CVE-2026-112014

The software LobsterAI prior to version 2026.10.16 contains a hardcoded password vulnerability (CWE-321). This flaw allows an attacker who obtains an exported provider file to decrypt third-party AI provider API keys. The vulnerability stems from using the constant 'lobsterai-APP' to encrypt keys...

cve-2025-59287

CVE-2025-59287 - WSUS Exploitation Toolkit by adel-h4x0a ⚠️ For Educational and Authorized Testing Purposes Only ⚠️ Overview This toolkit demonstrates the exploitation of CVE-2025-59287, a remote code execution vulnerability in Windows Server Update Services WSUS. Components 1. Encryption Module...

Linux Distros Unpatched Vulnerability : CVE-2026-98805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM...

PT-2026-116618

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

SrHollow

SrHollow LSA secrets extraction, reuse a preexisting VSS shadow copy + inline regf parser + AES-256 LSA decrypt via bcrypt.dll. Chain in 6 steps 1. Enumerate\GLOBAL?? via NtOpenDirectoryObject + NtQueryDirectoryObject. Pick the highest-numbered HarddiskVolumeShadowCopyN. 2. If none exists , fall...

openmeetings-remember-me-password

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-remember-me-password openmeetings-remember-me-password Class: ATO Reach: Remote Apache OpenMeetings 9.1.0. CVE-2026-33266 closed the hardcoded remember-me key per-instance AES-GCM. Cookie LoggedIn still...

Steganography-Online-Codec-JavaScript

Steganography Online Codec SDK for JavaScript & NPM Steganographic Online Codec allows you to hide a password encrypted message within the images & photos using AES encryption algorithm with a 256-bit PBKDF2 derived key. You can use it for free at:...

kroxylicious-pqc-filter

Kroxylicious PQC Record Encryption Filter A Kroxylicious filter plugin that provides transparent Post-Quantum Cryptography PQC record-level encryption for Apache Kafka using ML-KEM FIPS 203 key encapsulation with AES-256-GCM symmetric encryption. Kafka producers and consumers require zero code...

gpgsm-cve-2026-57062-cms-gcm-short-tag

gpgsm CVE-2026-57062: CMS AES-GCM short tag USN-8720-1 GnuPG's gpgsm the S/MIME and CMS tool derives the authentication tag length it verifies from the mac OCTET STRING in a CMS AuthEnvelopedData RFC 5083 AES-256-GCM message, and libgcrypt accepts tags as short as 4 bytes. RFC 5084 requires at...

CVE-2023-3350

CVE-2023-3349 / CVE-2023-3350 | IBERMATICA RPS 2019 Security research documenting an unauthenticated information disclosure and a cryptographic design flaw in IBERMATICA RPS 2019. The vulnerabilities can be chained to expose application logs containing authentication-related SQL queries and recov...

CVE-2026-111696

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-111696

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

EUVD-2026-102987

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

rust_citadel

Citadel Post-quantum hybrid encryption and key management server. Citadel combines X25519 + ML-KEM-768 for key encapsulation and AES-256-GCM for data encryption, following NIST's hybrid approach for the post-quantum transition. Applications encrypt and decrypt data through a REST API. Citadel...

SHIRO-721

SHIRO-721 RememberMe Padding Oracle Vulnerability RCE 0x00 Introduction: The RememberMe cookie is encrypted using AES-128-CBC mode, which is vulnerable to padding oracle attacks. An attacker can use a valid RememberMe cookie as a prefix for a Padding Oracle Attack, and then craft a malicious...

CVE-2026-11110-AES-GCM-Nonce-Reuse-Leading-to-Key-Recovery

CVE-2026-11110 – AES-GCM Nonce Reuse Leading to Key Recovery Program Code Python aesgcmnoncereusesim.py - Simulated encryption oracle with fixed nonce from Crypto.Cipher import AES import os key = os.urandom16 nonce = b'\x00' 12 ALWAYS SAME NONCE def encryptplaintext: cipher = AES.newkey,...

nounours

Nounours Nounours is a tool designed to test APPKEYs at scale on Laravel applications. Developed by Damien Picard. Description Nounours was written to test combinations of APPKEY and Laravel ciphers found in open sources. The goal is to have a fast brute-force loop by leveraging the following...

wibu-codemeter-analysis

Cryptographic Analysis of WIBU CodeMeter DLL Independent security research on WIBU-Systems CodeMeter protection Responsible Disclosure Vendor notified: December 24, 2025 Disclosure period: 90 days Public release: March 24, 2026 Scope: WibuBz32.dll analysis only Summary Analysis of WIBU CodeMeter...

EUVD-2026-102651

The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

TinkererShell

TinkererShell A simple reverse shell written in python 3.7 just for fun. Actually it supports Windows and Linux OS and integrates some basic features like keylogging and AES encrypted communications. Supported operating systems: Windows Linux OSX Functions and characteristics: Reverse connection...