CyberMeowfia

Sitio web: nebusec.ai · Twitter @nebusecurity · Lista de bugs 885+ Seguimiento de IonStack, sigue https://github.com/NebuSec/CyberMeowfia/issues/44 Últimas investigaciones IonStack parte II : GhostLock, un stack-UAF que ha existido en TODAS las distribuciones de Linux durante 15 años Linux Kernel...

cve-2022-27255

CVE-2022-27255 - Realtek eCos SDK SIP ALG 缓冲区溢出 本仓库包含演讲“探索OEM物联网设备的隐藏攻击面：利用Realtek eCos OS SDK中的一个漏洞攻陷数千台路由器”的材料，该演讲在DEFCON30上发表。 本仓库的内容包括： analysis: 自动化固件分析，用于检测CVE-2022-27255的存在（运行 analysefirmware.py）。 exploitsnexxt: PoC和利用代码。PoC应适用于所有受影响的路由器，但利用代码特定于Nexxt Nebula 300 Plus路由器。 ghidrascripts:...

Nebula

Nebula Nebula是一个云和（希望）DevOps渗透测试框架。它针对每个提供商和每个功能构建模块。截至2021年4月，它只涵盖AWS，但目前是一个持续进行的项目，希望将继续发展，测试GCP、Azure、Kubernetes、Docker或自动化引擎如Ansible、Terraform、Chef等。我开始编写它时正在阅读《Hands-On AWS Penetration Testing with Kali...

nebula

Nebula AI驱动的渗透测试 零层工作台 致谢 首先，我要感谢全能的上帝，祂是一切知识的源头。没有祂，这一切都是不可能的。 Nebula 将安全评估的工作组件整合到一个桌面界面上：终端、代码、浏览器、助手、文件、笔记、任务、发现和报告。 AI 可以调查、组织和编写。操作员定义范围、授予权限并决定运行的内容。 围绕操作员设计 集中一处工作。 从研究过渡到容器化终端，将有价值的输出作为证据保留，并将其带入发现和报告，而不会丢失上下文。 保持权限明确。 范围强制、审批暂停、硬预算和隔离的 OCI 执行位于 AI 辅助与受测系统之间。 留下持久的轨迹。...

CVE-2026-43499-pja110

网站：nebusec.ai · Twitter @nebusecurity · 漏洞列表（885+） 最新研究 IonStack 第二部分 ：GhostLock，一个存在于所有 Linux 发行版中长达 15 年的栈 UAF 漏洞 Linux 内核 📖 分析文章 · 🐦 推特 Longinus ：一个漏洞中的两个边界——通过单个漏洞刺穿 Chrome 的渲染器和 V8 沙箱，CVE-2026-6307 Chrome V8 📖 分析文章 · 🐦 推特 V8 中遗漏的写入屏障如何演变为 Chrome 中的 RCE ：CVE-2026-5865 Chrome V8 📖 分析文章 · 🐦 推特 ...

CVE-2026-61699

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...

CVE-2026-63464

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...

CVE-2026-55513

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollmenttokenttl security setting and per-network networkconfig.enrollmenttokenttl overrides. API host creatio...

CVE-2026-53602

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

CVE-2026-53603

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...

CVE-2026-55512

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC...

CVE-2026-53604

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real pki.CAResolver directly into mobilebundle.Build. Inside Build, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager, but Build...

CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...

CVE-2026-63464

CVE-2026-63464 affects nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN, in versions 0.6.0 through before 0.7.2 . The vulnerability is an SSRF that arises because non-admin operators (role user) can set allow_private: true on their own webhook subscription via POST/PATCH /api/v...

CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...

CVE-2026-61699 nebula-mesh: Certificate revocation is never enforced at the mesh

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...

CVE-2026-61699

nebula-mesh (forgekeep) is a self-hosted control plane for the Slack Nebula mesh VPN. Prior to v0.7.1 , the agent-side poller decodes the per-CA revocation blocklist from the server but discards it — it never writes pki.blocklist into the local config.yml, and the config generator has no field to...

CVE-2026-61699 nebula-mesh: Certificate revocation is never enforced at the mesh

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...

CVE-2026-55513

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. In versions 0.3.0 through before 0.5.0 , the POST /ui/hosts Web UI endpoint hardcodes a 24-hour enrollment token expiry instead of using the configured enrollment_token_ttl (server-wide or per-network) resolver that the API pat...

CVE-2026-55513 nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollmenttokenttl security setting and per-network networkconfig.enrollmenttokenttl overrides. API host creatio...