thymeleaf-check

thymeleaf-check ThymeleafCVE-2026-40477 / CVE-2026-41901 离线排查工具 —— 零依赖、单 jar、不联网。 两条 CVSS 9.0 的 SSTI 绕过,九天内连出两个修复版。它先回答「我中了哪几条」, 然后回答那个更难受的问题: 我这条版本线,有没有能升的修复版? 对 3.1.x ,有升到 3.1.5.RELEASE 就完事。 对 3.0.x 及更早 ,没有 —— 而那恰恰是装机面最大的一批人。 为什么需要它 两条 advisory 的受影响范围,在 OSV 里都是 introduced: 0: root@kitploit: cur...

PYSEC-2026-3795

opensslencrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files...

Google Solves Update Issue for Android Apps Installed from Unknown Sources

If you are wondering how to receive latest updates for an Android app—installed via a 3rd party source or peer-to-peer app sharing—directly from Google Play Store. For security reasons, until now apps installed from third-party sources cannot be updated automatically over-the-air, as Google does...