CVE-2026-21009-ECDSA-Nonce-Reuse-in-IoT-Firmware-Signing

CVE-2026-21009 – IoT 固件签名中的 ECDSA Nonce 重用 程序代码（Python） root@kitploit: ecdsanoncereusesim.py - Signing firmware with repeated nonce k import ecdsa, hashlib sk = ecdsa.SigningKey.generatecurve=ecdsa.NIST256p vk = sk.getverifyingkey Sign two different firmware images with same nonce due to bad RNG ...

gitrob

Gitrob: Putting the Open Source in OSINT Gitrob is a tool to help find potentially sensitive files pushed to public repositories on Github. Gitrob will clone repositories belonging to a user or organization down to a configurable depth and iterate through the commit history and flag files that...

DumpsterDiver

DumpsterDiver by @Rzepsky DumpsterDiver is a tool, which can analyze big volumes of data in search of hardcoded secrets like keys e.g. AWS Access Key, Azure Share Key or SSH keys or passwords. Additionally, it allows creating a simple search rules with basic conditions e.g. report only csv files...

SSH-Snake

SSH-Snake: 自動SSHベースネットワークトラバーサル 🐍 SSH-Snakeは、システム上で発見されたSSH秘密鍵を使用して自動的にネットワークトラバーサルを実行するように設計された強力なツールであり、ネットワークとその依存関係の包括的なマップを作成し、特定のシステムから開始してSSHとSSH秘密鍵を使用してネットワークがどの程度侵害される可能性があるかを特定することを目的としています。 SSH-Snakeは、SSHを介して接続されたシステム間の関係を自動的に明らかにすることができ、通常これを手動で行うには膨大な時間と労力がかかります。...

Scalar-Venom-Attack

本文分析了现代加密密钥管理基础设施中发现的加密漏洞，特别关注硬件安全模块（HSM）在处理椭圆曲线私钥时架构中的关键缺陷。研究聚焦于一类利用认证加密设备中隔离不充分的RAM管理的攻击。在现代比特币加密生态系统中，私钥安全是保护全球价值数万亿美元数字资产的基本要求。经FIPS 140-2标准认证的硬件安全模块（HSM）传统上被认为通过硬件级隔离和严格的内存管理协议为加密密钥提供无法穿透的保护。然而，F5OS-A FIPS HSM模块中关键漏洞CVE-2025-60013 的发现，结合Scalar Venom Attack 类攻击（也称为Scalar Poison、Memory Phantom...

user-agent-desktop

本项目已停止维护。 我们建议使用 Ghostery 跟踪器与广告拦截器 搭配 Firefox。 Ghostery 隐私浏览器 Ghostery 桌面浏览器是 Firefox 的一个最小化分支，专为隐私优化。主要额外功能包括： 内置并默认启用 Ghostery 隐私拦截器 扩展。 集成 Ghostery 隐私搜索。 Firefox 设置（遥测等）已调整为最大隐私保护。 下载 Ghostery 浏览器适用于以下平台： Windows（64位） Windows（ARM） Mac OSX Linux（64位） 每日构建频道 我们还提供每日构建版本，用于测试开发中的构建。获取方式如下： 1...

RAMnesia-Attack

This research presents a comprehensive analysis of two critical classes of attacks on the hardware memory of modern computer systems using DDR5 memory: Phoenix Rowhammer Attack CVE-2025-6202 and RAMnesia Attack CVE-2023-39910 . Both attacks demonstrate fundamental vulnerabilities in the processin...

CVE-2026-16750 Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...

test_avb_key

论 几乎 签名 Android 构建 引言 NCC Group 的顾问偶尔会遇到这样的问题：Android 构建使用了已知的私钥进行签名。这使设备制造商（以及他们的用户）暴露在风险之中，即使在启用了安全启动（secure boot）的设备上也是如此。这篇博文有两个目标： 提高对这一问题的认识 介绍一个脚本，用作快速检查，以验证 Android 构建是否（错误地）使用了已知私钥签名。 当基于 Android 的设备启动时，首先会验证引导加载程序（bootloader）运行的是已签名的代码，随后引导加载程序验证高级操作系统（HLOS）。这篇博文仅涉及后者。 保护引导加载程序 – 简要概述...

Phantom-Signature-Attack

本研究论文对比特币协议数字签名实现中的关键漏洞进行了全面的密码分析研究，即 幽灵签名攻击 （CVE-2025-29774）以及根本性的 SIGHASHSINGLE 处理错误。研究表明，交易签名机制中对密码学原语的不正确处理，为加密货币钱包所有者在不知情的情况下完全泄露其私钥创造了条件。该攻击利用了原始中本聪客户端中的一个遗留缺陷：当交易输入和输出数量不匹配时，系统不会拒绝签名，而是返回一个通用哈希值 “1”（uint256）。 研究的实践部分涉及使用 KeyFuzzMaster 密码学工具 ，用于系统性地识别签名验证代码、椭圆曲线运算和交易哈希函数中的漏洞。文中给出了通过 secp256...

CVE-2026-45143 Chamilo LMS: Student-to-admin stored XSS in private messages via v-html

Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/viewmessage.html.twi...

CVE-2026-52727

lxc-ci , the continuous integration and image-build scripts for LXC , shipped Arch Linux images (built from images/archlinux.yaml) that retained a shared pacman local-signing private key in /etc/pacman.d/gnupg. Every container or VM created from those images inherited the same key. An attacker wh...

AZL-102192 CVE-2026-93160 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-ecc - reject hardware ECDH without a public key The hardware ECDH path in atmelecdhcomputesharedsecret uses the private key stored in the device. However, the public key is cached only after atmelecdhsetsecret...

CVE-2026-54676

Scoold , a Q&A and knowledge-sharing platform for teams, is affected by an authorization bypass in ApiController.getPostReplies() (file ApiController.java). Prior to 1.69.0 , the GET /api/posts/{id}/answers endpoint did not call canAccessSpace before returning reply data, allowing users holding a...

CVE-2026-54676 Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

CVE-2026-54677 Scoold: Authenticated user can post replies and comments to private-space questions without space membership

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging to that space because src/main/java/com/erudika/scoold/controllers/QuestionController.java in QuestionController.reply...

CVE-2026-54677

Scoold is a team Q&A and knowledge-sharing platform. Prior to 1.69.0 , the QuestionController.reply() and CommentController.createAjax() methods failed to apply the canAccessSpace authorization check used by the question read path. When scoold.is_default_space_public is set to false and private s...

CVE-2026-93160 crypto: atmel-ecc - reject hardware ECDH without a public key

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-ecc - reject hardware ECDH without a public key The hardware ECDH path in atmelecdhcomputesharedsecret uses the private key stored in the device. However, the public key is cached only after atmelecdhsetsecret...

terrapod-PoC

Terrapod：安全公告 CVE 状态： 已申请，等待分配。此发现已发布为 GHSA-6qrc-597p-mrp9。CVE 分配后，此仓库将重命名为 CVE-YYYY-NNNNN-terrapod-PoC，并且此横幅将替换为 CVE 链接。 | ---|--- 研究员| Dostxodjayev Abdullox @squeeze440 公告| GHSA-6qrc-597p-mrp9 CVSS 3.1| 6.5（中危） 弱点| CWE-862, CWE-284 摘要 Terrapod（main @ b36d953，post-v1.3.1）中 GPG 密钥管理 API...

CVE-2026-86707

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...