Nimbus Vestige

Nimbus Vestige NV A forensic reconstruction engine for cloud and identity incident response. Given fragmented cloud, SaaS, and identity telemetry — control-plane logs, sign-in events, token and consent activity — NV reconstructs how an intrusion most likely moved across accounts and services,...

CVE-2026-117956

Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

SUSE CVE-2026-117956

Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

DEBIAN-CVE-2026-117956

Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117956

Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117956

The Nimbus Desktop Client component contains an invalid pointer vulnerability. This issue has been addressed in Firefox 159 and Firefox ESR 153.6 . No specific details regarding the root cause, practical consequences, or exploit availability are provided in the documents.

EUVD-2026-110987

Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117956 Invalid pointer in the Nimbus Desktop Client component

Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

PT-2026-126539

Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6...

RHLW-2026-4D628364A5512412 Lightwell Security Advisory: nimbus-jose-jwt 9.7.0.rhlw-00004

Red Hat Lightwell has released com.nimbusds:nimbus-jose-jwt 9.7.0.rhlw-00004 with a backported security fix. CVE-2025-53864: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in...

htb-nimbus-poc

HTB · Nimbus — PoC Proof-of-concept per la macchina Nimbus...

RHLW-2026-0A6FC4430620D7B4 Lightwell Security Advisory: nimbus-jose-jwt 9.7.0.rhlw-00002

Red Hat Lightwell has released com.nimbusds:nimbus-jose-jwt 9.7.0.rhlw-00002 with a backported security fix. CVE-2023-52428: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service resource consumption via a large JWE p2c header value aka iteration count for the...

CLEANSTART-2026-EQ87084 Connect2id Nimbus JOSE+JWT before v7

Security vulnerability affects the apache-hive package. Connect2id Nimbus JOSE+JWT before v7...

Malicious code in kite-nimbus-qim719-project (npm)

The package kite-nimbus-qim719-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in kelp-nimbus-ahk549-project (npm)

The package kelp-nimbus-ahk549-project was found to contain malicious code. --- Credit: OpenSSF source...

Directory Traversal

Overview org.apache.storm:storm-server is a distributed realtime computation system. Affected versions of this package are vulnerable to Directory Traversal via the uploadedJarLocation argument in the submitTopology and submitTopologyWithOpts processes. An attacker can access arbitrary files...

Incorrect Authorization

Overview org.apache.storm:storm-server is a distributed realtime computation system. Affected versions of this package are vulnerable to Incorrect Authorization due to insufficient validation of topology.blobstore.map during the rebalance process. An attacker can gain unauthorized access to...

CVE-2026-82432

Description Nimbus validated topology.blobstore.map against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could...

CVE-2026-82426

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...

CVE-2026-84179

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...