Astra Linux – Vulnerability in Thunderbird, Firefox

When importing an SPKI RSA public key as an ECDSA P-256 key, the key is handled incorrectly, causing the tab to crash. This vulnerability affects Firefox 110, Thunderbird 102.8, and Firefox ESR 102.8...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix use after free for wext The key information in wext.connect is not reset upon reconnection, and this can retain data from a previous connection. Resetting the key data prevents drivers or mac80211 from...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the X.Org X server’s validation of XKB key type requests. A local attacker could send a specially crafted request to the X server, leading to a vulnerability where out-of-bounds memory access could occur. This could result in the disclosure of sensitive information or cau...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: smb: Client – Reject descriptions of cifs.spnego in user space Descriptions of cifs.spnego keys contain fields that carry authority information, such as pid, uid, creduid, and upcalltarget. The cifs.upcall function treats these...

duckLogger

DuckLogger DuckLogger è un Key Logger USB basato su ESP32-S3. Registra le sequenze di tasti in un file di testo e fornisce accesso wireless per scaricare i log tramite un punto di accesso Wi-Fi integrato. Ricreare questo progetto non richiede alcun PCB personalizzato. L'hardware utilizzato costa ...

recipe-blog-encoding

recipe-blog-encoding !WARNING Questo progetto è interamente vibe-coded probabilmente parzialmente plagiato da questo repository e l'autore è un dumb-dumb che ha solo pensato che l'idea fosse divertente Usa i preamboli di ricette SEO-gaming come veicolo per codificare messaggi segreti il prompt pu...

BIT-VALKEY-2026-56684 Valkey: TLS pending-data processing use-after-free may allow remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendinglist while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a...

FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow

A heap-based buffer overflow in FreeRDP's cryptorsacommon allows an unauthenticated remote attacker to trigger a denial of service or potential remote code execution. By sending a crafted ciphertext during RDP Standard Security key establishment, the attacker can force a data write before the siz...

ssh_Enum_vaild

sshEnumvaild Ein Bash-Skript zur Aufzählung gültiger SSH-Benutzernamen unter Verwendung der CVE-2018-15473-Schwachstelle. Es überprüft gültige Benutzernamen auf einem OpenSSH-Server durch Analyse der Authentifizierungsantworten. Funktionen ✅ Erkennt gültige SSH-Benutzernamen basierend auf dem...

CVE-2026-9999-Serverless-Event-Injection-to-Code-Overwrite

3. CVE-2026-9999 – Event-Injection in Serverless-Funktionen Path Traversal → Code-Überschreibung Überblick Eine Serverless-Plattform, die Objektspeicher-Events verarbeitet, bereinigt das Feld object.key nicht, sodass ein Angreifer den Quellcode der Funktion per Path Traversal überschreiben kann...

sh4d0wup

sh4d0wup root@kitploit: % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Start a malicious update server front Bind a http/https server but forward everything unmodified infect High level tampering, inject additional commands into a package tamper Low...

cip-security-poc

cip-security-poc — dimostrare il principio della correzione dietro CVE-2021-22681 non solo la sua vulnerabilità Quattro script eseguibili. Traffico reale del protocollo EtherNet/IP, crittografia reale, zero software Rockwell o licenze in qualsiasi punto della catena. Realizzati per verificare...

Pribado

🔐 Pribado Gestione privata delle chiavi API e infrastruttura Zero-Knowledge Pribado è una piattaforma auto-ospitabile e zero-knowledge per la gestione di chiavi API, segreti crittografati e comunicazioni private. Realizzata su Oasis Sapphire per il calcolo confidenziale supportato da hardware. ✨...

mfoc

MFOC è un'implementazione open source dell'attacco "offline nested" di Nethemba. Questo programma consente di recuperare le chiavi di autenticazione dalle carte MIFARE Classic. Si prega di notare che MFOC è in grado di recuperare le chiavi dal target solo se dispone di una chiave nota: quella...

mfcuk

README Compilazione: autoreconf -is ./configure make Esecuzione la più basilare: ./mfcuk -C -R 0:A -v 2 PACCHETTO MiFare Classic Universal toolKit MFCUK STRUMENTOI Mifare Classic DarkSide Key Recovery Tool mfcukkeyrecoverydarkside.c precedentemente noto come zvmfdarkside ... LICENZA GPL. Vedere...

alaniz-cipher

Die Alaniz-Chiffre v3 Garbenbasierte Post-Quanten-Verschlüsselung durch vektorwertige endliche Körperpermutationen Ein kryptografisches Primitiv, das auf dem Inversionsproblem für nichtlineare Garbenmorphismen NL-SMIP basiert: ein Polynomsystem mit geheimen Koeffizienten, gekoppelt durch...

CVE-2026-78203

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then...

CVE-2026-78203 Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then...

PT-2026-80856

Name of the Vulnerable Software and Affected Versions nektos/act versions 0.2.81 through 0.2.89 Description The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact',...

CVE-2026-59335 - UAA case insensitive check bypass | Cloud Foundry

Severity CVSSv4.0 – 7.7 — CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSSv3.1 – 8.3 — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N Vendor CloudFoundry Foundation Versions Affected Severity is High unless otherwise noted. UAA All versions prior to v78.16.0 CF Deployment All...