cloudsplaining

Cloudsplaining Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report. Example report Documentation For full documentation, please visit the project on ReadTheDocs. Installation Cheatsheet Example report...

DPAT

Domain Password Audit Tool DPAT DPAT is a Python-based security tool that analyzes password hashes extracted from Active Directory domain controllers. It generates comprehensive HTML reports showing password usage statistics, policy violations, and security insights from both NTDS dumps and...

sparkplugFuzzer

Sparkplug B MQTT Security Fuzzer Un outil complet d'évaluation de la sécurité pour tester les implémentations du protocole Sparkplug B MQTT. Le fuzzer teste systématiquement tous les champs du protocole pour les 9 types de messages, découvre les dispositifs actifs sur le réseau et produit des...

thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers

A flaw was found in Thunderbird where a maliciously constructed mail header could lead to ambiguous parsing. This vulnerability could result in multiple mail header fields being incorrectly interpreted as one, or cause memory safety violations. A remote attacker could potentially exploit this to...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficiently hardened runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and related helpers,...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficiently hardened runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and...

PT-2026-98374

Name of the Vulnerable Software and Affected Versions ash versions 2.17.15 through 3.33.10 Description An Improperly Controlled Modification of Dynamically-Determined Object Attributes allows users to set values for private action arguments during bulk destroy and bulk update operations. Argument...

CVE-2026-91795 Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerability

Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution...

CVE-2026-91795

Foxit PDF Editor/Reader is affected by a vulnerability in its FileOpen plugin because it fails to adequately validate certain encryption metadata in specially crafted PDF files. This lack of validation can leave an internal pointer in an invalid state, resulting in chained read and write access v...

CVE-2026-91795: Untrusted Pointer Dereference

Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the HTTP/1.1 request parsing logic in sanic/http/http1.py, where malformed or conflicting transfer-encoding and content-length headers allow an attacker to inject a smuggled request into the processing...

SUSE CVE-2026-92238

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

CVE-2026-92238 Ambiguous parsing of mail headers

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

CVE-2026-92238

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

CVE-2026-92238: Inconsistent Interpretation of HTTP Requests

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

Astra Linux – Vulnerability in Firefox and Thunderbird

Security policy violation events could have revealed cross-origin information due to violations of frame-ancestor rules. This vulnerability affects Firefox ESR versions earlier than 91.5, Firefox versions earlier than 96, and Thunderbird versions earlier than 91.5...

Grid Trouble in Paradise: Uncovering Vulnerable Distributed Energy Resources and Their Grid-Level Risks

Grid-connected solar distributed energy resources DERs, such as solar inverters and monitoring platforms, have been deployed at unprecedented scale over the past few years, with global solar capacity more than doubling since 2022. To support monitoring and control, many of these systems are...

When Relationships Break: Interpreting Network Traffic Anomalies Via Dependency Violations

Current research on security monitoring is increasingly focusing on machine-learning-based approaches, but caveats remain. In addition to huge computational overhead, one concern is the lack of insights into "why" alerts are raised. Existing interpretability approaches rely on feature attribution...

JLSEC-2026-1236

libexpat before 2.8.2 does not consider XMLTOKDATACHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219...

CVE-2026-56131

A use-after-free vulnerability in libexpat occurs because handler call depth isn't properly tracked when XMLResumeParser is invoked during policy violations. This flaw can lead to information disclosure, data corruption, or denial of service. Mitigation To mitigate this vulnerability, avoid...