Quantum-Safe-Migration

🌌 Quantum-Safe Migration QSM A Post-Quantum Cryptography Migration Toolkit for Nginx and OpenSSH. 🛠️ Overview QSM is an open-source toolkit that audits legacy cryptographic configurations and migrates them to hybrid post-quantum cryptography PQC. It targets the "Harvest Now, Decrypt Later" HNDL...

zend-crypt

zend-crypt Repository abandoned 2019-12-31 This repository has moved to laminas/laminas-crypt. Zend\Crypt provides support of some cryptographic tools. Some of the available features are: encrypt-then-authenticate using symmetric ciphers the authentication step is provided using HMAC;...

CVE-2026-78938

CVE-2026-78938 — V8 TurboFan CheckMaps instance-migration type confusion Root-cause analysis and exploit for CVE-2026-78938, a type confusion in V8's TurboFan load elimination that was fixed in Chrome 152.0.7977.64 V8 15.2.124.18. The bug was reported as exploited in the wild. The exploit turns t...

ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

CVE-2022-2546

All-in-One WP Migration Affected versions All-in-One WP Migration 7.63 References Sucuri WPScan Hacking Force Cross-Site Scripting XSS Classification...

CVE-2025-5961

CVE-2025-5961 Migration, Backup, Staging – WPvivid Backup & Migration 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft...

Security Bulletin: Nomad allocation data migration may allow host directory permission modification via symlink following

Summary HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host file...

advisories

This is deprecated. All advisories can be found on https://www.rcesecurity.com/advisories/...

K000164068: Linux kernel CVE-2026-98432

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period tcpv4synrecvsock transfers ownership of ireq-ireqopt to the child socket newinet-inetopt without copying it. Another cpu can concurrently...

CVE-2026-115377

A flaw was found in Incus. An attacker controlling a malicious migration source can exploit an arbitrary file write vulnerability by embedding symbolic links symlinks into transferred storage volumes during migration streams. By directing these links to the underlying host filesystem, the attacke...

CVE-2026-119168

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files,...

Depixelization_poc

Depix Migrated to https://codeberg.org/spipm/Depixelizationpoc/...

CVE-2026-111068 DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute

The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access...

Exploit for Improper Encoding or Escaping of Output in Gitea

Gitea CVE-2022-30781 RCE Proof of Concept ███████╗███████╗███...

PT-2026-127875

The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access...

fsop-finder

Glibc FSOP code path finder Find FSOP code path that can hijack control flow and stack pointer in GLIBC Libio. Description: 1. Install this plugin 2. Open libc.so.6 in Binary ninja, then click Tools - Plugins - Find FSOP code path 3. You should see the result in Log windows Useful discoveries: //...

Linux Distros Unpatched Vulnerability : CVE-2026-115370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pu...

Linux Distros Unpatched Vulnerability : CVE-2026-115377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write...

WordPress Prime Mover – Backup and Migration plugin <= 2.2.1 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Civitasmass in WordPress Plugin Migrate WordPress Website & Backups – Prime Mover versions = 2.2.1...

UBUNTU-CVE-2026-115370

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an...