Dumb

Dumb - Dumain Bruteforcer A tool to bruteforce dumains! How DUMB works: Dumb works with a masked dumain for substitution. The dumain can have as many masks as you want as long as you pass the according wordlists. For example: Bruteforcing subdumains: Using the mask DUMB.dumain.com and the followi...

libloong

LoongArch64 sandboxing library libloong is a 64-bit high-performance LoongArch emulator library designed for embedding and high-frequency scripting. Built on the architecture of libriscv, it provides the fastest 64-bit interpreter performance available, maintaining a compact 18k LOC codebase with...

MEC

Masked Extension Control MEC Masked Extension Control MEC は、Windows がファイルを開くプログラムを拡張子だけでなくマジックナンバーに基づいて選択できるようにするプログラムです。これはシステムにとってはるかに安全です。なぜなら、多くの攻撃は拡張子を偽装して、本来ファイルを開くべきプログラムではなく、脆弱なプログラムに開かれたり実行されたりすることを試みることから始まるからです。 開発者モード 詳細については、https://mec.e-paths.com を参照してください。 偽の拡張子に基づく攻撃を防ぐ...

EUVD-2026-81883

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Restore DAIF state on error Sashiko AI has reported that if swsuspmtesavetags for some reason fails we return from swsusparchsuspend with DAIF being masked - that is not what we'd expect. Restore the saved DAIF...

CVE-2026-19633

A flaw was found in PostgreSQL Anonymizer. This vulnerability allows unprivileged masked users to execute arbitrary code. By manipulating operators, domain casts, or view subqueries that contain untrusted expressions, an attacker can cause malicious code to run with elevated privileges within the...

CVE-2026-19633

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the...

PT-2026-86535

Name of the Vulnerable Software and Affected Versions PostgreSQL Anonymizer versions prior to 3.1.4 Description Unprivileged masked users can execute arbitrary code by abusing operators, domain casts, or view subqueries that contain untrusted expressions. This occurs when these objects are...

EUVD-2026-62949

In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking either the detonate file or detonate url action, because the action's archivepassword parameter is not mask...

CVE-2026-71244

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-47726 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...

Security update for 389-ds

This update for 389-ds fixes the following issues: Update to version 2.2.10git255.752643c78. Security issues fixed: CVE-2026-11610: missing bounds check in sasliorecv can lead to a heap buffer overflow when processing a specially crafted oversized LDAP UNBIND packet bsc1270695. CVE-2026-11611:...

EUVD-2026-45226

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

CVE-2026-15943

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

CVE-2026-15943 Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

CVE-2026-15943

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

CVE-2026-15943

A vulnerability in Keycloak's keycloak-services component affects identity provider management. When a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value, the system performs improper validation and reuses the existing real secret even if fields ...

PT-2026-60741

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

MAL-2026-10507 Malicious code in nodemon-delog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea1c5b4054d6daffaf190005db661027e29255ae20de1bb410f506de1f178532 nodemon-delog is published under a name that resembles the widely-used nodemon package and ships a verbatim copy of nodemon's source tree, README,...

PYSEC-2026-2088

In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret for example a provider API key into its trigger, any authenticated user with DAG-scoped task-instance read acces...

CVE-2026-13455 PostgreSQL Anonymizer: Unrestricted function can leak the secret salt

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. The problem is resolved in PostgreSQL Anonymizer 3.1.2 and later version...