CVE-2026-116677

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

EUVD-2026-111234

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

AfterLife

AFTERLIFE Revocation Persistence Detection Lab When the password reset succeeds but the attacker never leaves. A local red/blue lab for one vulnerability class: the credential that outlives the event that was supposed to kill it. It ships the exploit, the root cause, the fix, a three-rule detecti...

CVE-2026-29145-Tester

CVE-2026-29145 Testing Environment 📌 Overview This repository contains a proof-of-concept PoC environment designed to test for CVE-2026-29145. The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS CLIENTCERT implementation. When OCSP Online Certificate Status Protocol is...

CVE-2026-117499

The @fastify/session plugin for Fastify is vulnerable to a session revocation bypass via a logout race condition in all releases before 11.1.6 . With default rolling session behavior, a request that restores a session before a logout can save a copy after a concurrent request completes the destro...

CVE-2026-117499 @fastify/session vulnerable to session revocation bypass via a logout race condition

@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session...

vault

Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...

afot

Automation FOrensics Tool The Automation FOrensics Tool AFOT is an automation tool build in Python and used for Windows Forensics in order to combine the following tools: AnalyzePESig http://didierstevens.com/files/software/AnalyzePESigV0002.zip National Software Reference Library reduced set...

CVE-2026-29145-Tester

CVE-2026-29145 Testing Environment 📌 Overview This repository contains a proof-of-concept PoC environment designed to test for CVE-2026-29145. The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS CLIENTCERT implementation. When OCSP Online Certificate Status Protocol is...

BootHole

BootHole General information This repository was created to contain relevant helpful scripts and any additional tools or information that can assist others in managing their BootHole vulnerability mitigation plans. Windows Based Platforms We have created a Powershell script that will check the EF...

talos

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Talos is a scalable and secure API key server optimized for low-latency verification, horizontal scaling, and predictable operations. It follows established security best-practices for API keys and issues, verifies, revokes, and...

PT-2026-126706

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

dugganusa-ietf

DugganUSA — IETF Hackathon Contributions Docs: https://docs.dugganusa.com/ Real-world threat-intelligence contributions from DugganUSA LLC to the IETF Hackathon, offered to project champions as empirical grounding for standards work. We are a bootstrapped threat-intelligence shop. We run a public...

cve-2026-29145

CVE-2026-29145 — OCSP checks sometimes soft-fail even when soft-fail is disabled Discoverer: gregk4sec https://github.com/gregk4sec/cve Discovery Date: 2026-02-26 Affected Vendor: Apache Affected Product: Tomcat Severity: 9.1 CRITICAL CWE: CWE-287 Improper Authentication Status: Under Review /...

CVE-2026-30945-PoC

🗑️ CVE-2026-30945 StudioCMS IDOR — Arbitrary API Token Revocation Leading to Denial of Service NVD • Advisory • CWE-639 Overview The DELETE /studiocmsapi/dashboard/api-tokens endpoint in StudioCMS ≤ 0.3.0 allows any authenticated user with editor privileges or above to revoke API tokens belonging...

CVE-2026-8863

CVE-2026-8863 Collection of the signed UEFI Secure Boot shim binaries affected by CVE-2026-8863, with the embedded shim version, Authenticode signer and revocation hashes of each image. Releases that ship the byte-identical signed shim are collapsed onto a single row — one Authenticode hash is on...

CVE-2026-71206-PoC

CVE-2026-71206 — Shiori: JWT CheckToken Never Re-Validates Account State Product: go-shiori/shiori File: internal/domains/auth.go CWE: CWE-613 — Insufficient Session Expiration CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — 8.2 High CNA: Turan Security · CVE record Description Shiori's CheckToke...

BootHoleFix

Boot Hole Fix This script will remediate the BootHole bug identified in CVE-2020-25632 and/or CVE-2021-20233. On July 29, 2020, Microsoft published security advisory 200011 that describes a new vulnerability that's related to Secure Boot. Devices that trust the Microsoft third-party Unified...

Amazon Linux 2023 : firefox (ALAS2023-2026-3329)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3329 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL...

Medium: firefox

Issue Overview: Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if...