CVE-2026-112014

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

CVE-2020-10560-Key-Recovery

CVE-2020-10560 Key Recovery AES This PoC recovers the sitekey for OSSN 5.3 and above. For more information see http://techanarchy.net/blog/cve-2020-10560-ossn-arbitrary-file-read...

CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

EUVD-2026-103467

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

CVE-2026-112014

The software LobsterAI prior to version 2026.10.16 contains a hardcoded password vulnerability (CWE-321). This flaw allows an attacker who obtains an exported provider file to decrypt third-party AI provider API keys. The vulnerability stems from using the constant 'lobsterai-APP' to encrypt keys...

cve-2025-59287

CVE-2025-59287 - WSUS Exploitation Toolkit by adel-h4x0a ⚠️ For Educational and Authorized Testing Purposes Only ⚠️ Overview This toolkit demonstrates the exploitation of CVE-2025-59287, a remote code execution vulnerability in Windows Server Update Services WSUS. Components 1. Encryption Module...

PT-2026-116618

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

SrHollow

SrHollow LSA secrets extraction, reuse a preexisting VSS shadow copy + inline regf parser + AES-256 LSA decrypt via bcrypt.dll. Chain in 6 steps 1. Enumerate\GLOBAL?? via NtOpenDirectoryObject + NtQueryDirectoryObject. Pick the highest-numbered HarddiskVolumeShadowCopyN. 2. If none exists , fall...

openmeetings-remember-me-password

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-remember-me-password openmeetings-remember-me-password Class: ATO Reach: Remote Apache OpenMeetings 9.1.0. CVE-2026-33266 closed the hardcoded remember-me key per-instance AES-GCM. Cookie LoggedIn still...

Steganography-Online-Codec-JavaScript

Steganography Online Codec SDK for JavaScript & NPM Steganographic Online Codec allows you to hide a password encrypted message within the images & photos using AES encryption algorithm with a 256-bit PBKDF2 derived key. You can use it for free at:...

kroxylicious-pqc-filter

Kroxylicious PQC Record Encryption Filter A Kroxylicious filter plugin that provides transparent Post-Quantum Cryptography PQC record-level encryption for Apache Kafka using ML-KEM FIPS 203 key encapsulation with AES-256-GCM symmetric encryption. Kafka producers and consumers require zero code...

gpgsm-cve-2026-57062-cms-gcm-short-tag

gpgsm CVE-2026-57062: CMS AES-GCM short tag USN-8720-1 GnuPG's gpgsm the S/MIME and CMS tool derives the authentication tag length it verifies from the mac OCTET STRING in a CMS AuthEnvelopedData RFC 5083 AES-256-GCM message, and libgcrypt accepts tags as short as 4 bytes. RFC 5084 requires at...

CVE-2023-3350

CVE-2023-3349 / CVE-2023-3350 | IBERMATICA RPS 2019 Security research documenting an unauthenticated information disclosure and a cryptographic design flaw in IBERMATICA RPS 2019. The vulnerabilities can be chained to expose application logs containing authentication-related SQL queries and recov...

CVE-2026-111696

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-111696

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

EUVD-2026-102987

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

rust_citadel

Citadel Post-quantum hybrid encryption and key management server. Citadel combines X25519 + ML-KEM-768 for key encapsulation and AES-256-GCM for data encryption, following NIST's hybrid approach for the post-quantum transition. Applications encrypt and decrypt data through a REST API. Citadel...

PatchlessCLRLoader

PatchlessCLRLoader PatchlessCLRLoader is a fork of InlineExecute-Assembly to load .NET assembly and direct the output to mailslot. I rewrites it to a standalone loader with the following implementation: AES encryption payload Fileless payload support Patchless AMSI and ETW bypass using hardware...

SHIRO-721

SHIRO-721 RememberMe Padding Oracle Vulnerability RCE 0x00 Introduction: The RememberMe cookie is encrypted using AES-128-CBC mode, which is vulnerable to padding oracle attacks. An attacker can use a valid RememberMe cookie as a prefix for a Padding Oracle Attack, and then craft a malicious...

CVE-2026-11110-AES-GCM-Nonce-Reuse-Leading-to-Key-Recovery

CVE-2026-11110 – AES-GCM Nonce Reuse Leading to Key Recovery Program Code Python aesgcmnoncereusesim.py - Simulated encryption oracle with fixed nonce from Crypto.Cipher import AES import os key = os.urandom16 nonce = b'\x00' 12 ALWAYS SAME NONCE def encryptplaintext: cipher = AES.newkey,...