OST-C2-Spec

Entwurf: Anfrage zur Diskussion Zusammenfassung Dieses Dokument bietet eine Übersicht über Version 1 der OST C&C Specification. Es soll eine detaillierte Beschreibung der Nachrichten und der in diesen Nachrichten enthaltenen Felder liefern. Einleitung Die Motivation hinter dieser Spezifikation...

isa_recovery

Sistema di Recupero ISA Una pipeline di reverse-engineering che trasforma un binario di firmware e il suo disassembly possibilmente errato in una specifica funzionante del processore per Ghidra. Quando ti imbatti in un processore proprietario senza documentazione e senza supporto in Ghidra, quest...

wycheproof

Progetto Wycheproof Il Progetto Wycheproof è un repository gestito dalla community di vettori di test che possono essere utilizzati dagli sviluppatori di librerie crittografiche per testare attacchi noti, incoerenze nelle specifiche e altri vari bug di implementazione. I vettori di test sono...

swagger-ui

परिचय: Swagger UI की भूमिका Swagger UI एक व्यापक रूप से उपयोग की जाने वाली लाइब्रेरी है जो OpenAPI पूर्व में Swagger विनिर्देशों को एक इंटरैक्टिव वेब इंटरफ़ेस में प्रस्तुत करती है। यह डेवलपर्स और इंटीग्रेटर्स को बैकएंड कार्यान्वयन के बिना API का अन्वेषण और परीक्षण करने में सक्षम बनाती है।...

BFScan

BFScan Strumento per l'elaborazione iniziale di applicazioni APK / XAPK / APKM / DEX / JAR / WAR. Ricerca di stringhe nel codice sorgente e nelle risorse che assomigliano a URI, percorsi o segreti Genera richieste HTTP grezze e specifiche OpenAPI basate su file di configurazione, annotazioni di...

tippa-my-tongue

Tippa My Tongue Tippa My Tongue ist ein Exploit, der die CVE-2022-1388 und CVE-2022-41800 nutzt, um auf F5 BIG-IP-Produkten eine root-Reverse-Shell zu etablieren. Die meisten CVE-2022-1388-Exploits erreichen Codeausführung über /mgmt/tm/util/bash. Dieser Exploit verwendet jedoch...

PT-2026-81891

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.43 through 7.0.109...

modo

Modo Die Open-Source-KI-IDE, die plant, bevor sie codiert. MIT-Lizenz · Schnellstart · Was Modo hinzufügt · Beitragen Ich wollte eine kleine Funktion in einem KI-Coding-Tool. Konnte keine Möglichkeit finden, sie vorzuschlagen. Also fragte ich mich: Wie schwer ist es eigentlich, so etwas wie Kiro,...

Wagtail: Denial of service via unbounded filter specs in the image preview

Impact An authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patches Patched versions have be...

EUVD-2026-62955

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer REST A...

CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

CVE-2026-71868

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71864 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

PT-2026-78545

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description An issue exists where unescaped backticks in an OpenAPI path are emitted into request URL template literals for axios, fetch, react-query, and SWR clients without safe encoding. This allows...

CVE-2026-66782

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account SA bearer token within the Submariner Custom Resource CR specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtai...

EUVD-2026-61066

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account SA bearer token within the Submariner Custom Resource CR specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtai...

CVE-2026-74439

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with contextclearentry while the Present bit is still set. This creates a windo...

CVE-2026-72239

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSRAMD64SYSCFGSNPEN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSRAMD64SYSCFGSNPEN". Section 8.8 of the SNP spec says: Before invoking SNPINITEX with INITRMP se...

CVE-2026-73268

The CVE-2026-73268 entry concerns the cluster-curator-controller component of multicluster engine (MCE). A tenant with create/update permissions on ClusterCurator resources can inject an arbitrary Job specification via spec.install.overrideJob, because CreateJob() does not validate user-controlle...

CVE-2026-73268 Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection

A flaw was found in the cluster-curator-controller component of multicluster engine MCE. A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob function does not validate user-controlled input when...