kube-monkey

kube-monkey kube-monkey is an implementation of Netflix's Chaos Monkey for Kubernetes clusters. It randomly deletes pods in the cluster, encouraging and validating the development of failure-resilient services. Apps opt in with a label, terminations happen during the hours and days you pick, and...

Big-Ass-Data-Broker-Opt-Out-List

Big Ass Data Broker Opt-Out List Symbols| Meanings ---|--- 💐| crucial ☠| high priority 🎫| requires driver’s license cross out your ID ! 📞| must pick up a gasp! phone 💰| site charges money for access or removal whaaaat? This list, also known as BADBOOL, was started in September 2017 and was most...

WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin tagDiv Opt-In Builder versions = 1.7.6...

WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin tagDiv Opt-In Builder versions = 1.7.6...

proposal-symbol-proto

Prototype Pollution Mitigation / Symbol.proto Authors : Santiago Díaz Google Champion : Shu-yu Guo Google Stage : 1 TOC Problem Description Spooky action at a distance Data-only attacks Issues with freeze, seal and preventExtensions The override mistake Coarse granularity Freezing points...

TJ-OPT

TJ-OPT Release Date September 9th 2024 Introduction As a pentester, there are many great resources, cheat sheets, and guidelines that contain a large amount of valuable information. However, it can be frustrating and time-consuming to find these notes or resources that are scattered all over the...

Sleeping Secrets: How Fine-Tuning Reawakens Privacy Risks in Language Models

Beyond adapting Large Language Models LLMs to specialized applications, fine-tuning has recently been shown to recover private information that is no longer accessible through direct queries. Previous fine-tuning recovery attacks, however, require genuine private supervision drawn from the same...

CVE-2026-101081

The D-Link DI-8400 running firmware version 16.07 is vulnerable to a stack-based buffer overflow in the Web Administration Service . The flaw exists within the menu_nat_more_asp function of the menu_nat_more.asp file, where manipulating the opt argument can trigger the overflow. This vulnerabilit...

PT-2026-99926

Name of the Vulnerable Software and Affected Versions D-Link DI-8400 version 16.07 Description A flaw in the Web Administration Service allows for a remote stack-based buffer overflow. This occurs when the opt argument is manipulated within the menu nat more asp function of the menu nat more.asp...

Vulnerability handling in VeloCloud Orchestrator (VCO) on-premises

VeloCloud has identified a vulnerability in VeloCloud Orchestrator VCO on-premises. This vulnerability allows external attackers to access privileged internal functions, which can compromise privacy, integrity, and availability. The vulnerability is actively exploited and has already been exploit...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nfttunnel: fixed a type confusion issue with geneveopt. When handling multiple NFTATUNNELKEYOPTSGENEVE attributes, the parsing logic should process each geneveopt structure individually and compactly. Therefore, whe...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is vulnerable to cache poisoning if the image is built FROM scratch. Additionally, changes to certain instructions—especially HEALTHCHECK and ONBUILD—do not trigger cache...

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

SummaryPraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset.This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

PYSEC-2026-3903 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

Summary PraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset. This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

Summary SVGO's opt-in removeScripts plugin did not inspect executable HTML content inside SVG elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting XSS. SVGO is an optimizer...

SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked

CVE: This vulnerability corresponds to CVE-2026-72789. Summary publishAccess.json is an opt-out list. The publish gate returns accessible for anything not explicitly listed in it. Encrypted notebooks are never written into that file, because only the administrator-gated setPublishAccess writes it...

CVE-2026-79632

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an...

CVE-2025-15691

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when...

CVE-2026-79632 WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an...

CVE-2026-79632

The WPFunnels WordPress plugin (versions before 3.13.0 ) contains a vulnerability where one of its opt-in submission handlers fails to perform authorisation or nonce checks . This flaw allows unauthenticated users to manipulate the request to provide arbitrary notification recipients and subjects...