Le Panthéon de la Souveraineté — Updated!

🏠 Developed on: GitLab | 🪞 Automated mirror on: GitHub 🏛️ The Pantheon of Sovereignty A 100% sovereign, redundant and secure cloud infrastructure, designed to completely break free from GAFAM. Version 1.1: Private network foundation, DNS request encryption for servers DoT and multi-datacenter...

semgrep v1.171.0

Code scanning at ludicrous speed. Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards. Semgrep supports 30+ languages and can run in an IDE, as a pre-commit check, and as part of CI/CD workflows. Semgrep is...

CVE-2026-10697 MFA Bypass in MOVEit Transfer

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...

CVE-2026-63765

CVE-2026-63765 affects Chatwoot

CVE-2026-15616

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

CVE-2026-65916

CyberPanel up to version 1.9.1 contains a missing authorization vulnerability in the cancelBackupCreation handler. An authenticated user can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt ba...

CVE-2026-15616

The Logto identity and access management platform fails to enforce locally configured Multi-Factor Authentication (MFA) during Single Sign-On (SSO) authentication. The vulnerability occurs when hasVerifiedSsoIdentity is true, allowing an attacker with a federated identity from a permissive upstre...

CVE-2026-15616 Local MFA not enforced during SSO sign-in

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

EUVD-2026-48301

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

CVE-2026-15616 Local MFA not enforced during SSO sign-in

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

CVE-2026-15616 Local MFA not enforced during SSO sign-in

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

GHSA-X445-F3H2-J279 Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

Summary Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider, becaus...

CVE-2026-16232: Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild

Overview On July 22, 2026, Check Point published a security advisory for multiple vulnerabilities affecting Security Management, Multi-Domain Management, and firewall products. The most urgent of these is CVE-2026-16232, an authentication bypass in the SmartConsole login process classified as...

vLLM has Remote DoS via Invalid Recovered Token Reinjection

SummaryA frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocabsize, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this reache...

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

Insecure Permission Assignment for Garmin OAuth Token Store Summarygarminconnect ≤ 0.3.4 wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask 022 the token file garmintokens.json was created world-readable 0o644. The file contains the DI...

sops v3.13.3

SOPS: Secrets OPerationS SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP. demo .. image:: https://i.imgur.com/X0TM5NI.gif .. image::...

installer v13.30.1

Overview Installation mql cnspec Scan your target platform Package Information Kubernetes Status Docker Containers: Homebrew: Install.sh: Install.ps1: macOS Pkg: Arch Linux: Installation The easiest way to install mql & cnspec is to use the install scripts. via Shell Script Linux and macOS...

Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access

Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management MDSM products, including a critical flaw that has come under active exploitation in the wild. The security flaw, tracked as CVE-2026-16232 CVSS score: 9.3, is an...

AZL-93270 CVE-2026-6390 affecting package nano 6.4-3

A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to...

UBUNTU-CVE-2026-6390

A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to...