sadcloud

Sadcloud sadcloud ist ein Tool zum Aufsetzen unsicherer AWS-Infrastruktur mit Terraform. Es unterstützt ca. 84 Fehlkonfigurationen in 22 AWS-Services. Die anfängliche Auswahl an Fehlkonfigurationen stammt aus ScoutSuite, dem Multi-Cloud-Auditing-Tool von NCCGroup. sadcloud wurde entwickelt, um...

TataShops-cyber-check-attacks

TataShops — Application Security & DAST Laboratory TataShop...

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Summary Injection Defense is a purpose-built prompt injection defense layer. It scans LLM inputs through six detection categories: instruction overrides, authority claims, boundary manipulation, obfuscation, financial manipulation, and self-harm instructions. The defense is misconfigured by...

EUVD-2026-43179

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats...

Nuclei_Templates

🎯 Nuclei Templates A large personal collection of 50,000+...

EUVD-2026-92870

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/buffer: An alert is added in trytofreebuffers for folios that have no buffers attached. trytofreebuffers can be called on folios with no buffers attached when filemapreleasefolio is invoked on a folio that belongs to a mapping...

CVE-2026-19553

ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to...

UBUNTU-CVE-2026-19553

ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to...

CVE-2026-91085 Apache Karaf: config:install missing ACL entry allows privilege escalation to admin

Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files etc/org.apache.karaf.command.acl..cfg. SecuredSessionFactoryImpl.checkSecurity resolves the roles required for an invocation and, when no ACL rule matches the command, fails...

CLEANSTART-2026-IJ88105 In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver

Security vulnerability affects the elasticsearch package. In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver...

DroidSniper

DroidSniper - Misconfigured Android Debug Bridge Scanner 🎯 This tool, DroidSniper, is designed to detect misconfigured Android Debug Bridge ADB protocols on Android devices. These devices are vulnerable to unauthorized access via ADB due to misconfiguration. By scanning for ADB instances lacking...

CVE-2026-66070

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-66070

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

EUVD-2026-85625

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-66070

RabbitMQ is a messaging and streaming broker containing a vulnerability in the rabbit_mgmt_cors.erl component. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6 , the match_origin/1 function incorrectly reflected the request Origin while allowing credentials when a wildcard (*) was configured....

EUVD-2026-84343

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

SUSE CVE-2026-90362

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Drop devpmoppsetrate0 devpmoppsetrate0 removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Drop the explicit call to it. Every call sit...

Security Misconfiguration org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center

This High severity Security Misconfiguration vulnerability was introduced in versions 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Security Misconfiguration vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of...

Security Misconfiguration org.bouncycastle:bcprov-jdk18on, org.bouncycastle:bcprov-lts8on Dependency in Jira Software Data Center

This High severity Security Misconfiguration vulnerability was introduced in versions 9.12.1, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This Security Misconfiguration vulnerability, with a CVSS Score of 7.1 and a CVSS...