SUSE CVE-2026-82522

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...

SUSE CVE-2026-82562

Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key a=1,2,3,4 is split into an array without being compared against arrayLimit, while the same value under a flat key a=1,2,3,4, an indexed key a0=, a nested key ab=, or a...

SUSE CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge targets,...

SUSE CVE-2026-84377

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

SUSE CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

SUSE CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

allstar

Allstar !IMPORTANT The OpenSSF-hosted Allstar GitHub App has been retired. Allstar, the OpenSSF Scorecard subproject, itself continues to be maintained — you must now run it yourself, either as a GitHub Action or as a service daemon. See ossf/allstar881 for more details. If your organization was...

crapsecrets

最初从 badsecrets 0.7.0 分叉而来 偶尔同步，直到 2025 年 3 月！ 已过时，部分模块和测试用例未更新！ 适用于 ASP.NET 受损 Machine Key 测试！ 这是 CrapBadSecrets mkdir -p /ctools/ cd /ctools/ git clone https://github.com/irsdl/crapsecrets/ cd /ctools/crapsecrets pip3 install -r requirements.txt export PYTHONPATH=$pwd:$PYTHONPATH python3...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 before Patch 11 and 5.4.0 before Patch 6. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN...

OWN-Defender

OWN-Defender — Windows Security Center COM リサーチ OWN-Defender は、Windows Security Center WSC がCOMインターフェースを通じてウイルス対策セキュリティ製品をどのように表現・管理するかを理解することに焦点を当てたWindowsセキュリティリサーチプロジェクトです。 このプロジェクトは、DefendNot が示す動作の調査として始まりましたが、既存の実装をブラックボックスとして扱うのではなく、独立したリバースエンジニアリングと検証の出発点として使用しました。...

norimaci

Norimaci "Norimaci"는 macOS용 간단하고 가벼운 멀웨어 분석 샌드박스입니다. 이 도구는 "Noriben"에서 영감을 받았습니다. Norimaci는 Sysinternals Process Monitorprocmon 대신 OpenBSM 또는 Monitor.app의 기능을 사용하여 macOS 시스템 활동을 모니터링합니다. Norimaci는 3개의 Python 스크립트로 구성됩니다. norimaci.py : 메인 스크립트 openbsmconv.py : OpenBSM 감사 로그 변환기 monitorappconv.py :...

norimaci

Norimaci "Norimaci" is a simple and lightweight malware analysis sandbox for macOS. This tool was inspired by "Noriben". Norimaci uses the features of OpenBSM or Monitor.app to monitor macOS system activity instead of Sysinternals Process Monitor procmon. Norimaci consists of 3 Python scripts...

CVE-2025-24016-Nuclei-Template

CVE-2025-24016 Wazuh 안전하지 않은 역직렬화 RCE 탐지 이 저장소는 CVE-2025-24016 으로 식별된 Wazuh 서버의 안전하지 않은 역직렬화 취약점을 탐지하는 Nuclei 템플릿을 포함합니다. 템플릿 세부 사항 root@kitploit: id: wazuh-unsafe-deserialization info: name: "Wazuh Unsafe Deserialization RCE Detection" author: "Hüseyin TINTAŞ" severity: critical description: |...

grapheneX

grapheneX 컴퓨팅에서 하드닝hardening은 일반적으로 시스템의 취약점 표면을 줄여 보안을 강화하는 과정입니다. 시스템이 더 많은 기능을 수행할수록 취약점 표면은 더 넓어집니다. 원칙적으로 단일 기능 시스템은 다기능 시스템보다 더 안전합니다. 공격 경로를 줄이는 방법에는 기본 암호 변경, 불필요한 소프트웨어 제거, 불필요한 사용자 이름 또는 로그인 제거, 불필요한 서비스 비활성화 또는 제거 등이 포함됩니다. grapheneX 프로젝트는 하드닝 명령을 자동으로 실행하여 시스템을 보호하는 프레임워크를 제공하는 것을 목표로...

rmg-s9180-fzg1

Root My Galaxy SM-S9180 dm3q — FZG1 payload ports Ports of the CVE-2026-43499 payload UAF → KernelSU LKM temporary root for Samsung Galaxy S23 Ultra SM-S9180 dm3q. Hong Kong TGY — S9180ZHS8FZG1 Kernel: 5.15.189-android13-8-33413713-abS9180ZHS8FZG1 2026-07-05 security patch Root method:...

CVE-2026-85137

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...

CVE-2026-85138

A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...

CVE-2026-83961

ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of...

CVE-2026-75036

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...

CVE-2026-57445

Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In dfba919e218e20d52db9f7b2e8d292d45a46c91b and prior, normal beneficiary payout paths in StreamingEscrow preserve depositAmount...