CVE-2026-102111

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative...

scorecard

OpenSSF Scorecard Overview What Is Scorecard? Prominent Scorecard Users View a Project's Score Scorecard's Public Data Using Scorecard Scorecard GitHub Action Scorecard REST API Scorecard Badges Scorecard Command Line Interface Prerequisites Installation Authentication Basic Usage Checks Default...

CVE-2026-103012

A flaw was found in claude-code. When retrieving server-managed settings, the application prioritized a locally stored credential over an active organizational account sign-in. If the configuration server rejected the stored credential, a local user could initiate a session that bypasses the...

cloudmapper

CloudMapper Note the Network Visualization functionality command prepare is no longer maintained. CloudMapper helps you analyze your Amazon Web Services AWS environments. The original purpose was to generate network diagrams and display them in your browser functionality no longer maintained. It...

content

¡Bienvenido! El propósito de este proyecto es crear contenido de políticas de seguridad para varias plataformas — Red Hat Enterprise Linux , Fedora , Ubuntu , Debian , SUSE Linux Enterprise Server SLES ,... — así como productos — Firefox ,... Nuestro objetivo es hacer que sea lo más fácil posible...

CSPBypass

CSP Bypass Bienvenido a CSPBypass.com , una herramienta diseñada para ayudar a los hackers éticos a eludir Políticas de Seguridad de Contenido CSP restrictivas y explotar vulnerabilidades XSS Cross-Site Scripting en sitios donde las inyecciones están bloqueadas por CSP que solo permiten ciertos...

browsertunnel

browsertunnel Browsertunnel is a tool for exfiltrating data from the browser using the DNS protocol. It achieves this by abusing dns-prefetch, a feature intended to reduce the perceived latency of websites by doing DNS lookups in the background for specified domains. DNS traffic does not appear i...

Super-UEFIinSecureBoot-Disk

Super UEFIinSecureBoot Disk Super UEFIinSecureBoot Disk is a proof-of-concept not actively maintained or enhanced bootable image with GRUB2 bootloader designed to be used as a base for recovery USB flash drives. Key feature: disk is fully functional with UEFI Secure Boot mode activated. It can...

brave-browser

Brave Browser Este repositorio no es necesario para compilar el navegador y solo contiene issues, lanzamientos y la wiki. El código fuente y las contribuciones están en https://github.com/brave/brave-core. Puedes visitar nuestro sitio web para obtener la última versión estable. Recursos Issues:...

JSONBee

JSONBee Un conjunto de endpoints JSONP listos para usar que ayudan a evadir la política de seguridad de contenido de diferentes sitios web. La herramienta se presentó durante HackIT 2018 en Kiev. La presentación se puede encontrar aquí no estoy seguro de por qué el formato de las diapositivas est...

cspparse

cspparse Descripción cspparse es una herramienta para evaluar Políticas de Seguridad de Contenido. Utiliza la API de Google para recuperar las cabeceras CSP y las devuelve en formato ReconJSON. No solo comprueba las cabeceras con la API de Google, sino que también analiza el HTML del sitio objeti...

CVE-2026-10518

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

CVE-2026-10518 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

CVE-2026-10518

GitLab EE is impacted by an incorrect authorization vulnerability affecting versions 17.9 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 . Due to improper authorization enforcement, an authenticated user with guest-level permissions could, under certain conditions, read private secur...

EUVD-2026-88688

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

CVE-2026-54477

CVE-2026-54477: Admin Panel Missing Security Headers clickjacking / XSS Advisory Field| Value ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.4 Medium Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Vector 4.0|...

zappzarapp-php-security

⚡ zappzarapp/security Biblioteca integral de seguridad para PHP que proporciona CSP, cabeceras de seguridad, protección CSRF, cookies seguras, validación de contraseñas, saneamiento de entradas, limitación de velocidad, SRI, carga de secretos, cifrado, seguridad de sesiones, autenticación de dos...

fides

Protegiendo Agentes de IA con Control de Flujo de Información Este repositorio contiene un cuaderno de Jupyter que acompaña al artículo académico «Protegiendo agentes de IA con control de flujo de información». El cuaderno está estructurado como un tutorial para guiar a los lectores a través de l...

CVE-2026-100663

A flaw was found in Netty's HTTP/3 codec netty-codec-http3. A remote attacker can bypass security policies and tunnel allowlists when Netty acts as an HTTP/1 to HTTP/3 proxy or gateway. Due to improper translation of HTTP/1 CONNECT requests, the component uses the attacker-controlled Host header ...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Parser component in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy through a crafted HTML page. Chromium security severity: Low...