CVE-2026-16751

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery...

CVE-2026-16751 Ente Museum Server Authorization Bypass Vulnerability

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery...

CVE-2026-16751 Ente Museum Server Authorization Bypass Vulnerability

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery...

EUVD-2026-50323

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery...

PT-2026-65794

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery...

AI is distorting the Holocaust (Lock and Code S07E10)

This week on the Lock and Code podcast … In May of last year, a warning about AI came from somewhere unexpected: The Auschwitz-Birkenau State Museum. Posting publicly on social media, the museum warned about a Facebook account using generative AI to create fake images of people who died in the...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: My coauthor Nathan E. Sanders and I are speaking at the Rayburn House Office Building in Washington, DC at noon ET on November 17, 2025. The event is hosted by the POPVOX Foundation and the topic is “AI and Congress: Practical Step...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: helm-set-status, conjur-cli, nerdctl, configmap-reload, http-echo, kbld, kubevela, kubebuilder, terraform-provider-time, kubernetes-csi-external-health-monitor, timoni, prometheus-adapter, smarter-device-manager, kubelet-csr-approver, kubernetes-csi-external-attacher...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: helm-set-status, conjur-cli, nerdctl, configmap-reload, http-echo, kbld, kubevela, kubebuilder, terraform-provider-time, kubernetes-csi-external-health-monitor, timoni, prometheus-adapter, smarter-device-manager, kubelet-csr-approver, kubernetes-csi-external-attacher...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: helm-set-status, conjur-cli, nerdctl, configmap-reload, http-echo, kbld, kubevela, kubebuilder, terraform-provider-time, kubernetes-csi-external-health-monitor, timoni, prometheus-adapter, smarter-device-manager, kubelet-csr-approver, kubernetes-csi-external-attacher...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: conftest-fips, vertical-pod-autoscaler, kube-bench, dynamic-localpv-provisioner, terraform-provider-azapi-fips, redpanda, prometheus-postgres-exporter-fips, grafana-fips, newrelic-nri-statsd, prometheus-alertmanager, restic-fips, vault, chisel-fips, dask-gateway,...

EUVD-2014-7526

Malware in sbrugna...

EUVD-2014-7565

Malware in sbrugna...

EUVD-2024-23109

Malicious code in bioql PyPI...

CVE-2025-55198 vulnerabilities

Vulnerabilities for packages: helm-set-status, flux-source-controller, cerbos, trivy, helm-push, nova, kargo, helm-operator, helm-mapkubeapis, pluto, envoy-gateway, zarf, rancher-fleet, cilium-cli, k8ssandra-client, flux-helm-controller, k9s, trivy-operator, chartmuseum, zot, chart-testing,...

GHSA-9H84-QMV7-982P vulnerabilities

Vulnerabilities for packages: helm-set-status, flux-source-controller, cerbos, trivy, helm-push, nova, kargo, helm-operator, helm-mapkubeapis, pluto, envoy-gateway, zarf, rancher-fleet, cilium-cli, k8ssandra-client, flux-helm-controller, k9s, trivy-operator, chartmuseum, tw, chart-testing, zot,...

Black Hat 2025: Why We Built a Museum Instead of a Booth

Think you know what to expect from a conference booth? Think again. Forget the cliches: the swag destined for the back of your wardrobe, the formula one simulators, the marketing trickery. Instead, step into a new kind of conference experience, one that takes you on a journey through past, presen...

CVE-2024-25802

SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the attack payload is the file content...

CVE-2024-25801

SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name not the content of a file...

berkshiremuseum.org Cross Site Scripting vulnerability OBB-4038544

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...