Hulios

Hulios Sistema endurecido de invisibilidad universal y cebolla para Linux Hulios es una puerta de enlace VPN Tor transparente para Linux impulsada por eBPF. Protege el tráfico de red saliente redirigiendo los sockets TCP y las consultas DNS a través de una instancia embebida de Arti cliente Tor y...

crypto-lab-merkle-proofs

crypto-lab-merkle-proofs What It Is This is an interactive demo of Merkle trees and Merkle inclusion proofs , built on SHA-256 via the browser's WebCrypto API. A Merkle tree hashes a set of data blocks into a single root hash that commits to all of them at once; an inclusion proof is the short li...

CVE-2026-100149 WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature attacker-obtained via inlinejs identify payload' parameter. This makes it possible...

Red-Team-Infrastructure-Wiki

This wiki is intended to provide a resource for setting up a resilient Red Team infrastructure. It was made to complement Steve Borosh @424f424f and Jeff Dimmock's @bluscreenofjeff BSides NoVa 2017 talk "Doomsday Preppers: Fortifying Your Red Team Infrastructure" slides If you have an addition...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1789602943)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789602943 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and...

AZL-105651 CVE-2026-97687 affecting package python-pip 24.2-10

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to remain separated because target-server TLS settings are...

CVE-2026-75158: Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow's /assets/events API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID,...

CVE-2026-63199

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately...

CVE-2026-63199 Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately...

easywall v2.20.1

easywall Your firewall. Your rules. No surprises. Live demo · Documentation · Changelog nftables through a web interface that cannot lock you out: every apply reverts itself unless you confirm it. The idea Editing a rule changes nothing. Applying it changes everything — for 120 seconds. If the ne...

The vulnerability of the vti6_siocdevprivate() function in the net/ipv6/ip6_vti.c module of the IPv6 protocol implementation in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the vti6siocdevprivate function in the net/ipv6/ip6vti.c module of the Linux operating system’s IPv6 kernel implementation is related to insufficient spatial separation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

CVE-2026-77966

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

EUVD-2026-68613

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

CVE-2026-77966 Ebyte NA111-M Missing Authorization

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

PT-2026-83880

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

The vulnerability of the exp_seq_show() function in the net/netfilter/nf_conntrack_expect.c module of the netfilter component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the expseqshow function in the net/netfilter/nfconntrackexpect.c module of the netfilter component of the Linux operating system is related to insufficient spatial separation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-52868

A flaw was found in DCMTK. An unauthenticated attacker can read sensitive worklist records from a directory outside the intended storage area. This could lead to unauthorized information disclosure, potentially crossing departmental or clinic data separation in multi-area deployments...

CVE-2025-52640

CVE-2025-52640 – AION: The vulnerability affects HCL AION where the shared storage used by product components is architected with insufficient access separation. As a result, processes sharing the storage may access or modify files beyond their intended scope, potentially causing unintended behav...