dc34-vault

DC34 vault 应用程序 !WARNING 将您自己的固件加载到徽章上会擦除光加密密钥，并导致您的徽章进入开发者模式。 注意：此仓库现已孤立，即将归档，因为它已合并到 xous-core 中。它之所以存在于 bunnie 的 GitHub 仓库中，是因为在会议之前它必须是私有的；现在它已公开，将作为 xous-core 的一部分进行维护。请将所有未来的 PR 提交到 xous-core。Tetris PR 最终将作为独立应用程序迁移，因此该仓库将保持活跃，直到该待办事项完成。 这是为 Defcon34 定制的 vault 应用程序。...

secure-vault-for-commercial

Secure Vault 📄 Technical paper: SecureVaultTechnicalPaperv3.5.0.pdf · Cite on Zenodo Local-first file encryption for Windows, secured by a physical USB key instead of a password. ⚠️ v3.5.0 includes a breaking security fix — see CHANGELOG.md before updating from an earlier version. Table of Content...

GHSA-92X3-5H48-MFHX vulnerabilities

Vulnerabilities for packages: terraform-ls, opentofu-fips, helmfile, vault, terraform, vault-fips, terraform-fips, opentofu, terraform-mcp-server...

CVE-2026-14978 vulnerabilities

Vulnerabilities for packages: terraform-ls, opentofu-fips, helmfile, vault, terraform, vault-fips, terraform-fips, opentofu, terraform-mcp-server...

zttp

ZTTP: Zero-Trust SSH Bastion Proxy 🔗 Project Mirrors: GitHub | GitLab ZTTP is a hardened, self-hosted Zero-Trust SSH bastion proxy built in Golang with HashiCorp Vault-backed key management, RBAC policy enforcement, full session recording, and an interactive admin TUI — designed for teams who nee...

hive

来自WikiLeaks： 今天，2017年11月9日，WikiLeaks发布Hive的源代码和开发日志。Hive是CIA用于控制其恶意软件的基础设施中的一个主要组成部分。 Hive为CIA的恶意软件操作人员解决了一个关键问题。即使目标计算机上安装了最复杂的恶意软件植入程序，如果它无法以不引人注意的安全方式与操作人员进行通信，那也是毫无用处的。使用Hive后，即使植入程序在目标计算机上被发现，仅通过查看恶意软件与互联网上其他服务器之间的通信，也很难将其归因于CIA。Hive为一系列CIA恶意软件提供了一个隐蔽的通信平台，用于将窃取的信息发送到CIA服务器，并从CIA的操作人员处接收新的指令...

Linux Distros Unpatched Vulnerability : CVE-2026-84962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized...

UBUNTU-CVE-2026-84962

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-84962

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

EUVD-2026-70516

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-85178

Helicone 's VaultManager.getDecryptedProviderKeyById() function on the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. An attacker with admin or owner privileges in any single organization can retrieve decr...

PT-2026-85037

The PyPI Incident as the Harm Threshold Marker Of the four incidents, the Mythos 5 PyPI package upload is the only one confirmed to have produced real-world third-party harm: the package was downloaded and executed by external systems before it was caught Source: TechCrunch, July 31, 2026. The...

CVE-2026-75137

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESSVMREAD permission to read the memory space of UpSignOn.exe a...

CVE-2026-75136

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a...

CVE-2026-75137

UpSignOn for Windows versions before 7.19.0 are affected by a sensitive data exposure vulnerability in process memory after the application has been locked. A local attacker with the PROCESS_VM_READ permission can read the memory space of UpSignOn.exe and extract cleartext vault data, including e...

CVE-2026-75137 UpSignOn < 7.19.0 Sensitive Data Exposure in Process Memory after Lock

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESSVMREAD permission to read the memory space of UpSignOn.exe a...

EUVD-2026-70262

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESSVMREAD permission to read the memory space of UpSignOn.exe a...

CVE-2026-75135 UpSignOn < 7.19.0 Sensitive Key Retention in Memory

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

CVE-2026-75135

UpSignOn for Windows before 7.19.0 retains a backup key in the process memory of UpSignOn.exe even after the vault has been re-locked. A local attacker with low privileges can extract this key, decrypt the encrypted master password backup in v6-vault1.DATA.txt , and subsequently decrypt the entir...

EUVD-2026-70260

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...