blitzstrike

Blitz Strike Ricognizione rapida. Analisi approfondita. Validazione prima del report. Blitz Strike è una metodologia strutturata di penetration testing — ricognizione, analisi del codice sorgente e validazione — erogata come server MCP universale. Enumera la superficie d'attacco BLITZ, traccia la...

CVE-2025-24893-POC

CVE-2025-24893 Install bun: curl -fsSL https://bun.com/install | bash To install dependencies: bun install To run: bun run CVE-2025-24893.ts This project was created using bun init in bun v1.2.19. Bun is a fast all-in-one JavaScript runtime. How to use: Usage: bun CVE-2025-24893.ts options Option...

EUVD-2026-88626

pbkdf2 rehashes long passwords on every iteration, enabling denial of service...

SUSE CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the pbkdf2 function in lib/sync.js, which passes the raw password to createHmac on every PBKDF2 iteration. Because HMAC rehashes any key longer than the digest's block size per RF...

CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

UBUNTU-CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

CVE-2026-102414

The pbkdf2 library (versions through 3.1.6 ) contains a vulnerability where passwords exceeding the digest's block size (64 bytes, or 128 bytes for sha384/sha512) are re-hashed on every iteration within the JavaScript fallback (lib/sync.js ). This results in a computational cost of O(iterations ×...

CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

CVE-2026-102414: Uncontrolled Resource Consumption

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

CyberStar

--- Table of Contents - Overview - Architectu...

blitzstrike

BlitzStrike MCP security-audit toolbelt — blitz triage → eagle-e...

PT-2026-80583

These are all security issues fixed in the bun-1.4.0git20260808.52bf09cb-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11535-1 bun-1.4.0~git20260808.52bf09cb-2.1 on GA media

These are all security issues fixed in the bun-1.4.0git20260808.52bf09cb-2.1 package on the GA media of openSUSE Tumbleweed...

MAL-2026-13983 Malicious code in knip-bun (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d412258df9a21f510333926a9be29bed8ae6368e549e295c84e187bdc1a3725 Package knip-bun typosquats the popular knip linter. The main module is an empty stub module.exports = , and package.json declares a dependency...

Malicious Package

Overview knip-bun is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. Microsoft Defender XDR detections 5. Advanced hunting queries 6. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400...