tarnish

tarnish tarnish is a static-analysis tool to aid researchers in security reviews of Chrome extensions. It automates much of the regular grunt work and helps you quickly identify potential security vulnerabilities. This tool accompanies the research blog post which can be found here. If you don't...

warcannon

WARCannon - Catastrophically powerful parallel WARC processing WARCannon was built to simplify and cheapify the process of 'grepping the internet'. With WARCannon, you can: Build and test regex patterns against real Common Crawl data Easily load Common Crawl datasets for parallel processing Scale...

CVE-2026-42897

CVE-2026-42897 - Exchange Health Checker Outbound Rewrite Rule Blind Spot Severity: Medium CVSS 5.3 Component: Microsoft CSS-Exchange - HealthChecker diagnostic tool Affected Files: Diagnostics/HealthChecker/Analyzer/Get-URLRewriteRule.ps1 L49, L72, L97...

CVE-2026-108546

Spotweb through version 1.5.8 is vulnerable to an OS command injection vulnerability within the runcommand NZB handler . The root cause is the unescaped substitution of shell metacharacters in a spot title for the $SPOTTITLE variable, which is subsequently passed to the exec() function. Remote at...

CVE-2026-108546 Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

CVE-2026-108546 Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

AI-Assisted Design of a Post-Quantum Cryptographic Accelerator: A Deployed-Silicon Case Study

Post-quantum migration is mandated on published timelines, and silicon that ships with a defect cannot be patched remotely. The standard acceptance gate cannot detect an entire class of ML-DSA defects. Signing resamples until a candidate meets its norm bounds, so the executed path varies with the...

SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough.

For years, routing traffic through cloud proxies was good enough. Then work moved to the browser, AI entered the workflow, and the inspection model stopped keeping up. Enterprise workflows now live across SaaS applications, browsers, and an expanding ecosystem of generative AI tools, unsanctioned...

GhostApproval: A Trust Boundary Gap in AI Coding Assistants

Uncovering a category-level blind spot in modern AI coding assistants, and why the Human-in-the-Loop safety model fails against this classic threat...

Fake Word Phishing Reveals Enterprise Blind Spot in Trusted Remote Access Tools

Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings...

EUVD-2024-55531

Hirschmann Industrial IT products contain a heap overflow vulnerability in the HiLCOS web interface that allows unauthenticated remote attackers to trigger a denial-of-service condition by sending specially crafted requests to the web interface. Attackers can exploit this heap overflow to crash t...

CVE-2024-14033

Hirschmann EagleSDV firmware prior to 05.4.02 contains a denial-of-service vulnerability in TLS session establishment. Attackers can crash the device during TLS handshake by exploiting protocol downgrades to TLS 1.0 or TLS 1.1, interrupting service availability...

CVE-2024-14033

Hirschmann EagleSDV firmware prior to 05.4.02 contains a denial-of-service vulnerability in TLS session establishment. Attackers can crash the device during TLS handshake by exploiting protocol downgrades to TLS 1.0 or TLS 1.1, interrupting service availability...

CVE-2024-14033 Hirschmann EagleSDV Denial of Service via TLS

Hirschmann EagleSDV firmware prior to 05.4.02 contains a denial-of-service vulnerability in TLS session establishment. Attackers can crash the device during TLS handshake by exploiting protocol downgrades to TLS 1.0 or TLS 1.1, interrupting service availability...

CVE-2024-14033 Hirschmann EagleSDV Denial of Service via TLS

Hirschmann EagleSDV firmware prior to 05.4.02 contains a denial-of-service vulnerability in TLS session establishment. Attackers can crash the device during TLS handshake by exploiting protocol downgrades to TLS 1.0 or TLS 1.1, interrupting service availability...

PT-2026-29899

Name of the Vulnerable Software and Affected Versions Hirschmann Industrial IT products BAT-R, BAT-F, BAT450-F, BAT867-R, BAT867-F, WLC, BAT Controller Virtual Description Hirschmann Industrial IT products are susceptible to a heap overflow in the HiLCOS web interface. Unauthenticated remote...

MAL-2026-1637 Malicious code in @spot-dapp/web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92f4a0dbb684268d2185a11b14a430fd159ea41f2c34bfd08c712c3fb1c6f45 The package @spot-dapp/web was found to contain malicious code...

Malicious code in @spot-dapp/web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92f4a0dbb684268d2185a11b14a430fd159ea41f2c34bfd08c712c3fb1c6f45 The package @spot-dapp/web was found to contain malicious code...

CVE-2026-27210

Pannellum is a lightweight, free, and open source panorama viewer for the web. In versions 3.5.0 through 2.5.6, the hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hostin...

CVE-2026-27210

Pannellum is a lightweight, free, and open source panorama viewer for the web. In versions 3.5.0 through 2.5.6, the hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hostin...