CVE-2025-53694

CVE-2025-53694: Divulgação de Informações na API ItemService com um usuário anônimo restrito, levando à exposição de chaves de cache usando uma abordagem de força bruta A API ItemService, acessível em /sitecore/shell/api/sitecore/ItemService/GetChildren, permite que usuários não autenticados...

bitlocker-bypass-research

Ricerca sul Bypass di BitLocker Progetto personale di ricerca sulla sicurezza — bypass della crittografia integrale del disco di BitLocker tramite CVE-2023-21563 BitPixie. Di cosa si tratta Ad ottobre 2025 ho effettuato una valutazione fisica di recupero su un laptop aziendale con BitLocker attiv...

CVE-2026-4444-JWT-Algorithm-Confusion-via-kid-Injection

CVE-2026-4444 – Confusão de Algoritmo JWT via Injeção de kid Código do Programa servidor Node.js + exploit Python root@kitploit: // jwtserver.js - Vulnerable JWT verification server const express = require'express'; const jwt = require'jsonwebtoken'; const jwksClient = require'jwks-rsa'; const...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – Side-Channel temporale del KEM post-quantistico decapsulazione Kyber Panoramica Un'implementazione vulnerabile della decapsulazione del KEM Kyber perde bit della chiave segreta attraverso differenze di temporizzazione nella fase di rifiuto del ciphertext, consentendo il recuper...

CVE-2023-45184

CVE-2023-45184 IBM i Access Client Solutions 1.1.9.4 - Lokaler Server mit defekter Zugriffskontrolle. Zeitplan Schwachstelle an den Hersteller gemeldet: 22.09.2023 Neue behobene Version 1.1.9.4 veröffentlicht: 08.12.2023 Öffentliche Offenlegung: 15.12.2023 Beschreibung IBM i Access Client Solutio...

CVE-2023-45182

CVE-2023-45182 IBM i Access Client Solutions 1.1.9.4 - Criptazione debole delle password Cronologia Vulnerabilità segnalata al venditore: 22.09.2023 Nuova versione corretta 1.1.9.4 rilasciata: 08.12.2023 Divulgazione pubblica: 15.12.2023 Descrizione IBM i Access Client Solutions per memorizzare l...

JetBrains TeamCity < 2021.2.1 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2021.2.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible. CVE-2022-24330 - In JetBrains TeamCity before 2021.2.1, the Agent...

TencentOS Server 4: opensc (TSSA-2026:0853)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0853 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Wazuh Server 4.3.0 < 4.14.6 Path Traversal (CVE-2026-49441)

The version of Wazuh Server on the remote host is at least 4.3.0 and prior to 4.14.6. It is, therefore, affected by a path traversal vulnerability: - The non-merged branch of processfilesfromworker trusts a peer-controlled filepath key from filesmetadata.json. A cluster peer holding the shared...

OpenSSL -- Multiple vulnerabilities

The OpenSSL poject reports: Heap Buffer Overflow in CMS Key Unwrapping CVE-2026-63072 Moderate Invalid Pointer Dereference in CMP Server via Crafted protectionAlg CVE-2026-63076 Moderate RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate CVE-2026-14457 Low Excessive...

Wazuh Server 4.0.0 < 4.14.5 Incorrect Authorization (CVE-2026-44252)

The version of Wazuh Server on the remote host is at least 4.0.0 and prior to 4.14.5. It is, therefore, affected by an incorrect authorization vulnerability: - A low-privilege read-only API user with manager:read permission can retrieve the cluster key from ossec.conf. An attacker can use the...

CVE-2026-63072

Heap Buffer Overflow in CMS Key Unwrapping...

UBUNTU-CVE-2026-63072

Heap Buffer Overflow in CMS Key Unwrapping...

CVE-2026-59648

A flaw was found in Bouncy Castle for Java. The OpenPGP Argon2 S2K Salted Key Derivation Function implementation allows a remote attacker to influence the amount of memory and passes used during key derivation. This can lead to a denial of service DoS by consuming excessive system resources, maki...

CVE-2026-59640

A flaw was found in Bouncy Castle for Java. A remote attacker can exploit an OpenPGP Open Pretty Good Privacy Cipher Feedback CFB quick-check oracle vulnerability. This oracle, active on symmetric and session-key paths, could allow an attacker to gain sensitive information by observing the result...

GHSA-W67G-5RQW-F597 Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

gorilla/websocket used math/rand cryptographically weak pseudo-random number generator to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with ...

CVE-2025-1234-RSA-Key-Validation-Bypass

CVE-2025-1234-RSA-Key-Validation-Bypass Una falla in una diffusa implementazione RSA permette agli attaccanti di bypassare la validazione delle chiavi fornendo un modulo che sembra valido ma in realtà è fattorizzabile — se lo si può fattorizzare rapidamente. CVE‑2025‑1234 — Exploit di Bypass dell...

about-hmac

Informazioni su HMAC Un esempio di implementazione di base di HMAC Hash-based Message Authentication Code utilizzando Flask in Python. Cos'è HMAC?! Il codice di autenticazione dei messaggi basato su hash HMAC fornisce al server e al client ciascuno una chiave privata nota solo a quel server e a...

CVE-2026-78555

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78553

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...