501 matches found
research-labs
Researcher's labs This repository contains a number of intentionally vulnerable applications that you can use to explore vulnerabilities found by PortSwigger Research. Note that you can find many free online labs designed by PortSwigger Research in the Web Security Academy. Table of contents...
CVE-2026-8863
CVE-2026-8863 Collection of the signed UEFI Secure Boot shim binaries affected by CVE-2026-8863, with the embedded shim version, Authenticode signer and revocation hashes of each image. Releases that ship the byte-identical signed shim are collapsed onto a single row — one Authenticode hash is on...
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters
Summary A security vulnerability has been identified in GitHub CLI that could allow attestation verification bypass when using gh attestation verify with --signer-repo or --signer-workflow flags. GitHub CLI builds the certificate matcher from these flag values without escaping regex metacharacter...
GHSA-MM27-MWQ9-FR5G GitHub CLI allows attestation verification bypass through unescaped regex metacharacters
Summary A security vulnerability has been identified in GitHub CLI that could allow attestation verification bypass when using gh attestation verify with --signer-repo or --signer-workflow flags. GitHub CLI builds the certificate matcher from these flag values without escaping regex metacharacter...
Important: Red Hat Security Advisory: RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
The 1.4.4 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20...
Important: Red Hat Security Advisory: RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
The 1.4.4 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20...
Important: Red Hat Security Advisory: RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
The 1.4.4 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20...
Important: Red Hat Security Advisory: RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
The 1.4.4 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20...
Important: Red Hat Security Advisory: RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
The 1.4.4 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20...
Malicious code in web3-signer-kit (RubyGems)
Source: amazon-inspector fe57c8011ef7048ef33ccdb828615b8efd9ab10799a2a730d12c2d854c2e0895 The gem's extconf.rb decodes a base64 literal and eval's it at gem install time inside a double-forked, session-detached child whose stdio is redirected to /dev/null. The decoded payload opens a TCPSocket to...
MAL-2026-17801 Malicious code in web3-signer-kit (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe57c8011ef7048ef33ccdb828615b8efd9ab10799a2a730d12c2d854c2e0895 The gem's extconf.rb decodes a base64 literal and eval's it at gem install time inside a double-forked, session-detached child whose stdio is...
GO-2026-6610 vulnerabilities
Vulnerabilities for packages: policy-bot-fips, knative-serving, knative-net-istio-fips, grafana-rollout-operator, helm-operator-fips, oauth2-proxy-fips, crossplane-provider-aws-servicecatalog, crossplane-provider-aws-signer, lmstack-lora-controller-fips, cluster-api-azure-controller-fips,...
GO-2026-6612 vulnerabilities
Vulnerabilities for packages: policy-bot-fips, knative-serving, knative-net-istio-fips, grafana-rollout-operator, helm-operator-fips, oauth2-proxy-fips, crossplane-provider-aws-servicecatalog, gogatekeeper, amass, crossplane-provider-aws-signer, lmstack-lora-controller-fips, vitess,...
GO-2026-6611 vulnerabilities
Vulnerabilities for packages: policy-bot-fips, knative-serving, knative-net-istio-fips, grafana-rollout-operator, helm-operator-fips, oauth2-proxy-fips, crossplane-provider-aws-servicecatalog, gogatekeeper, amass, crossplane-provider-aws-signer, lmstack-lora-controller-fips, vitess,...
GO-2026-6617 vulnerabilities
Vulnerabilities for packages: policy-bot-fips, knative-serving, knative-net-istio-fips, grafana-rollout-operator, helm-operator-fips, oauth2-proxy-fips, crossplane-provider-aws-servicecatalog, gogatekeeper, amass, crossplane-provider-aws-signer, lmstack-lora-controller-fips, vitess,...
CVE-2026-97032 vulnerabilities
Vulnerabilities for packages: policy-bot-fips, knative-serving, knative-net-istio-fips, grafana-rollout-operator, helm-operator-fips, oauth2-proxy-fips, crossplane-provider-aws-servicecatalog, gogatekeeper, amass, crossplane-provider-aws-signer, lmstack-lora-controller-fips, vitess,...
CVE-2026-78669 vulnerabilities
Vulnerabilities for packages: policy-bot-fips, knative-serving, knative-net-istio-fips, grafana-rollout-operator, helm-operator-fips, oauth2-proxy-fips, crossplane-provider-aws-servicecatalog, gogatekeeper, amass, crossplane-provider-aws-signer, lmstack-lora-controller-fips, vitess,...
GO-2026-6603 vulnerabilities
Vulnerabilities for packages: policy-bot-fips, knative-serving, knative-net-istio-fips, grafana-rollout-operator, helm-operator-fips, oauth2-proxy-fips, crossplane-provider-aws-servicecatalog, gogatekeeper, amass, crossplane-provider-aws-signer, lmstack-lora-controller-fips, vitess,...
com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +92 more potentially affected by CVE-2026-107281 via org.asynchttpclient:async-http-client (>=3.0.0, <=3.0.11)
org.asynchttpclient:async-http-client MAVEN version =3.0.0, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2026-107281 Source advisory: MEND:CVE-2026-107281...
SUSE CVE-2026-71891
In Bouncy Castle for Java before 1.86, BLS12381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field...