poc-CVE-2026-0073

CVE-2026-0073 PoC Wireless ADB TLS Auth Bypass This directory contains a Python proof of concept for CVE-2026-0073. The script is generated using AI-assisted code generation techniques. Summary CVE-2026-0073 is a logic issue in ADB daemon certificate verification adbdtlsverifycert in auth.cpp. Th...

pwnage24mtk

pwnage24mtk Cert exploit for MTK devices.There is a logic flaw in MTK cert verification process.Similar to CVE-2023-20696. Patched. CVE-2023-20696 CVE-2025-20730 There are some issues about architecture detect.Need to be fixed when I am free.Or anyone can make a pull request. This is a vibe-coded...

ibmsecurity

IBM Sample Code يحتوي هذا المستودع على كود Python لإدارة أجهزة IBM الأمنية باستخدام واجهات REST API الخاصة بها. يتمتع جهاز ISAM بأكثر كود نضجًا. الكود الخاص بجهاز ISDS قيد التطوير. الكود الخاص بجهاز ISVG جديد تمامًا تم اختباره مع الإصدار 10.0.1.0 وما فوق فقط. المتطلبات يتطلب هذا الحزمة Python...

sslnuke

sslnuke -- SSL without verification isn't secure! We have all heard over and over that SSL without verification is not secure. If an SSL connection is not verified with a cached certificate, it can easily be hijacked by any attacker. So in 2013, one would think we had totally done away with this...

universal-flutter-ssl-pinning

universal-flutter-ssl-pinning Reverse-engineers libflutter.so with PyGhidra to locate the SSL certificate verification function, then emits ready-to-use bypass scripts for both Frida and Renef. How it works 1. PyGhidra loads libflutter.so headlessly and scans all defined strings for sslclient 2...

nogotofail

nogotofail Nogotofail एक नेटवर्क सुरक्षा परीक्षण उपकरण है जिसे डेवलपर्स और सुरक्षा शोधकर्ताओं को उपकरणों और अनुप्रयोगों पर कमजोर TLS/SSL कनेक्शन और संवेदनशील क्लियरटेक्स्ट ट्रैफ़िक को पहचानने और ठीक करने में मदद करने के लिए डिज़ाइन किया गया है, एक लचीले, स्केलेबल, शक्तिशाली तरीके से। इसमें सामान्...

p5-ssl-tools

مجموعة أدوات SSL يحتوي هذا المستودع على أدوات متنوعة، تهدف إلى تصحيح الأخطاء أو تحليل المشاكل المتعلقة بـ SSL/TLS. تحليل حالة TLS analyze-ssl.pl التحقق من دعم إصدارات SSL/TLS المختلفة التحقق من الخوارزميات ciphers المدعومة التحقق من الشهادة التحقق من حالة OCSP التحقق مما إذا كان SNI مدعومًا و/أو...

CVE-2026-84736

Eclipse aeriOS (current development version, no official release published) has a vulnerability in its Federator component where TLS certificate validation is disabled by default for outbound HTTPS connections. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the...

EUVD-2026-70494

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly...

Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass

IKEv1 key exchange contains a broken authentication caused by logic flow weakness in Remote Access and Mobile Access certificate validation, letting unauthenticated remote attackers bypass user authentication and establish VPN connections without valid passwords, exploit requires use of deprecate...

poc-CVE-2026-0073

CVE-2026-0073 PoC تجاوز مصادقة TLS في ADB اللاسلكي يحتوي هذا الدليل على إثبات مفهوم بلغة Python لثغرة CVE-2026-0073. تم إنشاء السكربت باستخدام تقنيات توليد الكود بمساعدة الذكاء الاصطناعي. ملخص CVE-2026-0073 هي مشكلة منطقية في التحقق من شهادات خدمة ADB adbdtlsverifycert في auth.cpp. يعامل الفحص...

CURL-CVE-2026-80230 OpenSSL pinning bypass

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

CVE-2026-55856

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore,...

CVE-2026-54876

A flaw was found in OpenSSL. A malicious TLS Transport Layer Security server can exploit this vulnerability by sending a specially crafted OCSP Online Certificate Status Protocol response during the X.509 certificate chain verification process. This can lead to a memory leak in client application...

CVE-2026-19854

CVE-2026-19854 affects the ClickHouse plugin (Grafana) when it uses the Native protocol (the default) together with PDC or secure SOCKS . The root cause is that the underlying connection library requests TLS but then ignores it, resulting in plaintext communication with ClickHouse. Concretely, us...

CVE-2026-19854 CVE-2026-19854 CVE Record

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

CVE-2026-81034

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

libgit2: libgit2: Network attacker can intercept HTTPS connections via inverted IP SubjectAltName comparison

A flaw was found in libgit2, a C library for Git functionality. An inverted comparison in the OpenSSL backend's certificate verification logic, specifically when handling IP-literal hosts and certificate IP SubjectAltNames, allows a network attacker to intercept HTTPS connections. By presenting a...

Astra Linux – Vulnerability in PostgresSQL 11

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries during the initial establishment of a connection, despite the use of SSL certificate verification and encryption...