EUVD-2026-50079

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...

CVE-2026-48058

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

CVE-2026-48058 nebula-mesh: Session and OIDC state cookies lack the Secure attribute

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

EUVD-2026-49991

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

CVE-2026-48058

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

CVE-2026-48058

Summary of CVE-2026-48058 (nebula-mesh) nebula-mesh (Slack Nebula mesh control plane) versions prior to 0.3.2 expose a cookie security flaw: internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on cookies but omit the Secure attribute. A plaintext HTTP request to the ori...

CVE-2026-48058 nebula-mesh: Session and OIDC state cookies lack the Secure attribute

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

Malicious Package

Overview ethers-secure is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in ethers-secure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa36b9a8ec228142a26760738fbbca9c72f9634ed0abedb9d5beeae6a2441244 Package name mimics the popular ethers library. Its exported wallet API WalletClient/createWalletClient/parseAccount accepts an Ethereum private key...

MAL-2026-11153 Malicious code in triage_bot_using_sdkv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed39efd544cae19da3ed546fecb2383729aef637bf623e00a9cf02f1f8ded05c package.json registers a preinstall hook that runs index.js on npm install. index.js collects os.hostname, os.userInfo, home directory, DNS server...

MAL-2026-11127 Malicious code in app-sima-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a34ad4e52b9e8255bcfa74cbb6aa18811b0c8d80819a75c6bbfc36d79757b66 The package's postinstall script performs three coordinated attacks against the installer at install time. First, on Linux it fetches an SSH public k...

Improperly Implemented Security Check for Standard

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard through the secure-client-uris client policy executor in t...

CVE-2026-14103

An use after free flaw was found in the SSL component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513465245...

Exploit for CVE-2026-59891

CVE-2026-59891 Regression & Control Lab @sigstore/oci의 실제 취...

CVE-2026-18025

Insufficient Moodle app token isolation made it possible for a Moodle site being logged into the app to access secure-storage tokens for other Moodle sites the user already had configured in their Moodle mobile app. This could result in compromise of the user’s web service token if, for example,...

erlang/otp: Erlang/OTP ssl client: Authentication bypass via unoffered anonymous cipher suite acceptance

A flaw was found in the Erlang/OTP ssl client. This vulnerability allows an on-path attacker to bypass server authentication in TLS 1.2 and earlier and DTLS connections. By tricking the client into accepting an unoffered anonymous cipher suite, the attacker can complete the handshake without a...

CVE-2026-48058: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

Distributing Security Controls through Harness Engineering

AI coding agents are being adopted at historic speed, yet security and risk concerns remain the primary barrier to scaling agentic AI across organizations. Existing security controls for coding agents are not systematically distributed to engineering teams, and vendor-native solutions introduce...

PT-2026-65623

Name of the Vulnerable Software and Affected Versions goshs versions 2.1.3 through 2.1.3 Description An authentication bypass exists in the SFTP server component when the application is started with a basic authentication string containing a username but an empty password e.g., -b 'admin:', the...

CVE-2026-66824

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...