digital-forensics-lab

Digital Forensics Lab & Shared Cyber Forensic Intelligence Repository Features of Repository Interactive Digital Forensics Labs: Tailored for students and faculty engagement Linux-Centric Lab Environment: Utilizes Kali Linux exclusively for all labs Visual Learning Support: Each lab includes...

Notes

Security Engineering at Google: My Interview Study Notes By nolang I am a security engineer at Google and these are the notes from when I was studying for the interviews. This is my first job in security and a lot of people have asked me how I studied. My notes consist mostly of a list of terms a...

linux-insides

linux-insides A book-in-progress about the Linux kernel and its insides. Introduction • Chapter status • Requirements • Translations • Contributing • Author Introduction linux-insides is a book-in-progress about the Linux kernel and its insides. The goal of this project is simple - to share...

CVE-2026-95699

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and...

CVE-2026-95699

The iSteamX mobile application (MrSteam) contains an improper isolation or compartmentalization vulnerability due to a flaw in its AWS policy . This policy allowed authenticated users to access wildcard MQTT topics , potentially exposing other users' device data and profile information. An attack...

CVE-2026-95699 MrSteam iSteamX Improper Isolation or Compartmentalization

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and...

EUVD-2026-86468

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and...

PT-2026-98302

Name of the Vulnerable Software and Affected Versions iSteamX mobile application versions prior to 9/18/2026 Description The AWS policy of the application allows authenticated users to access wildcard MQTT topics. This flaw enables an attacker to expose device data from other users and control...

CVE-2026-92760 Shlink through 5.1.6 Mercure Token Authorization Bypass

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

REcon 2023 Conference Slides

REcon 2023 conference slides for topics Ice Ice Baby: Coppin' RAM With DIY Cryo-Mechanical Robot, Handoff All Your Privacy Again, Adventures of My Oven Pinocchio with ChipWhisperer, Enabling Security Research on Qualcomm Wifi Chips, The Hunt for Red October - One Ping Too Many, Cracking the Final...

Black Hat USA 2024 Conference Slides

Black Hat USA 2024 conference slides for topics Self-Hosted GitHub CI/CD Runners: Continuous Integration, Continuous Destruction, From Weapon to Target: Quantum Computers Paradox, Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap, Windows Downdate: Downgrade Attacks Usin...

CVE-2026-71576: Insufficient Verification of Data Authenticity

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...

Paged Out! Magazine Issue 8

Paged Out! magazine issue 8 includes sections related to art, algorithms, artificial intelligence, assembly, cryptography, encodings, file formats, food for thought, hardware, networks, OS internals, operating systems, programming, retro stuff, reverse engineering, security / hacking, and system...

JLSEC-2026-1125

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the $MQTT. namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. Versions...

CVE-2026-69091

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...

CVE-2026-69091

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...

EUVD-2026-52284

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...

CVE-2026-69091 Admidio before 5.0.11 Authentication Bypass via forum.php

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...

CVE-2026-69091: Missing Authentication for Critical Function

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...

classy-core (0.1.0a0), disformers (>=0.0.1, <=0.10.7) +2 more potentially affected by CVE-2026-9856 via transformers (4.11.0)

transformers PYPI version 4.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - classy-core 0.1.0a0 - disformers =0.0.1, =0.10.7 - pyconverse 0.1.0 - zeroshot-topics 0.1.0 Source cves: CVE-2026-9856 Source advisory:...