rinhit

RinHit RinHit - macOS 生态系统侦察框架。从 Apple 生态系统中收集痕迹，构建网络活动、跨设备身份和物理位置关联的时间线。 这是开源侦察模块。闭源 Swift 载荷（rinhit-agent）由我们的红队内部使用，不属于本仓库。 功能 Wi-Fi 网络侦察 - 解析 com.apple.wifi.known-networks.plist（旧版）或使用 networksetup（macOS 15+ Data Vault） 蓝牙设备 - 来自 com.apple.Bluetooth.plist 的已配对、缓存和已连接设备 USB 设备历史 - 通过 ioreg...

Astra Linux – Vulnerability in Thunderbird

The Matrix JavaScript SDK is the Matrix Client-Server software development kit SDK for JavaScript. Prior to version 19.7.0, an attacker who cooperated with a malicious home server could interfere with the verification process between two users, substituting their own cross-signed user identity wi...

CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

CVE-2026-50575

BetterDesk versions through 2.3.0 fail to invalidate deleted device identities, letting an unauthenticated client replay or spoof a device ID to bypass registration controls. CVSS 7.7 (HIGH) reflects network exposure with no privileges required. Version 3.0.0-alpha patches the issue; no workaroun...

CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

CVE-2026-50575 BetterDesk has a replay behavior vulnerability when devices are deleted

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

PT-2026-77029

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

CVE-2026-21078

Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity...

CVE-2026-21078: Insufficient Verification of Data Authenticity

Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity...

On a General Theoretical Framework for Radio Frequency Fingerprint-Based Authentication

While radio frequency fingerprint RFF-based wireless device authentication has been widely studied across different datasets and scenarios, there still lacks a fundamental theory to explain why and how RFF can serve as a reliable device identity, significantly hindering the practical application ...

Exploit for Insufficiently Protected Credentials in Rockwellautomation Factorytalk_Services_Platform

cip-security-poc — proving the fix principle behind CVE-2021...

super v1.2.2

📡 SPR: Open Source, secure, user friendly and fast wifi routers for your home. Overview Create an adaptive, micro-segmented network for managing WiFi devices, remote VPN access, and wired systems. One Password Per WiFi Device Policy Based / Zero Trust Network Access Per-Device DNS Rules & Ad Bloc...

CVE-2026-38059

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID DID, Terminal Private Key identifier TPK, MAC address, and exact firmwa...

PT-2026-57166

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID DID, Terminal Private Key identifier TPK, MAC address, and exact firmwa...

CVE-2026-13753

Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unauthenticated attacker to access sensitive information through exposed APIs...

EUVD-2026-41895

A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version =TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive...

CVE-2026-13753 Certain HP DeskJet All in One – Potential Information Disclosure

Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unauthenticated attacker to access sensitive information through exposed APIs...

CVE-2026-13753

A missing authorization vulnerability in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version

CVE-2026-13753 Certain HP DeskJet All in One – Potential Information Disclosure

Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unauthenticated attacker to access sensitive information through exposed APIs...

GHSA-QJPC-QF9M-XWMR OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing

Summary In trusted-proxy Control UI mode, OpenClaw accepted a WebSocket client's declared operator scopes before those scopes were bound to a server-approved pairing or trusted-proxy authorization baseline. This issue affects trusted-proxy Control UI deployments. It does not apply to shared-secre...