prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

vibebox

an ultrafast, open-source sandbox for running coding agents safely. English | 简体中文 VibeBox is a per-project micro-VM sandbox for running coding agents on macOS Apple Virtualization Framework. It’s optimized for a daily-driver workflow: fast warm re-entry, explicit mounts, and reusable sessions. W...

airgap

airgap Security for the modern AI age. No security layer is perfect. airgap is still experimental. Contributions welcome! Protected secrets airgap launches a target program e.g. an AI coding agent inside its own mount namespace and transparently replaces secrets with redacted versions. A program...

CVE-2026-121555

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all...

CVE-2026-121547

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname,...

CVE-2026-121432

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

CVE-2026-121555 Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all...

EUVD-2026-115900

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all...

EUVD-2026-115892

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname,...

CVE-2026-121547 dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname,...

CVE-2026-121547

Canop dysk versions prior to 3.8.2 are vulnerable to a terminal escape sequence injection (CWE-150). The issue occurs because the application renders unsanitized mount metadata in table and CSV output . A local attacker can craft FUSE mounts containing ESC/OSC sequences within mount-point names o...

CVE-2026-121547 dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname,...

EUVD-2026-115854

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

RLSA-2026:93461 Important: util-linux security update

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fixes: util-linux: TOCTOU in the mount program when setting up loop devices...

util-linux security update

An update is available for util-linux. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The util-linux packages contain a large variety of low-level system...

CVE-2026-121555: DrizzleTime Foxel: Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files…

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all...

CVE-2026-121547: Canop dysk: Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject…

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm: perform file ownership checks using the appropriate mount idmap Since the introduction of idmapped mounts, inode ownership checks for side-channel protection in mincore and madviseMADVPAGEOUT were performed against the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: do not BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

util-linux: TOCTOU in the mount program when setting up loop devices

A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the mount program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use TOCTOU window where an attacker can substitute th...