Rocky Linux 8 [CIQ] Security Update: bind-dyndb-ldap / bind-dyndb-ldap-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3755)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243755 advisory. CVE-2024-2698 freeipa: delegation rules allow a proxy service to impersonate any user to access another target service CVE-2024-3183 freeipa: user can obta...

Rocky Linux 9 [CIQ] Security Update: ipa-client / ipa-client-common / ipa-client-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3754)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243754 advisory. freeipa: delegation rules allow a proxy service to impersonate any user to access another target service CVE-2024-2698 freeipa: user can obtain a hash of t...

regipy

regipy ⚠️ v6.0.0의 주요 변경 사항 버전 6.0.0에는 중요한 현대화 변경 사항이 포함되어 있습니다: Python 3.9+ 필요 - Python 3.6, 3.7, 3.8 지원 중단 attrs 라이브러리 제거 - 데이터 클래스가 이제 Python의 내장 dataclasses 모듈을 사용합니다 코드에서 내부 클래스Cell, VKRecord, Value, Subkey를 가져오고 attr.asdict와 같은 attrs 함수를 사용하는 경우 dataclasses.asdict로 전환하세요 자세한 내용은 CHANGELOG를...

regipy

regipy ⚠️ Breaking Changes in v6.0.0 Version 6.0.0 includes significant modernization changes: Python 3.9+ required - Dropped support for Python 3.6, 3.7, and 3.8 attrs library removed - Data classes now use Python's built-in dataclasses module If your code imports internal classes Cell,...

GhostTrace

GhostTrace Windows에 남겨진 소프트웨어의 흔적을 찾아내세요. 그 흔적이 다시 돌아오기 전에. GhostTrace는 침해 대응 담당자, 시스템 관리자, 보안에 관심 있는 고급 사용자를 위한 로컬 Windows 포렌식 추적 헌터입니다. 지속성Persistence, 실행Execution, 활동Activity, 잔여 아티팩트Leftover Artifacts를 검토 가능한 기록으로 매핑하고, 사용자가 명시적으로 선택할 때만 엄격하게 제한된 정리Cleanup를 수행합니다. 다운로드 | 요구 사항 | 빠른 시작 | 수집 항목...

openclaw-hardening-check

이 스크립트는 읽기만 수행합니다. 아무것도 수정하지 않으며, 안전함을 보장하지 않습니다. 녹색 출력은 아래 나열된 검사만 통과했음을 의미하며 그 이상은 아닙니다. OpenClaw 보안 강화 점검 openclaw-hardening-check.mjs는 의존성이 없고 오프라인에서 동작하는 작은 도구로, OpenClaw 설치 환경을 검토합니다. 로컬 설정, 패키지 메타데이터, 플러그인 및 스킬 매니페스트, 파일 모드, 그리고 Linux에서는 실행 중인 Gateway의 /proc 항목을 읽습니다. 파일을 변경하거나, OpenClaw 명...

Oihk-pentesting

OIHK-pentesting OIHK-pentesting is an autonomous multi-agent engine for authorized security assessments. A root planner delegates to recon, discovery, attack Privesc, validation, and reporting agents — and the engine itself enforces scope, egress, evidence, and resource policy no matter which mod...

AlmaLinux 9.2 [TuxCare] Security Update: ipa-client / ipa-client-common / ipa-client-epn / ipa-client-samba / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1763391572)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763391572 advisory. - A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for...

Security Bulletin: IBM Documentation Offline may be vulnerable to TLS authentication bypass and authority rebinding due to Node.js (CVE-2026-48618, CVE-2026-48930)

Summary IBM Documentation Offline uses Node.js as its runtime environment. Node.js is affected by two vulnerabilities related to TLS hostname handling. CVE-2026-48618 involves improper handling of Unicode dot separators during TLS certificate verification, which could allow an attacker performing...

mini-shai-hulud-scanner

미니 샤이훌루드 스캐너 현재 주요 패키지를 감염시키고 있는 npm/PyPI 공급망 웜을 위한 무료 오프라인 스캐너입니다. Intrudify 팀이 제작했습니다. 회원가입 불필요, 원격 측정 없음, 완전히 오프라인으로 실행됩니다. NHS CC-4781 · CVE-2026-45321 CVSS 9.6 · GHSA-g7cv-rxg3-hmpx 이 스캐너는 무엇인가요? 지난 몇 주 동안 npm install 또는 pip install을 실행했다면, 이 스캐너가 필요합니다. 특히 @tanstack/, @uipath/, @mistralai/,...

CVE-2026-97469

A flaw was found in PostgreSQL Anonymizer. An authenticated, unprivileged masked user can bypass access restrictions to execute restricted functions by embedding function calls within a subquery. By repeatedly invoking functions such as anon.hash, an attacker can collect output to deduce the...

CVE-2026-101089

Versions of Nezha before 2.2.7 are susceptible to an information disclosure vulnerability within the GET /api/v1/profile endpoint. This flaw allows authenticated users to retrieve their bcrypt-hashed password field. Because there are no rate limiting or audit trail constraints, an attacker can ex...

CVE-2026-101089 Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-101089 Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

EUVD-2026-88024

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-101089 Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-101089: Insufficiently Protected Credentials

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

A2A-ForensicTrace: Offline Verification of Tamper-Evident A2A Runtime Evidence

Security-relevant Agent2Agent A2A executions can cross organizational boundaries, leaving investigators without live access to all participating systems. Offline investigation involves checking preserved records and their cross-record relationships for consistency. This paper presents...

CVE-2026-100719

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure ...

CVE-2026-100719 Froxlor before 2.3.12 Credential Disclosure via DirProtections API

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure ...