paskto

Paskto - Passive Web Scanner Paskto will passively scan the web using the Common Crawl internet index either by downloading the indexes on request or parsing data from your local system. URLs are then processed through Nikto and known URL lists to identify interesting content. Hash signatures are...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4 with [federation] ENABLED = true contains a signature-spoofing flaw in its ActivityPub inbox processing. The HTTP Signature verification in routers/api/v1/activitypub/reqsignature.go validates the request, but inbox handlers then read the acting identity from the att...

hashes

RustCrypto: Hashes Collection of cryptographic hash functions written in pure Rust. All algorithms reside in separate crates and are implemented using traits from digest crate. Usage examples are provided in digest and hash implementation crate docs. Additionally all crates do not require the...

CVE-2017-6640-POC

CVE-2017-6640-POC Prueba de concepto para CVE-2017-6640 como extensión de Burp Cisco Prime Data Center Network Manager DCNM implementa credenciales estáticas. Ver también: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm2 Más específicamente, la interfa...

PoC_CVE-2019-0217

Este repositorio contiene un exploit de prueba de concepto para CVE-2019-0217, junto con un Dockerfile para configurar un servidor web vulnerable a este CVE. Descripción del CVE En Apache HTTP Server 2.4, versiones 2.4.38 y anteriores, una condición de carrera en modauthdigest cuando se ejecuta e...

Linux Distros Unpatched Vulnerability : CVE-2026-89763

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KEYS: trusted: Fix TPM teardown ordering trustedtpmexit drops the TPM chip reference and frees the digest array before unregistering the trusted key type...

CVE-2026-89763

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trustedtpmexit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. keytypelookup holds keytypessem for reading until the key operation...

AZL-100370 CVE-2026-89763 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trustedtpmexit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. keytypelookup holds keytypessem for reading until the key operation...

gstreamer1-plugins-base security update

An update is available for gstreamer1-plugins-base. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs of...

BIT-TOMCAT-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while...

BIT-TOMCAT-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any...

gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate header

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...

CVE-2026-21010-VoIP-SIP-Digest-Authentication-Replay

CVE-2026-21010 – VoIP SIP Digest Authentication Replay Program Code Python SIP sim root@kitploit: sipserversim.py - SIP server that accepts replayed authenticated requests from flask import Flask, request app = Flaskname Simulated nonce storage: doesn't track used nonces usednonces = set...

ctf-party

ctf-party What it is A library to enhance and speed up script/exploit writing for CTF players or security researchers, bug bounty hunters, pentesters but mostly focused on CTF by patching the String class to add a short syntax of usual code patterns. The philosophy is also to keep the library to ...

PT-2026-90479

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted tpm exit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key type lookup holds key types sem for reading until the key operation...

AlmaLinux 10 : gstreamer1-plugins-base (ALSA-2026:66460)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:66460 advisory. gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gstrtspmessageparseauthcredentials when parsing a crafted Digest...

Linux Distros Unpatched Vulnerability : CVE-2026-87962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from...

jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision

A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...

jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision

A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...

CVE-2026-88884

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...