windiff

WinDiff About WinDiff is an open-source web-based tool that allows browsing and comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the operating system. The binary database is automatically updated to include information from the latest Windo...

K000163557: Linux kernel vulnerability CVE-2026-43313

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix NULL-pointer dereference in acpiprocessorerratapiix4 In acpiprocessorerratapiix4, the pointer dev is first assigned an IDE device and then reassigned an ISA device: dev =...

Security Bulletin: Multiple vulnerabilities in IBM Aspera HTTP Gateway

Summary Multiple vulnerabilities were addressed in IBM Aspera HTTP Gateway version 2.3.5 Vulnerability Details ID:WS-2026-0043 DESCRIPTION: Denial of service via exponential $ref expansion in ExpandSpec/ExpandSchema in github.com/go-openapi/spec. The expander inlines every $ref without memoizatio...

Notes

Ingeniería de Seguridad en Google: Mis Notas de Estudio para la Entrevista Por nolang Soy ingeniero de seguridad en Google y estas son las notas que tomé mientras estudiaba para las entrevistas. Este es mi primer trabajo en seguridad y mucha gente me ha preguntado cómo estudié. Mis notas consiste...

attackintel

UPDATE 26 Nov 2018 MITRE has deprecated the ATT&CK API functionality and will soon be phasing it out. They have moved to utilizing STIX. My code will be available for reference but you can check out my ATT&CK Intel webapp which is in the preliminary phases of development and offers the same info...

responsible-ai-toolbox

Responsible AI Toolbox La IA responsable es un enfoque para evaluar, desarrollar e implementar sistemas de IA de manera segura, confiable y ética, y tomar decisiones y acciones responsables. Responsible AI Toolbox es un conjunto de herramientas que ofrece una colección de interfaces de usuario y...

Exploit for Missing Authentication for Critical Function in Apache Artemis

CVE-2026-57967 — Apache ActiveMQ Artemis Unauthenticated Sessi...

threatcl

threatcl 使用 HCL 进行威胁建模 hcltm 发生了什么？ hcltm 已更名为 threatcl。欢迎！ 概述 !TIP 想阅读新的文档？请访问 threatcl.dev 威胁模型可以通过多种方式进行记录。从简单的文本文件，到更深入的 Word 文档，再到完全仪表化的集中式解决方案中的威胁模型。威胁模型的两个最有价值的属性是能够清晰记录威胁，并能够推动有价值的变更。 threatcl 旨在通过关注以下目标，提供一种 DevOps 优先的方法来记录系统威胁模型： 简单的文本文件格式 简单的 CLI 驱动用户体验 集成到版本控制系统（VCS）中 此仓库是 threatcl CL...

PetitPotam

Detección de ataques de relay NTLM PetitPotam Un paquete de Zeek para detectar algunos intentos de desencadenar ataques de relay NTLM mediante el exploit Petit Potam. Este paquete detectará lo que parecen ser intentos de explotación exitosos y fallidos. Hace una distinción entre ellos examinando ...

Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-199)

Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized sha...

Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-198)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth...

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-197)

Incorrect Authorization in Elasticsearch Leading to Privilege Escalation Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect...

Elasticsearch 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-196)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursio...

Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-195)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user with connector management privileges could cause t...

Elastic Agent / Endpoint 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-194)

Uncaught Exception in Elastic Endpoint Leading to Denial of Service Uncaught Exception CWE-248 in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in zstd-jni, snappy-java, and Apache Parquet

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in zstd-jni, snappy-java, and Apache Parquet. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-90559 DESCRIPTION: snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in...

Kibana 9.4.8, 9.5.5 Security Update (ESA-2026-193)

Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management...

Elasticsearch 9.4.7, 9.5.3, 8.19.23 Security Update (ESA-2026-192)

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to Denial of Service via Excessive Allocation CAPEC-130. Elasticsearch enforces a size limit on the user-suppli...

Kibana 9.4.0 Security Update (ESA-2026-191)

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal API surface within the Metrics Experience feature did not enforce a...

Elasticsearch 9.4.8, 9.5.5 Security Update (ESA-2026-190)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation CAPEC-130. Affected Versions: 9.x:...