GO-2025-4245 vulnerabilities

Vulnerabilities for packages: elastic-agent-fips, jaeger-fips, aws-otel-collector, vale, verticadb-operator, kine, k8sgateway-fips, eks-distro-fips, jaeger, elastic-agent, argo-rollouts, coredns, kubeflow-pipelines, opentelemetry-collector-contrib-fips, tempo, argo-cd-fips, nats,...

GO-2025-4010 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth-fips, kube-state-metrics, kyverno-policy-reporter-plugins-kyverno-fips, nerdctl, nodetaint, kubevela, trivy-operator, ucd, kube-metrics-adapter-fips, rootlesskit-fips, envconsul-fips, kubernetes-csi-external-snapshotter, git-sync-fips,...

CVE-2026-63424

During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges...

GHSA-P7H3-7Q52-72W8 printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows...

printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows...

GHSA-7CR3-H577-G38J rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

The --preserve-root check uses a path-string test path.hasroot && path.parent.isnone rather than comparing device/inode. A symlink to / e.g. /tmp/rootlink - / has a parent component, so it passes the check. GNU caches /'s dev/inode at startup and compares every traversed directory against it...

cut: -s (only-delimited) ignored when delimiter is a newline

The cut utility in uutils coreutils incorrectly handles the -s only-delimited option when a newline character is specified as the delimiter. The implementation fails to verify the onlydelimited flag in the cutfieldsnewlinechardelim function, causing the utility to print non-delimited lines that...

GHSA-WV33-5PXH-R7J7 cut: -s (only-delimited) ignored when delimiter is a newline

The cut utility in uutils coreutils incorrectly handles the -s only-delimited option when a newline character is specified as the delimiter. The implementation fails to verify the onlydelimited flag in the cutfieldsnewlinechardelim function, causing the utility to print non-delimited lines that...

GHSA-2W8R-9XJ7-69J5 mktemp: empty TMPDIR creates temp files in CWD instead of /tmp

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the...

Strapi Content API Sanitization Bypass Detection Module Scanner

This Python script assesses exposure to CVE-2026-27886 in Strapi Content API endpoints by performing differential filter validation against where parameters. Detection compares baseline query behavior against controlledfilter predicates to determine whether unsanitized conditions reach backend...

Chatwoot Scanner

This is a security assessment tool designed to evaluate authentication status, response behavior, and possible exposure indicators in Chatwoot conversation filtering functionality...

CVE-2025-10238

During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode SMM...

CVE-2025-10237

CVE-2025-10237 involves ThinkPad embedded controller firmware. A potential vulnerability could allow a privileged local user to perform arbitrary reads or writes to privileged memory regions. The available connected records confirm a LOCAL attack vector with HIGH impact on confidentiality, integr...

PT-2026-48455

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...

PT-2026-48430

During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could allow a privileged local user to perform arbitrary reads or writes to privileged memory regions...

Exploit for Improper Authentication in Wordpress

CVE-2008-1930 Exploitation Documentation Guide Document In...

FIFOFox: Windows Named-Pipe Security Auditor and Fuzzer

FIFOFox is a Windows named-pipe security assessment tool for identifying weak pipe permissions, pipe-squatting exposure, and named-pipe impersonation attack paths. It combines passive auditing with authorized active testing, including fuzzing and interception-style capture, to help defenders find...

FortiClient EMS 7.4.6 Detection Scanner

FortiClient EMS CVE-2026-35616 Detection Scanner is a non-destructive security assessment module designed to identify whether Fortinet hotfix protections for CVE-2026-35616 are properly applied on FortiClient EMS servers. The scanner performs safe behavioral validation by comparing server respons...

Apache ActiveMQ Jolokia Security Auditor

This is a security assessment tool for Apache ActiveMQ deployments that expose the Jolokia management interface. It verifies connectivity, evaluates authentication status, retrieves Jolokia agent information, and identifies accessible ActiveMQ broker instances through JMX endpoints...

"What Is the Problem Space?" Defining Host-Space Adversarial Perturbations against Network Intrusion Detection Systems

Network Intrusion Detection Systems NIDS are now increasingly leveraging Machine Learning ML techniques to detect malicious network activities. Numerous papers have scrutinized the security of ML-based NIDS ML-NIDS by testing them against various attacks involving adversarial perturbations. The...