rust_citadel

Citadel 后量子混合加密与密钥管理服务器。 Citadel 结合了 X25519 + ML-KEM-768 进行密钥封装，并使用 AES-256-GCM 进行数据加密，遵循 NIST 为后量子过渡提出的混合方法。应用程序通过 REST API 进行加密和解密。Citadel 负责管理密钥——包括生成、轮换、撤销、访问控制和审计日志记录。 状态: 功能实现。未经审计。无生产部署。请参阅下面的安全说明。 功能概述 Your Application Citadel Database | | | |-- POST /encrypt -------| | | |-- hybrid KEM...

git-remote-pqcrypt

git-remote-pqcrypt 这是一个实验性项目，尚未经过正式安全审计。请勿将其用于任何关键仓库。 git-remote-pqcrypt 是一个加密的 Git 远程助手，类似于 gcrypt。它以加密形式存储 Git packfile 和仓库元数据。访问时使用抗量子 XWing 封装。 当前 crate 版本：0.2.0。 工作原理 1. git-remote-pqcrypt init 创建仓库主密钥。 2. 每个用户的主密钥用其公钥进行封装。 3. Git packfile 和清单文件使用主密钥加密。 4. Git 通过 git-remote-pqcrypt 远程助手使用...

CVE-2026-15361

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...

Malicious code in @druids/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071ce35c0d6a17c606e5448f4c485228df973342935b0a11519304050877edf5 The package's package.json declares a dependency ltidisafe resolved not from the npm registry but as a direct tarball URL:...

Express.js 安全漏洞

Express.js is a fast, unconstrained, minimalist web framework for Node.js open sourced by expressjs. A security vulnerability exists in Express.js 3.21.2 and earlier versions, which stems from a response.links function that can inject arbitrary resources in the Link header when using unaudited da...

CVE-2021-21568

Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an insufficient logging vulnerability. An authenticated user with ISIPRIVLOGINPAPI could make un-audited and un-trackable configuration changes to settings that their roles have privileges to change...

DELL EMC PowerScale 安全漏洞

Dell EMC PowerScale OneFS is an API-driven file system. version 8.2.-9.2. of Dell EMC PowerScale OneFS is vulnerable to insufficient logging. An attacker could exploit this vulnerability to make unaudited and untraceable configuration changes to settings that their role is authorized to change...