FakeLiang

Automatic Attack Graph Verification Agent Read in an attack g...

Exploit for CVE-2026-91136

CVE-2026-91136 — Divi Plus ≤ 2.4.0 — Unauthenticated Arbitrary...

gitleaks

Gitleaks ┌─○───┐ │ │╲ │ │ │ ○ │ │ ○ ░ │ └─░───┘ !WARNING Gitleaks está completo en cuanto a funcionalidades. No estoy incorporando nuevas funciones en Gitleaks. Las versiones futuras serán solo parches de seguridad. Estoy centrando mi atención en Betterleaks license:...

Multiple vulnerabilities in rpm.rte affect AIX.

IBM SECURITY ADVISORY First Issue: Mon Oct 12 00:46:10 CDT 2026 Updated: Fri Oct 30 05:10:50 CDT 2026 Update: Added installation instruction as a NOTE to install rpm.rte fileset version 4.20.1.2003 with '-F' option. The most recent version of this document is available here:...

hsecscan

hsecscan Un escáner de seguridad para cabeceras de respuesta HTTP. Requisitos Python 2.x Módulos de Python os.path argparse sqlite3 urlparse urllib2 urllib json ssl Instalación $ pip install hsecscan Uso $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POS...

CryptoLyzer

CryptoLyzer es un analizador rápido, flexible y completo de protocolos criptográficos de servidor TLS, SSL, SSH, IKE, DNSSEC y configuraciones relacionadas cabeceras HTTP, registros DNS y generador de huellas digitales JA3, HASSH con interfaces API y CLI. Use CryptoLyzer cuando necesite auditar...

poco-f6-unlock

POCO F6 / Redmi Turbo 3 — Bootloader Unlock A reproducible,...

K000163653: Apache HTTP Server vulnerabilities CVE-2026-56449 and CVE-2026-57941

Security Advisory Description CVE-2026-56449 Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. CVE-2026-57941 Use After Free vulnerability in Apache HTTP Server's modhttp2 via...

Sublist3r

Acerca de Sublist3r Sublist3r es una herramienta de Python diseñada para enumerar subdominios de sitios web utilizando OSINT. Ayuda a los probadores de penetración y cazadores de bugs a recolectar y reunir subdominios para el dominio que están atacando. Sublist3r enumera subdominios utilizando...

CVE-2026-77363: Origin Validation Error

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a maliciou...

CVE-2026-92682: Incorrect Authorization

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

Important: openssl

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

PT-2026-110598

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.22 Description A denial of service issue exists where the NanoNemotronVLImageProcessor disables Pillow decompression bomb protection process-wide by setting Image.MAX IMAGE PIXELS to None. This allows remote...

Security and Robustness Analysis of Encrypted Communications for Local Home Automation: ESPHome Native API and MQTT over TLS 1.3

The expansion of the Internet of Things IoT in residential and local automation environments has highlighted the limitations of considering the internal network as an inherently trusted domain. Man-in-the-middle MitM attacks, such as ARP spoofing, can allow traffic interception or manipulation wh...

CVE-2026-109229: Improper Handling of Highly Compressed Data (Data Amplification)

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...

PT-2026-110630

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

PT-2026-110862

Name of the Vulnerable Software and Affected Versions obsidian-tc versions prior to 1.3.1 Description The Streamable HTTP transport fails to validate the Host or Origin header and lacks DNS-rebinding protection. DNS-rebinding is a technique used to bypass the Same-Origin Policy, allowing a websit...

EulerOS 2.0 SP11 : unbound (EulerOS-SA-2026-4293)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare loca...

SMB Network Service Reporter

This plugin aggregates SMB network service settings collected by individual detection plugins and reports the result as a structured internal host tag. The structured data object is reported even when only a subset of the source plugins ran. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'...

AlmaLinux 9.2 [TuxCare] Security Update: microcode_ctl (ALMALINUX9.2:CLSA-2026:1791485704)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791485704 advisory. - Improper handling of values for some IntelR Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow an escalation of...