Quantum-Silicon-Core-Loader

محمّل نواة السيليكون الكمومي النواة الأساسية: qslcl.asm v0.0.2 قيد التطوير الوحدة المساعدة: qslcl.bin v0.7.4 وحدة التحكم العامة: qslcl.py v2.2.2 بحث محمي قانونيًا - يعمل هذا المشروع ضمن أطر قانونية راسخة للبحث الأمني وحق الإصلاح والحرية الأكاديمية. اعرف المزيد نظرة عامة محمّل نواة السيليكون...

SCTT-2026-33-0002-DWM-Visual-Field-Singularity

SCTT-2026-33-0002: تفرد المجال البصري لـ DWM 📡 التصنيف النظري المعرف: SCTT-2026-33-0002 الباحث: Americo Simoes SimoesCTT الفيزياء: النظرية 4.2 - انتقال الطور المضطرب TPT الثابت: α = 0.0302011 الهدف: مدير سطح المكتب dwm.exe / مكوّن الرسومات في Windows يلغي: CVE-2026-20805 و CVE-2026-20871 تصحيحات...

-SCTT-2026-33-0002-DWM-Visual-Field-Singularity

SCTT-2026-33-0002: تفرد المجال البصري لـ DWM 📡 التصنيف النظري المعرف: SCTT-2026-33-0002 الباحث: Americo Simoes SimoesCTT الفيزياء: النظرية 4.2 - الانتقال الطوري المضطرب TPT الثابت: α = 0.0302011 الهدف: مدير سطح المكتب dwm.exe / مكوّن الرسومات في Windows يُلغي: CVE-2026-20805 و CVE-2026-20871...

AtomicMemory

تنفيذ FPGA المرجعي Cyclone V يحتوي هذا الدليل على وحدات RTL المرجعية، وصور FPGA المترجمة مسبقًا، ونصوص اختبار TCL الاختيارية لبدائية القياس–الانهيار الذرّي. هذه البدائية هي آلية قياس–انهيار عتادية متوافقة مع CMOS تفرض دلالات القراءة الأحادية: أول قراءة مؤهلة تُرجِع البايت المخزَّن، وفعل القياس...

Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned...

GHSA-R7F2-6FJ8-6FG2 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned...

NPM: Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

NPM: Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, 6.65.0...

WP < 7.1.3 - Action Injection via Post Status Transition Dynamic Hooks

Description WordPress does not restrict some dynamically generated action hook names to registered post statuses and types during a status transition in some cases, which could allow an attacker who can introduce a post with attacker-controlled status or type through a separate vulnerability to...

CVE-2026-105689

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

EUVD-2026-92707

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

CVE-2026-105648 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

CVE-2026-105689: Server-Side Request Forgery (SSRF)

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

CVE-2026-104458 YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

GO-2026-6572 Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers NAT64, IPv4-compatible, 6to4 reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve...

PYSEC-2026-4064 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...

lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

SummaryLightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...

PT-2026-105591

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers NAT64, IPv4-compatible, 6to4 reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve...

Learning Normal Diffusion Dynamics for Backdoor Defense in Text-To-Image Models

Backdoor attacks pose a serious threat to the secure deployment of text-to-image T2I diffusion models. Existing defenses typically detect backdoors from specific abnormal patterns in internal representations, which may limit their generalizability with the emergence of increasingly diverse attack...

CVE-2026-102879

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the downloadfile and scrapeweb agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata...

EUVD-2026-89414

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the downloadfile and scrapeweb agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata...