gitlab-profile

TEST STATUS : ↳ core-orchestrator tester ↳ documentation tester CREATION DATE: 2025-10-24 09:50 PM ↳ Alberto Marangelo - @theGlitched !WARNING ⚠️ This project is in beta! 🎉 yeah! We're happy to announce that the beta version will soon be complete! From the version 0.153 is currently started all...

cloudquery

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

content-packs

Content Packs for Eventum Ready-to-use generator projects for Eventum that produce realistic synthetic events mimicking real SIEM data sources. Each generator outputs ECS-compatible JSON that can be ingested directly into Elasticsearch, OpenSearch, or any SIEM platform. Quick Start With Docker...

vol-rs

vol-rs A port of the Volatility 3 memory forensics framework from Python to Rust. It reads the same memory images, runs the same plugins with the same options, and prints the same output, byte for byte, a good deal faster. License This project is a port of Volatility 3 and is therefore an...

CVE-2026-77474 dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open

destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

CVE-2026-77474: Uncontrolled Resource Consumption

destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

PT-2026-115657

destructive command guard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

EUVD-2026-96601

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user...

EUVD-2026-96598

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's...

CVE-2026-108662

Versions of JeecgBoot up to and including 3.9.5 are vulnerable to a missing authorization flaw in the /sys/tenant/deleteTenantPackUser endpoint. This vulnerability allows low-privileged authenticated users to perform unauthorized actions by supplying arbitrary userId and packId values in a PUT re...

CVE-2026-108659 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's...

CVE-2026-108659 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's...

CVE-2026-108662: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user...

CVE-2026-108659: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-125)

Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service Improper Handling of Highly Compressed Data CWE-409 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding Streams management privileges could supply specially...

CVE-2026-15382

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

CVE-2026-15382

The Ultimate Addons for WPBakery Page Builder WordPress plugin, in versions before 3.21.4 , is vulnerable to an unauthenticated custom icon font deletion. The root cause is the failure to perform capability or nonce checks before processing requests to delete custom-uploaded icon font packs. An u...

CVE-2026-15382: External Control of File Name or Path

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

Open Security Benchmark: Towards Autonomous Enterprise Cyber Defense

Enterprises are moving toward autonomous cyber defense: agentic AI that builds situational awareness of an organization's security state and reasons from it to assessments, decisions, and actions. This rests on a holistic view of the enterprise's security state, the continuous, cross-vendor pictu...

GHSA-HC4M-Q9JH-XW4J nono-cli'scregistry pack verification can fail open when provenance metadata is absent

Summary Registry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant: - /.config/nono/packages/lockfile.json - /.config/nono/packages///.nono-trust.bundle Testing shows that nono fails closed when a pack has a trust bundle b...