CVE-2021-38666-poc

CVE-2021-38666-poc You need to verify your identity and get approval...

dot

il Deepfake Offensive Toolkit dot aka Deepfake Offensive Toolkit produce deepfake in tempo reale e controllabili, pronti per l'iniezione in telecamere virtuali. dot è stato creato per eseguire penetration testing contro, ad esempio, sistemi di verifica dell'identità e videoconferenza, per uso da...

The Hitchhikers Guide to Online Anonymity

La guida completa per l'anonimato online e l'OpSec. Benvenuti. Questa è una guida che mira a fornire un'introduzione a varie tecniche di tracciamento online, tecniche di verifica dell'identità online e una guida dettagliata per creare e mantenere identità online veramente anonime. È scritta con l...

SecureCivic

SecureCivic SecureCivic ist eine von Bürgern entwickelte Open-Source-Identitätsverifikationsplattform, die es der Social Security Administration SSA ermöglichen soll, ein modernes, datenschutzorientiertes Verifikationssystem zu übernehmen. Es beseitigt die Abhängigkeit von privaten Datenbrokern u...

openwifipass

OpenWifiPass Uma implementação de código aberto do papel de concedente no protocolo de Compartilhamento de Senha Wi-Fi da Apple. Aviso Legal O OpenWifiPass é um software experimental e é o resultado de esforços de engenharia reversa do projeto Open Wireless Link. O código serve exclusivamente a...

CVE-2020-25769

GOG Galaxy स्थानीय विशेषाधिकार वृद्धि - CVE-2020-25769 GOG Galaxy 2.0, CD Project द्वारा विकसित एक प्लेटफॉर्म है जिसे स्टोरफ्रंट, सॉफ्टवेयर वितरण, सोशल नेटवर्क और एकीकृत गेम लॉन्चर के रूप में डिज़ाइन किया गया है। विंडोज के तहत क्लाइंट विशेषाधिकार प्राप्त कार्यों को संभालने के लिए...

CVE-2026-59564

An authentication bypass vulnerability exists in the communications between affected versions of the Zscaler Client Connector (ZCC) and the Zscaler Client Connector Portal . The CVSS 3.1 score is 9.1 (Critical) , with a network attack vector , low complexity , and no privileges or user interactio...

PT-2026-80866

Name of the Vulnerable Software and Affected Versions Zscaler Client Connector affected versions not specified Description An authentication bypass issue exists in the communications between the Zscaler Client Connector and the Zscaler Client Connector Portal. Authentication bypass occurs when an...

CVE-2026-66402

A flaw was found in FreeRDP. This flaw involves multiple weaknesses in how FreeRDP validates TLS Transport Layer Security certificates. FreeRDP's custom validation logic can incorrectly process DNS Subject Alternative Name SAN values, accept Common Names without proper comparison to other SAN...

CVE-2026-45330

Summary: The vulnerability in Decidim affects the verification admin flow where the pending_authorizations are loaded by raw identifiers without verifying current_organization ownership, allowing a tenant admin to view/approve/reject another tenant’s id_documents. The technical trigger is the use...

CVE-2026-46715

Summary of CVE-2026-46715 (Flask-Security-Too) Affected: Flask-Security-Too up to version 5.8.0. Issue: in the OAuth reauthentication flow, the verification callback can mark a victim’s session as freshly reauthenticated after an OAuth identity belonging to a different user is verified. If an att...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...

PYSEC-2026-2471 Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection

Summary Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletio...

The Verification Step Is the New ATO Battleground in 2026

For years, account takeover ATO followed a predictable script. Attackers bought stolen credentials in bulk, ran them through automated tools, and waited for matches. Credential stuffing was cheap, scalable, and for defenders, relatively well understood. That era is ending. Not because attackers...

PYSEC-2026-1336 Ethyca Fides Cryptographically Weak Generation of One-Time Codes for Identity Verification

Impact The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application. Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or delete/erase it. Consent reque...

PYSEC-2026-842 When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder

When matrix-nio before 0.20 requests a room key from our devices, it correctly accepts key forwards only if they are a response to a previous request. However, it doesn't check that the device that responded matches the device the key was requested from. This allows a malicious homeserver to inse...

PYSEC-2026-326 dcap-qvl has Missing Verification for QE Identity

Impact This vulnerability involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Identity collateral including qeidentity, qeidentitysignature, and qeidentityissuerchain from the PCCS. However, it skips to verify the QE Identity signature...

CVE-2026-54320

CVE-2026-54320 refers to Daytona’s cross-tenant takeover vulnerability prior to version 0.184.0. The issue allowed an unverified email that matched an invitation’s target to accept it (or decline) and join the target organization, since invitation acceptance/declination did not require email veri...

PT-2026-51579

🚨 CVE-2026-54320 Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.184.0, organization invitations could be accepted and declined by a user whose email matched the invitation but had not been verified. Daytona authenticates user...

The FCC Wants to Eliminate Burner Phones

A proposed FCC rule would kill burner phones: phones whose accounts are not attached to a particular person. The FCC plans to do this by legally forcing the country's telecoms to store a wealth of personal information about essentially all phone customers, including a government issued...