hyperfox

Hyperfox Hyperfox is a security auditing tool that proxies and records HTTP and HTTPS traffic between two points. Installation You can install the latest version of hyperfox to /usr/local/bin with the following command requires admin privileges: curl -sL...

ForgeCert

ForgeCert ForgeCert uses the BouncyCastle C API and a stolen Certificate Authority CA certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory. This attack is codified as DPERSIST1 in our "Certified Pre-Owned" whitepaper. This code base was...

Security update for mozilla-nss

This update for mozilla-nss fixes the following issue: remove compromised eMudhra Intermediates CA bsc1286261. Changes for mozilla-nss: update to NSS 3.125.1 bsc1289144: bmo2088196 - backport nssckbi 2.92. bmo2082793 - Don't cache sessions when ECH was rejected. bmo2082792 - Keep DTLS handshake...

CVE-2026-116677

A flaw was found in openwisp-controller. An authorization bypass vulnerability in the certificate revocation list CRL download endpoint allows an authenticated user with Certificate Authority CA view permissions to retrieve CRL data belonging to other organizations by specifying their sequential ...

CVE-2026-119573

A flaw was found in Traefik. An authorization bypass vulnerability exists in the Kubernetes Ingress NGINX provider when cached client authentication Transport Layer Security TLS configurations are reused. An authenticated user with permissions to create Ingress resources can bypass cross-namespac...

ecapture

eCapture 旁观者 Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. English · 汉字 !IMPORTANT Supports Linux on x8664 kernel 4.18+, aarch64 kernel 5.5+, and LoongArch64 loong64 kernel 6.6+. Android supports x8664 and aarch64 with the existing kernel minimums. Requires root...

mkchain

mkchain Open source tool to help you build a valid SSL certificate chain. Description • How To Use • Parameters • How it works • Requirements • Other • License Description Is an open source tool to help you build a valid SSL certificate chain. Also can help you fix the incomplete chain and downlo...

ejbca-pqc-lab

EJBCA Pure PQC Lab — ML-DSA-65 Two-Tier PKI Hierarchy A hands-on implementation of NIST FIPS 204 ML-DSA in a two-tier PKI hierarchy using EJBCA Community Edition. 📖 Full walkthrough: Building a Post-Quantum PKI: How I Signed a Root CA and Sub CA Using ML-DSA on EJBCA What This Lab Builds A comple...

CVE-2026-119190

A flaw was found in node-forge. The certificate verification mechanism improperly parses deprecated extension identifiers as standard basic constraints when validating certificate chains. An attacker holding a certificate issued by a trusted Certificate Authority CA with a permissive deprecated...

CVE-2026-109359

A flaw was found in Contrast. The Coordinator peer recovery process fails to verify that a serving peer uses the current manifest generation. An attacker with write access to the manifest history can exploit this flaw by replaying superseded history records. This action can lead to sensitive...

certsync

certsync certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate...

test-certs-site

test-certs-site Introduction This is a purpose-built webserver for hosting the test pages required by the CA/Browser forum Baseline Requirements. They contain the following requirement: The CA SHALL host test Web pages that allow Application Software Suppliers to test their software with Subscrib...

CVE-2026-116641

A flaw was found in mongo-tools. The application fails to reject connections using certificates issued by distrusted Certificate Authorities CAs due to an incomplete internal certificate denylist. A remote attacker in an intercepted network position could exploit this flaw by presenting a...

CVE-2026-77691

ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA...

CVE-2026-77691

ZohoCorp ManageEngine Key Manager Plus versions prior to 7151 are vulnerable to an OS Command Injection (CWE-78) flaw. The vulnerability occurs because the application allows authenticated users to submit malicious input during the configuration of a Microsoft CA . Successful exploitation could l...

CVE-2026-77691 Command injection vulnerability

ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA...

Kibana 8.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 (ESA-2026-229)

The version of Kibana installed on the remote host is 8.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-229 advisory. - The system certificate authority CA store in Red Hat products, distributed via...

CVE-2026-109141

The vulnerability gives a role that is restricted to a list of CAs cas = ... its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resource...

CVE-2026-109142

The Krill server is vulnerable to an authorization bypass when a Certificate Authority (CA) and its parent reside on the same server. Instead of verifying a signed CMS message, the system executes the RFC 6492 provisioning exchange in-process and trusts the child_handle provided by the caller in ...

CVE-2026-109142 Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...