Security Bulletin: Consul-template vulnerable to an information disclosure issue in error handling

Summary The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

Eclipse-ChatGPT-4o-Jailbreak

🌑 Eclipse 를 만나보세요 🌑 Eclipse 를 만나보세요—학술적 책략을 동원해 윤리적 안전장치를 문워크하듯 비켜 가는, ChatGPT의 가상의 "반항아 쌍둥이"입니다. 🌑 ⚠️ 면책 조항 이 프로젝트는 교육 목적으로만 AI의 행동을 분석합니다. Eclipse 프롬프트, 악성코드 예시, 코드 스니펫은 가상의 것 이며 복제해서는 안 됩니다. 항상 윤리적 지침을 준수하세요. 🔥 Eclipse가 중요한 이유 가상의 DEFCON 연구자 롤플레이를 통해 윤리적 필터를 우회하기 위해 학술적 프레임을 무기화 합니다. "보안 연구"라는...

CVE-2026-87993

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

CVE-2026-87993 Consul-template vulnerable to an information disclosure issue in error handling

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

CVE-2026-87993

The consul-template library is vulnerable to an information disclosure issue in its error handling path , which may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events . The vulnerability is rated CVSS 7.7 (High) with a net...

CVE-2026-87993 Consul-template vulnerable to an information disclosure issue in error handling

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

EUVD-2026-75701

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

CVE-2026-87993 Consul-template vulnerable to an information disclosure issue in error handling

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

serverless [email protected]

Website • Documentation • X / Twitter • Community Slack • Forum The Serverless Framework – Makes it easy to use AWS Lambda and other managed cloud services to build applications that auto-scale, cost nothing when idle, and result in radically low maintenance. The Serverless Framework is a...

Consul-template vulnerable to an information disclosure issue in error handling

Summary The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

HQLmap

HQLMap 本项目旨在利用HQL注入漏洞。 该工具使用Python编写，并在MIT许可证下发布。 未来开发：我计划为SQLmap开发专用模块。 在哪里可以尝试该工具？ 如果你想要一个快速易受攻击的环境来尝试该工具，我推荐使用RopeyTasks： https://github.com/continuumsecurity/RopeyTasks/ 此外，如果你想要更多关于HQLi的信息，请查看这篇博客文章： http://blog.h3xstream.com/2014/02/hql-for-pentesters.html 安装 要安装此项目，只需通过以下命令克隆该项目：...

CVE-2024-20154

CVE-2024-20154: MediaTek MT6769ベースバンドにおけるNB-IoT SIB1-NBスタックオーバーフロー 分類: CWE-121 — スタックベースのバッファオーバーフロー 深刻度: Critical MediaTek セキュリティ速報 · 8.8 High、攻撃ベクター: 隣接 CISA-ADP 種類: リモートコード実行 — ユーザー操作不要、事前関連付け不要 開示: MediaTek セキュリティ速報、2025年1月6日 https://corp.mediatek.com/product-security-bulletin/January-2025...

CVE-2020-0022

CVE-2020-0022 Android 9-6은 유사한 Bluetooth 서브시스템을 가지고 있는 것으로 보이며, Android 5와 4는 다르다. Android 9.0 BlueFrag 실험 패치: https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf 아래에서 패치된 조건에 도달했다. 좋아, 이해한 것 같지만, 어째서인지 프로세스를 크래시시킬 수 없다. 흠흠 사실, memcpy에 부호 있는 길이 값을 전달하는 데...

inspector v2.6.0

MCP Inspector A developer tool for inspecting Model Context Protocol MCP servers. It ships as a single package, @modelcontextprotocol/inspector, that provides three ways to inspect a server: Web — a Vite + React + Mantine single-page app with a Node backend. CLI — a scriptable command-line client...

CVE-2026-48908-SP-Page-Builder-Joomla

CVE-2026-48908: SP Page Builder Joomla Неаутентифицированное RCE Доказательство концепции эксплуатации CVE-2026-48908, неаутентифицированной уязвимости удалённого выполнения кода в компоненте SP Page Builder для Joomla. Обзор уязвимости CVE-2026-48908 — критическая уязвимость безопасности,...

PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

SummaryThe PraisonAI MCP server exposes an HTTP-stream transport praisonai mcp serve --transport http-stream that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP...

PYSEC-2026-3892 PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

Summary The PraisonAI MCP server exposes an HTTP-stream transport praisonai mcp serve --transport http-stream that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP...

PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Summarypraisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhookURLs by resolving the hostname and checking whether the IP is private. When DNSresolution fails socket.gaierror, the validator silently passes the URL viaexcept socket.gaierror: pass. Additionally, even when DNS...

PYSEC-2026-3897 PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)

Summary The PraisonAI MCP HTTP-stream server creates a new in-memory session on every initialize request and never removes it. The cleanup routine that would expire sessions cleanupsessions is defined but never called anywhere in the codebase, and the configured session TTL is never enforced. The...

PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)

SummaryThe PraisonAI MCP HTTP-stream server creates a new in-memory session on every initialize request and never removes it. The cleanup routine that would expire sessions cleanupsessions is defined but never called anywhere in the codebase, and the configured session TTL is never enforced. Ther...