what-you-reveal

╦ ╦╦ ╦╔═╗╔╦╗ ╦ ╦╔═╗╦ ╦ ╦═╗╔═╗╦ ╦╔═╗╔═╗╦ ║║║╠═╣╠═╣ ║ ╚╦╝║ ║║ ║ ╠╦╝║╣ ╚╗╔╝║╣ ╠═╣║ ╚╩╝╩ ╩╩ ╩ ╩ ╩ ╚═╝╚═╝ ╩╚═╚═╝ ╚╝ ╚═╝╩ ╩╩═╝ SYSTEM ANALYSIS TOOL // BROWSER FINGERPRINT DEMO What You Reveal is a privacy analysis tool designed to show exactly what information your browser exposes to websites. It...

CVE-2026-108659 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's...

voila (>=0.2.0a2, <=0.2.2), voila-gridstack (>=0.1.0a3, <=0.1.0a5) +1 more potentially affected by CVE-2026-86049 via jupyter-server (0.3.0)

jupyter-server PYPI version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - voila =0.2.0a2, =0.1.0a3, =0.1.0a1, =0.1.0a4 Source cves: CVE-2026-86049 Source advisory: OSV:PYSEC-2026-4054...

Verifiable Randomness for Blockchain-Based Lottery Systems

As lotteries and other high-stakes decentralized applications increasingly depend on unpredictable randomness for their operations, the lack of a secure and transparent on-chain random number generator that is verifiable by all participants remains a critical open problem. Various approaches to...

Malicious Package

Overview link-async-global-reveal-md is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

voila (>=0.2.0a2, <=0.2.2), voila-gridstack (>=0.1.0a3, <=0.1.0a5) +1 more potentially affected by CVE-2026-86049 via jupyter-server (0.3.0)

jupyter-server PYPI version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - voila =0.2.0a2, =0.1.0a3, =0.1.0a1, =0.1.0a4 Source cves: CVE-2026-86049 Source advisory: OSV:GHSA-C3MW-737P-C7G2...

Malicious code in @xiaohhhh1/canvas-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34add291ef7584aec7041449cb2e80d36ae98f93c2725e1aa018707e3334119 On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/agent-relay and treats inboun...

CVE-2026-0637

The CVE pertains to WS02 products where an Event Publisher output adapter configured with irrelevant properties logs those properties without proper validation or sanitization. This can expose sensitive data (e.g., user credentials) to anyone with access to the wso2carbon logs, enabling unauthori...

GHSA-F2R8-JV7C-XQMP Electron: DevTools embedder handler executes arbitrary files via shell open

Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend such as a malicious DevTools extension could use this to execute native code outside the sandbox. Apps are only...

PT-2026-68956

Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend such as a malicious DevTools extension could use this to execute native code outside the sandbox. Apps are only...

CVE-2026-67292

FreeRDP before 3.29.0 is affected by a buffer over-disclosure in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client reuses a fixed 1024-byte Pong response stream, not sealing its length to the received Ping payload. A non-empty Ping from a malicious gateway/WebSocke...

SUSE CVE-2026-6339

Mattermost versions 11.5.x = 11.5.1, 11.4.x = 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an authenticated channel member to force the reveal of a burn-on-read message without recipient consent via a crafted Markdown image tag.. Mattermost...

Hugging Face Has a Deepfake Nudes Problem

Researchers tested top image editing models on Hugging Face and found they could easily create explicit deepfakes—and 1,000 image editing prompts show how people use the software...

Just Testing, Move Along: Evasion of LLM-Based System Log Interpretation by Prompt Injection

Large Language Models LLMs are increasingly integrated into Security Operations Center SOC workflows, where they support analysts in tasks such as the interpretation of system logs. However, the ability of LLMs to directly process untrusted textual input also introduces new attack surfaces. In...

CVE-2024-23568

HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. Displaying version information of software could allow an attacker to determine which vulnerabilities are present in the software, particularly if an outdated...

voila (>=0.2.0a2, <=0.2.2), voila-gridstack (>=0.1.0a3, <=0.1.0a5) +1 more potentially affected by CVE-2026-5422 via jupyter-server (0.3.0)

jupyter-server PYPI version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - voila =0.2.0a2, =0.1.0a3, =0.1.0a1, =0.1.0a4 Source cves: CVE-2026-5422 Source advisory: OSV:PYSEC-2026-2532...

voila (>=0.2.0a2, <=0.2.0a3), voila-gridstack (>=0.1.0a3, <=0.1.0a5) +1 more potentially affected by CVE-2025-53000 via nbconvert (6.0.0a6)

nbconvert PYPI version 6.0.0a6 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - voila =0.2.0a2, =0.1.0a3, =0.1.0a1, =0.1.0a2 Source cves: CVE-2025-53000 Source advisory: OSV:PYSEC-2026-1691...

pwn-grind

Description Daddy, teach me how to use random value in pro...

voila (>=0.2.0a2, <=0.2.2), voila-gridstack (>=0.1.0a3, <=0.1.0a5) +1 more potentially affected by CVE-2026-44727 via jupyter-server (0.3.0)

jupyter-server PYPI version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - voila =0.2.0a2, =0.1.0a3, =0.1.0a1, =0.1.0a4 Source cves: CVE-2026-44727 Source advisory: OSV:PYSEC-2026-366...

Malicious code in zomato-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a23c3c63a9064636250be7dffa3781af0f9cdfcfd11a8da875be470c6952033e On npm install, the package's preinstall lifecycle script runs curl against http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site/install/ carrying the...