Overglade-Badges

Overglade Hackathon Badges These are zero-power hackathon badges I designed for the overglade hackathon in singapore! They're powered by the RP2040 and have passive NFC and an onboard e-ink driver! Custom Features Passive NFC tap for whatever your heart desires E-ink support so that you don't nee...

purpleteam

purpleteam CLI CLI component of purpleteam - Currently in alpha Installation Simplest npm install -g purpleteam If you want to debug Clone this repository. Configuration Copy the config/config.example.json to either config/config.local.json or config/config.cloud.json depending on which...

dcsgonebadge

DEF CON Singapore One Badge This project manages the hardware design of the Circuit Crafters first project, an electronic hardware badge intended for distribution at the DEF CON Singapore 2026 security conference at the Marina Bay Sands Expo and Convention Centre. License This project is licensed...

CVE-2025-61777

CVE-2025-61777 1. Unauthorized modification of badge templates on FlagforgeCTF CVE-2025-61777 Summary The Flagforge application https://flagforge.xyz exposes critical vulnerabilities in its administrative API endpoints, specifically /api/admin/badge-templates GET and...

CVE-2026-106161

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing even...

EUVD-2026-102085

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing even...

CVE-2026-106161

Progress Kendo UI for jQuery releases from v2020.1.114 up to (but not including) v2026.3.1015 are vulnerable to Cross-Site Scripting (XSS) . The Badge text method fails to encode string values, rendering them as raw HTML even when supplied through text binding. An attacker capable of modifying bo...

CVE-2026-106161 Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing even...

CVE-2026-73126

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository...

CVE-2026-73126 Gitea private workflow badge token scope bypass

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository...

CVE-2026-73126

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository...

CVE-2026-73126

Gitea versions

CVE-2026-73126 Gitea private workflow badge token scope bypass

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository...

CVE-2026-73126

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository...

gha-lab-232af4821f

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of BraveUX/for-the-badge at commit...

DC30-Badge-Challenge-Writeup

DC30-Badge-Challenge-Writeup Table of Contents Intro Challenge Part 1: Gathering Notes Challenge Part 2: Calling YИИEႱ Challenge Part 2A: Alice Challenge Part 2B: Bob Challenge Part 2C: Carol Challenge Part 2D: Dan Challenge Part 2E: Eve Challenge Part 2F: Trevor Challenge Part 3: The Final Threa...

dc34-vault

DC34 vault Application !WARNING Loading your own firmware onto your badge will wipe the light encryption key and cause your badge to enter developer mode. NOTICE: this repo is now orphaned and will be archived soon, as it is now merged into xous-core. It only existed in the bunnie github reposito...

CVE-2026-91022

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any...

CVE-2026-91022

The Motors WordPress plugin (versions before 1.4.124 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue occurs because the plugin fails to properly sanitize and escape a listing badge setting before rendering it within an HTML attribute. This allows users with a custom, admini...

CVE-2026-91022 Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any...