GHSA-3C93-F73F-QC9H social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

TLPE

This is a PoC and a writeup for CVE-2026-49881, a logic issue in the InCallController class in Android 17's Telecom service that allows an unprivileged app to gain arbitrary code execution as UID 1000 systemserver with no extra user interaction. We also show here that systemserver code execution...

LSPromise

LSPromise A complete exploit chain that enables privilege escalation from a local untrusted app to root/kernel. It does not involve memory corruptions or race conditions, so attackers don't need to perform complex heap spraying or bypass mitigations against memory corruption vulnerabilities such ...

gha-lab-40e23db109

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gradio-app/gradio at commit...

CVE-2026-75604

CVE-2026-75604 RCE PoC CVE-2026-75604 の Python 概念実証コード。Windows 上でホストされている Next.js アプリケーションPages Router と App Router を Cache Components なしで使用における、認証不要のリモートコード実行の脆弱性を実証します。 デモ 要件 Next.js =13.4 =16.0 16.3.3 ネイティブ Windows サーバー Cache Components を使用しない Pages Router と App Router 動的な Pages ISR ルートと動的なキャッ...

CVE-2026-7671

CVE-2026-7671 - Tornet Scooter OTP Brute Force Summary Improper restriction of excessive authentication attempts CWE-307 in Tornet Scooter Mobile App 4.75 on Android. Details The /TwoFactor endpoint does not implement rate limiting or lockout. A 4-digit OTP 0000-9999 can be brute-forced remotely...

passera

Nota: Ya no tengo tiempo para continuar con el desarrollo de Passera, ¡pero las pull requests son más que bienvenidas! El elemento más solicitado sería una extensión de Firefox actualizada, ya que el último cambio en la API rompió la versión actual. Passera Una herramienta sencilla que permite a...

CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

EUVD-2026-86312

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178

The Python Social Auth library, specifically the vk-app backend , is vulnerable to an authentication bypass in versions prior to 5.0.0 . The root cause is that the backend accepts VK application callback data without verifying the signature when the auth_key parameter is missing. This allows an a...

vulnerable-java-app

Este repositorio no tiene un README...

next-rep-CVE-2026-4800

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. T...

ios-nehelper-enum-apps-0day

nehelper enumerate installed apps 0-day iOS 15.0 I've updated this code to avoid using Private API directly. Read more in my blog post. However, that means that now this code is iOS version-specific and possibly device model-specific. So if it doesn't work on your device, recalculate and update t...

CVE-2022-44830

Descripción sugerida Se descubrió que Sourcecodester Event Registration App v1.0 contiene múltiples vulnerabilidades de inyección CSV a través de los campos Nombre, Contacto y Observaciones. Estas vulnerabilidades permiten a los atacantes ejecutar código arbitrario mediante un archivo Excel...

CVE-2022-22845-Exploit

CVE-2022-22845-Exploit Exploit para CVE-2022-22845 - Toma de control de administrador no autenticado en QXIP SIPCAPTURE Homer-App hasta 1.4.27 Descubrimiento: Omri Baso & Fabien Aunay Autor del exploit: Omri Baso...

Security Bulletin: QRadar App SDK for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar App SDK has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION:...

react2shell-security-toolkit

🛡️ Kit de seguridad React2Shell Kit de seguridad para detectar y mitigar la vulnerabilidad CVE-2025-55182 React2Shell ⚠️ CRÍTICO : ¡Esta vulnerabilidad CVSS 10.0 está siendo explotada activamente! Inicio rápido root@kitploit: npm install -g react2shell-security-toolkit npx react2shell-check ¿Qué es...

nexts-cve-2025-66478-exploit

Este es un proyecto de Next.js creado con create-next-app. Comenzando Primero, ejecuta el servidor de desarrollo: root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev Abre http://localhost:3000 con tu navegador para ver el resultado. Puedes empezar a editar la página modificando...