CVE-2021-42574

Trojan Source:Invisible Vulnerabilities - Code generator — En pocas palabras, la vulnerabilidad consiste en que el código se ve diferente de cuando se compila : El ataque consiste en usar caracteres de control incrustados en comentarios y cadenas para reordenar los caracteres del código fuente de...

L1B3RT4S

L1B3RT45...

CVE-2026-92232

The Joomla! Core component is vulnerable to a Cross-Site Scripting (XSS) filter bypass in the InputFilter component, specifically affecting versions 1.5.0-5.4.8 and 6.0.0-6.1.3 . The root cause is that the cleanAttribute method fails to properly sanitize HTML data URIs when injected whitespace ch...

stegcloak

StegCloak The Cloak of Invisibility for your texts StegCloak is a pure JavaScript steganography module designed in functional programming style, to hide secrets inside text by compressing and encrypting the secret before cloaking it with special unicode invisible characters. It can be used to...

stegcloak

StegCloak 你的文本隐形斗篷 StegCloak 是一个纯 JavaScript 的隐写术模块，采用函数式编程风格设计，通过压缩和加密秘密信息，然后利用特殊的 Unicode 不可见字符将其隐藏在文本中。它可以安全地用于水印字符串、网页上的不可见脚本、社交媒体文本或其他任何隐蔽通信。完全不可见！通过这篇 Medium 文章详细了解其工作原理，或观看我们的演示以了解其功能。 特性 使用密码和 HMAC 完整性保护您的不可见秘密 通过使用 AES-256-CTR 加密不可见秘密，实现密码学安全 使用 6 个 Unicode...

CVE-2026-95509

The Qt for MCUs framework is vulnerable to an out-of-bounds read due to an incorrect buffer size calculation during String.arg() formatting. This issue specifically affects strings optimized for Latin-1 characters when displaying Latin-1 characters. The vulnerability can result in an out-of-bound...

weakpass

Weakpass Here, you can find the list of tools and example of API server from weakpass.com for password and hash cracking in one place. 📂 Folder Structure tools A collection of password and hash cracking tools. Check them out: Kraker-js Lookup Passcheck Passgen libs Links to the libraries used in...

BIT-OPENBAO-2026-71543 OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter pa...

SafeText

SafeText 用于净化文本的工具，通过移除零宽字符和同形异义字，确保来自匿名来源的文档能够安全分发。 试图泄露电子邮件或其他文本文件的个人，面临通过指纹识别被鉴别的风险。指纹识别通常发生在原始文档分发者嵌入了某种形式的“金丝雀”时。例如，埃隆·马斯克在2008年针对泄密事件的邮件中，为每位员工提供了略有不同的措辞。这一策略被员工识破并失败。另一种同样被使用的更简单策略，是在文本中嵌入几乎不可见的修改。SafeText旨在识别并移除这些修改。 具体来说，该工具将移除同形异义字、零宽字符以及其他隐蔽字符。该工具还会尝试识别可能暴露个人所在位置的独特单词拼写。 用法...

shiro-cve-2020-17523

Apache Shiro 两种姿势绕过认证分析（CVE-2020-17523） 0x01 漏洞描述 Apache Shiro是一个强大且易用的Java安全框架，执行身份验证、授权、密码和会话管理。使用Shiro的易于理解的API，您可以快速、轻松地获得任何应用程序，从最小的移动应用程序到最大的网络和企业应用程序。 当它和 Spring 结合使用时，在一定权限匹配规则下，攻击者可通过构造特殊的 HTTP 请求包完成身份认证绕过。 影响范围：Apache Shiro 1.7.1 0x02 漏洞环境搭建 shiro 1.7.0...

sharesniffer

sharesniffer sharesniffer is a network analysis tool for finding open and closed file shares on your local network. It includes auto-network discovery and auto-mounting of any open cifs and nfs shares. How to use Example to find all hosts on any local network with open/closed nfs/smb shares: pyth...

EUVD-2026-88536

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

CVE-2007-2447

CVE-2007-2447 Samba 3.0.0 - 3.0.25rc3 son susceptibles a la Vulnerabilidad de Inyección Remota de Comandos CVE-2007-2447, lo que permite a atacantes remotos ejecutar comandos arbitrarios especificando un nombre de usuario que contenga metacaracteres de shell...

bidi-guard

bidi-guard Scan code for invisible bidirectional Unicode characters Why This Exists Invisible Unicode bidirectional characters can make source code display differently than it executes. This is CVE-2021-42574 — the Trojan Source attack. An attacker embeds characters that reverse text direction. I...

expat: Expat: XML Injection via Malformed UTF-16 Input

A flaw was found in Expat. This vulnerability allows a remote attacker to send specially crafted UTF-16 encoded XML data. Due to improper validation of surrogate characters, the parser can be tricked into accepting malformed sequences, which can hide legitimate markup characters. This could enabl...

CVE-2026-101015

A flaw was found in OpenDMARC. A remote attacker can bypass Domain-based Message Authentication, Reporting, and Conformance DMARC policy checks by submitting domain names containing equivalent Unicode dot characters. Due to improper input validation in domain handling, the service fails to enforc...

CVE-2026-100866

A flaw was found in onefetch. An attacker can manipulate terminal output by embedding control characters and escape sequences into project manifest fields, such as the project name or version. When a user runs onefetch in an untrusted repository, these unsanitized values are printed directly to t...

CVE-2022-41220

CVE-2022-41220 描述 md2roff 1.9 存在一个基于栈的缓冲区溢出漏洞，通过一个包含大量连续待处理字符的 Markdown 文件触发。 漏洞复现 要复现该漏洞，请下载一个易受攻击的 md2roff 版本（1.9）： git clone https://github.com/nereusx/md2roff.git cd md2roff git checkout 9241b8cfeb687c57099f3ef45f03a8ad3f291cf4 make 项目编译完成后，我们可以处理一个由模糊测试生成的恶意 Markdown 文件来复现程序崩溃： ./md2roff...

CVE-2026-100867

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof...