Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2022_5777)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225777 advisory. Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 CVE-2022-2505 Mozilla: Directory indexes for bundled resources reflected URL parameters...

Breaking the Bounded Entanglement Barrier for Quantum Position Verification

Position verification, introduced by Chandran et al. SIAM J. Computing 2014, allows verifiers to test a prover's claimed position by an interactive protocol. Classical position verification is impossible. Even for Quantum Position Verification QPV, there always exists an LOCC Local Operations and...

Clematis

Clematis 中文 | English 🛠️ PEファイル（EXE/DLL）を位置非依存シェルコードに変換するための強力なツール。 ✨ 主な機能 PEファイル（EXE/DLL）のシェルコード変換に対応 x86 / x64 両アーキテクチャに対応 コマンドライン引数のサポート 出力ファイルサイズを大幅に削減する LZNT1 圧縮アルゴリズムを内蔵 ステルス性を高める任意の難読化機能 📦 インストール 依存関係 pip install pefile lznt1 🚀 使い方 python clematis.py -f -o -g -c -p パラメータ | | desc| default|...

venom-rs

Rust 製 Shellcode Reflective DLL Injection sRDI（コードネーム: Venom） Shellcode reflective DLL injection（sRDI）は、プロセスインジェクション手法の一種で、指定した DLL を位置独立コード（position-independent code）へ変換し、お気に入りの shellcode インジェクション＆実行手法を使って注入できるようにするものです。 特徴 リフレクティブローダーのサイズは約 4KB です。...

CVE-2024-34221

基于 PHP 和 MySQL 的人力资源管理系统项目免费源代码 提交者：Kha Do 漏洞类型 权限设置不当 描述 SourceCodester 人力资源管理系统 1.0 中的 /hrm/controller/ccity.php?positionedit= 存在权限设置不当漏洞，攻击者可访问普通用户无权访问的功能。 受影响组件 路径 URL：/hrm/controller/ccity.php?positionedit= 参数：position.php 影响 攻击者可使用普通账户添加新职位，而普通用户本无权执行此操作。 POC...

CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

DEBIAN-CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

PT-2026-97544

Name of the Vulnerable Software and Affected Versions automation-controller affected versions not specified Description A flaw exists in the install-bundle endpoint. When a System Administrator downloads an install bundle for an execution or hop node, the controller signs an X.509 certificate usi...

CVE-2026-88993

The All Bootstrap Blocks WordPress plugin, affecting versions up to and including 1.3.31 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the plugin fails to properly escape a block attribute before outputting it into an HTML tag-name position . This allows us...

CVE-2026-91984

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984

Vikunja before 2.6.0 suffers from a Broken Object-Level Authorization in its task-position endpoints. The application fails to validate that a user-supplied project_view_id belongs to the task's own project, allowing authenticated attackers to insert task position rows into arbitrary other tenant...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

EUVD-2026-78655

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

PT-2026-91876

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position button' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-91984: Authorization Bypass Through User-Controlled Key

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

PT-2026-92098

Vikunja before 2.6.0 fails to validate that user-supplied project view id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-86889

A certificate validation issue was addressed with improved certificate validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to intercept network traffic...