Quantum-Silicon-Core-Loader

Quantum Silicon Core Loader Primary Core: qslcl.asm v0.0.2 under development Assistant Module: qslcl.bin v0.7.4 Universal Controller: qslcl.py v2.2.2 Legally Protected Research - This project operates under established legal frameworks for security research, right to repair, and academic freedom...

mkdev

mkdev Real HTTPS for local dev — with a TUI and LAN sharing. mkdev runs trusted HTTPS on .local. A single Go binary: cert authority + reverse proxy + /etc/hosts + mDNS broadcast + a full TUI. What makes it different: LAN sharing Mark a route shared, hit https://app.local from your phone or any...

CVE-2026-24423

CVE-2026-24423 CVE-2026-24423 – 재현 ⚠️ 보안 연구 및 승인된 테스트 전용 / For security research and authorized testing only 개요（Overview） 이 프로젝트는 CVE-2026-24423 취약점을 재현하기 위한 것입니다. 해당 취약점은 SmarterMail ConnectToHub 기능에 존재하며, 근본 원인은 다음과 같습니다: - 관리자 수준 인터페이스에 인증이 없음 - 서버가 사용자가 지정한 Hub에 능동적으로 연결함（SSRF） - 외부 Hub가 반환한...

CVE-2026-27597

CVE-2026-27597 - 버전 원격 코드 실행 빠른 사용법 python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe 악용 참고 사항 심각도: CRITICAL CVSS: 10.0 영향: 기밀성, 무결성, 가용성 게시일: 2026-02-25 기술 요약 Enclave는 안전한 AI 에이전트 코드 실행을 위해 설계된 보안 JavaScript 샌드박스입니다. 버전 2.11.1 이전에는 @enclave-vm/core에 의해 설정된 보안 경계를 우회할...

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

SummaryDecepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

SummaryDecepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

SummaryDecepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

SummaryAutobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 byt...

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

SummaryAutobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 byt...

sanic chunked trailer request smuggling allows hidden second request execution

DescriptionSanic's HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating 0\r\n chunk. Because of that, attacker-controlled bytes left in the connection buffer after the first chunked request can be interpreted as the start of a new HTTP request on the same...

CVE-2026-22019-libcurl-HTTP-2-CONNECT-Tunnel-Mixup

CVE-2026-22019 – libcurl HTTP/2 CONNECT 터널 혼동 프로그램 코드 C 시뮬레이션 // curlhttp2tunnelmixup.c - Simulated libcurl handling CONNECT over HTTP/2 include void handlehttp2streamint streamid // Vulnerability: after CONNECT, the proxy mixes streams with the tunneled data if streamid == 0 printf"CONNECT to...

EUVD-2026-81601

vm2: Incomplete nodejs. symbol filtering lets sandbox override host WebStream state checks...

llm-differential-privacy-gateway

Noisegate: 신뢰할 수 없는 AI 에이전트를 위한 차등 프라이버시 게이트웨이 민감한 데이터를 연구할 수 있지만 누구도 특정할 수는 없는 AI 에이전트. 그 한계는 수학적이며, 에이전트가 접근할 수 없는 코드로 강제되고, 이 저장소는 이를 깨뜨리려는 공격까지 함께 제공한다. 녹화된 Claude Desktop 세션답변은 축약됨; 차트 카드는 세션 자체의 것. AI 에이전트가 20명의 환자를 진단별로 분류하면 ±12 노이즈가 모든 구간을 압도한다. 노이즈를 끌 수 없다는 사실을 상기한 에이전트는 세 번의 답변 예산을 소진하고...

CTF-Web-Exploitation

Nether Portal Desync HUUP "I travel not on established roads but leap freely across the void. Package me wrong, and I'll deliver a secret to the wrong doorstep." Description The challenge features an HTTP/3 QUIC application layered over UDP. Because UDP is stateless and the proxy doesn't enforce...

boundary

Boundary Boundaryとは: https://developer.hashicorp.com/boundary/docs/what-is-boundary ウェブサイト: https://www.developer.hashicorp.com/boundary/ フォーラム: HashiCorp Discuss ドキュメント: https://developer.hashicorp.com/boundary/docs チュートリアル: HashiCorpのLearnプラットフォーム...

CVE-2025-7783-poc

form-data boundary randomness vulnerability CVE-2025-7783 Largely based on https://hackerone.com/reports/2913312 by https://hackerone.com/parrot409?type=user Installing: npm install Make sure you have python3 installed with the z3 module pip3 install -r requirements.txt -- the exploit code shells...

NPM: hono/jsx renders plain strings unescaped in boundary components, leading to XSS

NPM: hono/jsx renders plain strings unescaped in boundary components, leading to XSS vulnerability discovered by ? in WordPress Npm hono versions 4.13.7...

sgxray

SGXRay: Автоматизация обнаружения уязвимостей для приложений SGX Intel SGX защищает изолированную логику приложения и конфиденциальные данные внутри анклава с помощью аппаратного шифрования памяти. Использование такого механизма аппаратной безопасности требует строгой модели программирования при...

CVE-2026-51864

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in pythonfileupload packages/dbgpt-app/src/dbgptapp/openapi/apiv1/pythonuploadapi.py:42. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...

firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component...