xssor2

XSS'OR XSS'OR - Hack with JavaScript. ONLINE You can have a try: https://xssor.io and http://xssor.io/ It contains three major modules: Encode/Decode, Codz, Probe. INSTALL Python 3 with Django 3.0. or Python 2 with Django 1.11. git clone https://github.com/evilcos/xssor2 or download directly cd...

ROOT-APP-NPM-CVE-2026-118664 CVE-2026-118664 in decode-uri-component - Patched by Root

Root has patched CVE-2026-118664 in the decode-uri-component package for Root:npm. Multiple fixed versions available...

jwt-hack

JSON Web Token Hack Toolkit A high-performance toolkit for testing, analyzing and attacking JSON Web Tokens. Installation Cargo cargo install jwt-hack Homebrew brew install jwt-hack Snapcraft Ubuntu sudo snap install jwt-hack Chocolatey Windows choco install jwt-hack From source git clone...

yaralyzer

THE YARALYZER Visually inspect all of the regex matches and their sexier, more cloak and dagger cousins, the YARA matches found in binary data and/or text. See what happens when you force various character encodings upon those matched bytes. With colors. Quick Start pipx install yaralyzer Scan...

flask-session-cookie-manager

Flask Session Cookie Decoder/Encoder Original author : Wilson Sumanang Fixes and improvements author : Alexandre ZANNI Imported from saruberoz.github.io Depencencies Python 2 or Python 3 itsdangerous Flask Installation Package BlackArch Linux pacman -S flask-session-cookie-manager3,2 Git ArchLinu...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

pythem

pythem - Penetration Testing Framework pythem is a multi-purpose pentest framework written in Python. It has been developed to be used by security researchers and security professionals. The tool intended to be used only for acts within the law. I am not liable for any undue and unlawful act...

the-book-of-secret-knowledge

"Knowledge is powerful, be careful how you use it! " A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools, and more. 📔 What is it? This repository is a collection of various materials and tools that I use every day in my work. It contains a lot of useful...

SD JWT JS: Tampered disclosures silently dropped instead of rejected

Summary When one Disclosure in an SD-JWT presentation is tampered so its digest no longer matches the Issuer-signed sd array, @sd-jwt/decode 0.19.0 does not reject the presentation. It silently drops the unmatched Disclosure and returns a reduced claim set, reporting success. The Issuer signature...

EUVD-2026-113215

SD JWT JS: Tampered disclosures silently dropped instead of rejected...

GHSA-F9J6-8P6X-R9J6 SD JWT JS: Tampered disclosures silently dropped instead of rejected

Summary When one Disclosure in an SD-JWT presentation is tampered so its digest no longer matches the Issuer-signed sd array, @sd-jwt/decode 0.19.0 does not reject the presentation. It silently drops the unmatched Disclosure and returns a reduced claim set, reporting success. The Issuer signature...

@2060.io/credo-ts-didcomm-media-sharing (>=0.0.2, <=0.1.0), @2060.io/credo-ts-didcomm-reactions (>=0.0.2, <=0.1.0) +335 more potentially affected by CVE-2026-62374 via @sd-jwt/decode (>=0.1.2-alpha.5, <=0.19.0)

@sd-jwt/decode NPM version =0.1.2-alpha.5, =0.0.2, =0.0.2, =0.0.7, =0.0.12, =0.0.4, =0.0.0-alpha.117, =0.0.0-alpha.117, =0.0.0-alpha.119, =1.2.1-dev.3, =1.2.1-dev.3, =1.2.1-dev.3, =0.0.1-alpha.23, =0.1.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-62374 Source advisory: GHSA-F9J6-8P6X-R9J6...

@2060.io/credo-ts-didcomm-media-sharing (>=0.0.2, <=0.1.0), @2060.io/credo-ts-didcomm-reactions (>=0.0.2, <=0.1.0) +335 more potentially affected by CVE-2026-62374 via @sd-jwt/decode (>=0.1.2-alpha.5, <=0.19.0)

@sd-jwt/decode NPM version =0.1.2-alpha.5, =0.0.2, =0.0.2, =0.0.7, =0.0.12, =0.0.4, =0.0.0-alpha.117, =0.0.0-alpha.117, =0.0.0-alpha.119, =1.2.1-dev.3, =1.2.1-dev.3, =1.2.1-dev.3, =0.0.1-alpha.23, =0.1.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-62374 Source advisory: OSV:GHSA-F9J6-8P6X-R9J6...

PT-2026-135473

libaec through 1.1.7 contains an out-of-bounds read vulnerability in m se decode in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or...

decode-uri-component decoder DoS

The vulnerability in the decodeUriComponent function of the decode-uri-component decoder is related to uncontrolled resource consumption. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

CVE-2026-28956-jxl-messages-surface

JPEG XL auto-decodes in the iOS Messages preview path A delivery-surface finding for CVE-2026-28956 AppleJPEGXL, plus the patch-diff attribution and a reliability reality-check on the public PoC. TL;DR — Conventional wisdom and our own prior measurement with EXR is that iOS Messages renders...

PT-2026-134685

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx decode frame to copy uninitialized av malloc buffer...

PT-2026-134692

imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt fax4 decode size that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4 stream lacking EOFB to ccittfax4 decode or the numcodecs...

PT-2026-134693

imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode jpegsof3. Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stac...

PT-2026-134687

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new palette entries in cdxl decode ham8 or cdxl...