CredMaster

CredMaster Launch a password spray / brute force attach via Amazon AWS passthrough proxies, shifting the requesting IP address for every authentication attempt. This dynamically creates FireProx APIs for more evasive password sprays. Shoutout to @ustayready for his CredKing and FireProx tools,...

windows

Windows !Buildbuildurl !Versiontagurl !Sizetagurl !Packagepkgurl !Pullshuburl Windows inside a Docker container. Features ✨ Runs Windows inside a Docker container Automatic download and hands-free installation Supports modern and legacy Windows releases Near-native performance with KVM accelerati...

CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Python 3 checker and configurable exploit hook for CVE-2026-90817 Securifera / Ryan Wincey. | ---|--- Product| REDCap Vanderbilt Affected| ≥ 13.3.0 until branch patch Fixed| 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard+ CVSS 3.1| 9.8 Critical...

b2evolution CMS <6.11.6 - Open Redirect

b2evolution CMS before 6.11.6 contains an open redirect vulnerability via the redirectto parameter in emailpassthrough.php. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-22840 info:...

CVE-2026-98814

A flaw was found in the Linux kernel's Non-Volatile Memory Express NVMe driver. A local attacker can cause a denial of service DoS or potentially escalate privileges by exploiting a use-after-free flaw. This issue occurs when an input/output I/O passthrough command is sent through a multipath...

CVE-2026-90458

A path traversal vulnerability was found in OpenStack Ironic Redfish vendor passthrough subscription management. An authenticated attacker with vendor passthrough privileges could use a crafted subscription id to access or delete arbitrary Redfish resources on a node's BMC. Mitigation There is no...

CVE-2026-114636

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entr...

EUVD-2026-107891

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entr...

CVE-2026-114636 Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entr...

CVE-2026-114636

Traefik version v3.7.13 is vulnerable to an authentication bypass within the Kubernetes Ingress NGINX provider . The root cause is that the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points fails to apply access-control annotations. Consequently, unauthenticated attacker...

CVE-2026-111817

A vulnerability in Apache Traffic Server causes chunked transfers to stall until a connection timeout occurs. This happens because the server waits for trailer bytes that have already been dropped via the proxy.config.http.drop_chunked_trailers configuration. The issue is active by default in ver...

CVE-2026-111817 Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout

Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed proxy.config.http.dropchunkedtrailers until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x i...

Security update for tiff

This update for tiff fixes the following issue: CVE-2026-18495: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough bsc1280164. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

UBUNTU-CVE-2026-98814

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

CVE-2026-98814

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

DEBIAN-CVE-2026-98814

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

AZL-108890 CVE-2026-98814 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

CVE-2026-98814

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

CVE-2026-98814 nvme: fix command effects log lifetime for multipath heads

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

EUVD-2026-103899

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...