Effective Interventions against AI-Enhanced Scams

In 2025, scams were responsible for an estimated $442 billion in direct losses globally. In the United States, reported losses increased by nearly 400% between 2020 and 2025. Though AI in scamming is a relatively new phenomenon, its use significantly changes the economics of scams as well as the...

Alibaba Cloud Linux 3 : 0274: pam (ALINUX3-SA-2026:0274)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0274 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-54411: Linux-PAM through 1.7.2 contains an...

MAL-2026-15820 Malicious code in @systemzero/baileys (npm)

@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...

EUVD-2026-69205

Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the csbroker component...

CVE-2026-51750

Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the csbroker component...

CVE-2026-51750

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the updatePriChannel function, accessible via the cs_broker MQTT component. An unauthenticated network attacker can send a crafted MQTT message to rescan and switch the primary mesh channel , disrupting wire...

CVE-2026-30252

creationtimestamp| type| source ---|---|--- 2026-08-31 23:00:03+00:00| seen| https://t.me/GithubRedTeam/100549 2026-09-01 00:00:08+00:00| seen| https://t.me/GithubRedTeam/100549 2026-09-02 01:00:07+00:00| seen| Telegram/TO6gwaKR29w8zbOIagSxqu6m5rAsecMdMSmaIK0PnLLamc 2026-09-03 00:00:57+00:00|...

CVE-2026-30251

creationtimestamp| type| source ---|---|--- 2026-08-31 23:00:03+00:00| seen| https://t.me/GithubRedTeam/100550 2026-09-01 00:00:08+00:00| seen| https://t.me/GithubRedTeam/100550 2026-09-02 01:00:07+00:00| seen| Telegram/TO6gwaKR29w8zbOIagSxqu6m5rAsecMdMSmaIK0PnLLamc 2026-09-03 00:00:57+00:00|...

tfc — Updated!

Tinfoil Chat Tinfoil Chat TFC is a FOSS+FHD peer-to-peer messaging system that relies on high assurance hardware architecture to protect users from passive collection, MITM attacks and most importantly, remote key exfiltration. TFC is designed for people with one of the most complex threat models...

SPOILER

SPOILER: los peligros de la carga especulativa potencian los ataques Rowhammer y de caché CVE-2019-0162 INTEL-SA-00238 https://www.usenix.org/system/files/sec19-islam.pdf root@kitploit: @inproceedings 236252, author = Saad Islam and Ahmad Moghimi and Ida Bruhns and Moritz Krebbel and Berk...

cve-2025-32433

Build root@kitploit: » git clone https://github.com/0xPThree/cve-2025-32433.git && cd cve-2025-32433 » docker build -t erlang-ssh . » docker run -d --name erlang-ssh -p 2222:2222 erlang-ssh POC root@kitploit: kdev :: /erlang/CVE-2025-32433 ‹main› » python3 cve-2025-32433.py -h usage:...

iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

kr00k

kr00k CVE-2019-15126 kr00k 漏洞的概念验证（PoC） 安装 root@kitploit: apt-get install aircrack-ng pip install -r requirements.txt 免责声明 用法 usage: kr00k.py -h -i INTERFACE -t VICTIM -v VERBOSE -c CHANNEL -w WRITETO -r READ --bssid BSSID root@kitploit: optional arguments: -i INTERFACE, --interface INTERFACE -t...

CVE-2019-5489

CVE 2019-5489 Este repositorio contiene una prueba de concepto de los Ataques de Canal Lateral de Page Cache CVE-2019-5489 para Linux. Para evaluar el canal lateral de page cache, he implementado un canal encubierto entre dos procesos. El proceso emisor envía datos confidenciales a un proceso...

CVE-2026-80696

A flaw was found in the Linux kernel's hwmon ltc4282 driver. This vulnerability occurs due to an out-of-bounds read when processing the minimum alarm voltage for the VGPIO channel, caused by a missing return statement. A local attacker could potentially exploit this to cause a denial of service o...

FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling

A flaw was found in FreeRDP. A remote attacker, by sending a specially crafted Remote Desktop Protocol RDP packet, could trigger a heap buffer overflow in the server-side RAIL channel handler. This vulnerability, caused by an integer underflow, allows the attacker to corrupt memory and crash the...

CVE-2026-80654

A flaw was found in the Linux kernel. An incorrect condition check during the cleanup of a mailbox receive channel in the soc: xilinx component allows the channel to remain active and receive messages even after the device has been removed. This oversight leads to a use-after-free vulnerability,...

CVE-2026-7070-RDP-Clipboard-Hijacking-via-Virtual-Channel-Injection

CVE-2026-7070 – Secuestro del portapapeles de RDP mediante inyección de canal virtual Código del programa Python – portapapeles de RDP simulado root@kitploit: rdpserversim.py - Simulated RDP server with trusted virtual channel from http.server import HTTPServer, BaseHTTPRequestHandler import json...

BlueKeep

Bluekeep 概念验证 此仓库包含关于CVE-2019-0708的研究。 Bluekeep 或 CVE-2019-0708 是一个 RCE 漏洞，影响以下版本的 Windows 系统： Windows 2003 Windows XP Windows Vista Windows 7 Windows Server 2008 Windows Server 2008 R2 该漏洞发生在预认证阶段，有可能在 NT Authority\system 用户安全上下文中执行任意恶意代码。 工作原理 通过发送特制数据包，攻击者能够将 Channel ID 的值设置为 RDP...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – Canal lateral de temporización del KEM post-cuántico desencapsulación de Kyber Resumen Una implementación vulnerable de la desencapsulación del KEM Kyber filtra bits de la clave secreta a través de diferencias de temporización en el paso de rechazo del texto cifrado, lo que...