CVE-2026-82929

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...

CVE-2026-82929 Use of Shared Cryptographic Key in mH-DEVELOPER

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...

EUVD-2026-88229

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...

CVE-2026-82929

The mH-DEVELOPER smart home module is vulnerable because it uses identical hard-coded SSH host keys across all devices instead of generating unique per-device keys. An attacker capable of extracting these keys from the firmware can deploy a rogue SSH server that clients will trust automatically. ...

CVE-2026-57836-Confluent_Kafka

CVE-2026-57836: Disabled TLS Certificate Verification for HashiCorp Vault KMS in confluent-kafka Severity: High, CVSS 3.1 7.4 Vector v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected: confluent-kafka = 2.8.0, = 2.14.2 Fixed in: 2.15.0 CWE: CWE-295 Improper Certificate Validation...

Linux Distros Unpatched Vulnerability : CVE-2026-93304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client...

CVE-2026-82929: Use of Hard-coded Cryptographic Key

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...

Exploit-Writeups

Esta es una colección de writeups de exploits que he creado: PS3 lv0ldr SPI MITM...

CVE-2025-68721

CVE-2025-68721: Axigen WebAdmin Broken Access Control Vulnerability Summary A flaw in the permission logic allows an administrator account with zero permissions to access the "Security & Filtering" page, specifically the SSL Certificates endpoint. While other restricted sections are correctly...

CVE-2020-25748

CVE-2020-25748 Suggested description A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras firmware versions v342, v339. Someone in the middle can intercept and modify the video data from the camera, which is transmitted in an unencrypted form. One can als...

k8s-cve-2020-8554-mitigations

Prisma Cloud Compute Mitigations for Kubernetes CVE-2020-8554 This repository contains Prisma Cloud Compute Admission rules that mitigate exploitation of CVE-2020-8554, an unpatched Kubernetes vulnerability. To ensure correct usage, please follow the instructions provided in the 'Prisma Cloud...

DEBIAN-CVE-2026-93304

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

CVE-2026-93304

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

CVE-2026-93304

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

EUVD-2026-87909

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

CVE-2026-93304

A (D)TLS 1.2 client is vulnerable to an out-of-order ChangeCipherSpec message being accepted before the ClientKeyExchange is sent. Because the master secret is not yet derived, the client installs read keys from a known deterministic key, allowing a man-in-the-middle attacker to complete the hand...

CVE-2026-93304 (D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

CVE-2026-93304 (D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

Linux Distros Unpatched Vulnerability : CVE-2026-94419

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the...

CVE-2026-100708 Froxlor before 2.3.13 Private Key Disclosure via Certificates API

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...