CVE-2026-109365: Insufficient Verification of Data Authenticity

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling,...

PT-2026-110724

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.13 Description A DOM-based cross-site scripting issue exists in the control panel login and 2FA verification flow. The problem occurs because the returnUrl variable, which is controlled by the user, accept...

CVE-2026-109307: Improper Neutralization of Input During Web Page Generation

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a craft...

CVE-2026-21138: Undefined Security Weakness

Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications...

PT-2026-110782

Name of the Vulnerable Software and Affected Versions Zebra versions prior to 6.4.0 Description An uncontrolled resource consumption issue allows unauthenticated peers to force full proof verification by serving forged block bodies that possess valid header hashes. By flipping authorizing-only...

CVE-2026-109359: Insufficient Verification of Data Authenticity

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain...

Rocky Linux 10.2 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (crlsa-2026_77020)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202677020 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

Rocky Linux 9 [CIQ] Security Update: python3.14 / python3.14-debug / python3.14-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_77021)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202677021 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

fuzzowski

Fuzzowski █ █ ████████ ██████████ ██ ████ ██ ██ ████ ██ ████ ████ █ ████████████ █ █ ██████████ █ Fuzzowski Network Fuzzer █ █ █ █ 🄯 Fuzzers, inc. ██ ██ by Mario Rivas La idea es ser el Fuzzer de Protocolos de Red que queramos usar. El objetivo de esta herramienta es ayudar durante todo el proces...

fastfinder

FastFinder Una herramienta ligera de respuesta a incidentes para la caza de amenazas y el triage forense ✨ Descripción general FastFinder es una herramienta de respuesta a incidentes potente y ligera diseñada para profesionales de la ciberseguridad que realizan caza de amenazas, análisis forense ...

terrier

Terrier Terrier es una herramienta de análisis de imágenes y contenedores que se puede utilizar para escanear imágenes OCI y contenedores para identificar y verificar la presencia de archivos específicos según sus hashes. Un artículo detallado sobre Terrier se puede encontrar en el blog de Heroku...

heaphopper

heaphopper HeapHopper es un framework de verificación de modelos acotados para implementaciones de Heap. Descripción general Configuración sudo apt update && sudo apt install build-essential python3-dev virtualenvwrapper git clone https://github.com/angr/heaphopper.git && cd ./heaphopper...

openwifipass

OpenWifiPass Una implementación de código abierto del rol de otorgante en el protocolo de Compartir Contraseña Wi-Fi de Apple. Descargo de responsabilidad OpenWifiPass es un software experimental y es el resultado de esfuerzos de ingeniería inversa por parte del proyecto Open Wireless Link. El...

sec_review_cve-2024-3094

A full security review of the open-source vulnerability CVE-2024-3094 was conducted. Based on the obtained data, the following were prepared: 1. Report «ThreatModel + SecurityReview» – detailed description of threats, exploitation paths, risk assessment, and recommendations for reducing the attac...

CVE-2026-108698

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in loadwasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the tag can serve an unsigned malicious...

CVE-2026-108699

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...

CVE-2026-108699 hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...

EUVD-2026-96999

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...

CVE-2026-108699

The hyper-mcp framework (versions through 0.8.3 ) is vulnerable to an improper signature verification flaw involving OCI WebAssembly plugins. The root cause is that the cosign_verify_args() function accepts any signer identity and OIDC issuer by default. This allows an attacker who controls a plu...

CVE-2026-108699 hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...