libqcow

libqcow is a library to access the QEMU Copy-On-Write QCOW image file format. Project information: Status: alpha Licence: LGPL-3.0-or-later Read-only supported QCOW formats: version 1 version 2 version 3 Supported QCOW format features: zlib DEFLATE compression AES-CBC 128-bit encryption backing...

CVE-2026-31635

🩸 CVE-2026-31635 – DirtyDecrypt Linux Kernel Local Privilege Escalation via RXGK Page Cache Corruption "DirtyDecrypt" — Part of the 2026 "Dirty" family exploits 📖 Overview DirtyDecrypt CVE-2026-31635 is a local privilege escalation vulnerability in the Linux kernel's rxrpc subsystem specifically...

AES-Killer

AES Killer Burpsuite Plugin Burpsuite Plugin to decrypt AES Encrypted traffic on the fly Requirements Burpsuite Tested on Burpsuite 2021.4 Windows 10 Ubuntu & PopOS What it does The IProxyListener decrypt requests and encrypt responses, and an IHttpListener than encrypt requests and decrypt...

dbd

d8888b. d8888b. d8888b. 88 8D 88 8D 88 8D 88 88 88oooY' 88 88 88 88 88b. 88 88 88 .8D 88 8D 88 .8D Y8888D' Y8888P' Y8888D' Durandal's Backdoor Copyright C 2013 Kyle Barnthouse [email protected] dbd is distributed under the GNU GPL Mipsbe binary added by Darkerego https://github.com/darkerego...

meesho-android-improper-encryption-cve-2026-5682

🔐 Proof of Concept: Meesho Android App – Insecure Cryptographic Implementation AES-CBC without Integrity + Weak Key Derivation Author: Soyam Arya aka honestcorrupt Date of Discovery: March 2026 Affected App: Meesho Android App com.meesho.supply Status: Under Verification Category: Insufficient...

LazZzy_Dump

laZzzy Dump A static analysis tool for extracting encrypted shellcode from laZzzy-wrapped PE binaries without requiring dynamic execution, debugging, or emulation. Overview laZzzy Dump is a malware analysis tool which aids analysis through static extraction of shellcode from binaries compiled wit...

CVE-2026-11119-Padding-Oracle-Attack-on-CBC-Mode-Encryption

CVE-2026-11119 – Padding Oracle Attack on CBC Mode Encryption Program Code Python paddingoracleserver.py - Server that returns padding error from flask import Flask, request from Crypto.Cipher import AES from Crypto.Util.Padding import pad, unpad import os key = os.urandom16 app = Flaskname...

CVE-2026-89320

HmacShaCryptor.Hash never hashed its input. For any input it returned HMACK"" — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext...

EUVD-2026-108654

HmacShaCryptor.Hash never hashed its input. For any input it returned HMACK"" — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext...

CVE-2026-89320

"HmacShaCryptor.Hash" never hashed its input. For any input it returned "HMACK""" — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext...

PT-2026-121818

HmacShaCryptor.Hash never hashed its input. For any input it returned HMAC K"" — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext...

CLSA-2026-1792632603 cjose: Fix of CVE-2026-53939

CVE-2026-53939: fix all-zero AES-CBC-HMAC content-encryption key...

AlmaLinux 9.6 [TuxCare] Security Update: cjose / cjose-devel (ALMALINUX9.6:CLSA-2026:1792632603)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792632603 advisory. - OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose...

Rocky Linux 9.6 [TuxCare] Security Update: cjose / cjose-devel (ALMALINUX9.6:CLSA-2026:1792632603)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792632603 advisory. - OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjos...

RockyLinux 10 : cjose (RLSA-2026:80605)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:80605 advisory. cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 Tenable has extracted the preceding description block...

RHEL 10 : cjose (RHSA-2026:80605)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:80605 advisory. CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: OpenIDC/cjose uses all-zero Content...

Critical: Red Hat Security Advisory: cjose security update

An update for cjose is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

A flaw was found in cjose. When encrypting a JSON Web Encryption JWE object using AES-CBC-HMAC algorithms, the library initializes the encryption key with all-zero bytes instead of generating a secure random key. As a result, an attacker who intercepts the encrypted message can decrypt sensitive...

RHEL 10 : cjose (RHSA-2026:83224)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83224 advisory. CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: OpenIDC/cjose uses all-zero Content...

Rocky Linux 10.2 [CIQ] Security Update: cjose / cjose-debuginfo / cjose-debugsource / cjose-devel (crlsa-2026_80605)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680605 advisory. cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 Tenable has extracted the preceding description block...