Flutter-Reverse-Engineering-Labs

مختبرات الهندسة العكسية لتطبيقات Flutter يحتوي هذا المستودع على سلسلة من التحديات التصاعدية المصممة لتقديم الهندسة العكسية لتطبيقات Flutter. نظرًا لعدم وجود العديد من المنشورات أو الدروس التعليمية التي تشرح الهندسة العكسية لـ Flutter بالتفصيل، قررت إنشاء هذا المستودع كطريقة عملية لسد هذه الفجوة...

CVE-2026-79390

Trueview TI8161 version 6.0.23.4 is susceptible to information disclosure because it transmits MQTT communications in plaintext over TCP port 1883 . An unauthenticated attacker on the same network segment can intercept this traffic to obtain device identifiers, message metadata, and control-relat...

CVE-2026-25961-SumatraPDF-3.5.0---3.5.2-RCE

PoC de mise à jour non sécurisée de SumatraPDF CVE-2026-25961 – Exécution de code à distance via un serveur de mise à jour malveillant Auteur : Mohammed Idrees Banyamer Date : Février 2026 CVE : CVE-2026-25961 GHSA : GHSA-xpm2-rr5m-x96q CVSS v3.1 : 7.5 Élevé AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H...

CVE-2026-22011-iOS-MDM-Profile-Delivery-over-HTTP

CVE-2026-22011 – Доставка MDM-профиля iOS по HTTP Программный код Python Flask MDM-сервер root@kitploit: mdmserver.py - Serves enrollment profile over plain HTTP from flask import Flask, sendfile app = Flaskname @app.route'/enroll.mobileconfig' def serveprofile: Vulnerability: profile delivered...

CVE-2026-19683

CVE-2026-19683 affects TP-Link Omada Gateways: DDNS credentials are sent over an unencrypted channel, exposing them to network observers who could steal credentials or tamper with DNS records. Exploitation requires DDNS to be configured and an attacker on the path. No patch or exploit details are...

CVE-2026-76362

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer REST server could access or modify all relevant data exchanged through that credential manager. The vulnerability is...

CVE-2026-76244

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation...

CVE-2026-76242 stigmem Federation Peer Registration Authentication Bypass

stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can...

EUVD-2026-60484

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1. An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic...

CVE-2026-65329

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1. An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic...

CVE-2026-65329

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1. An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic...

PT-2026-76846

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1. An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic...

CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

PT-2026-70232

Name of the Vulnerable Software and Affected Versions NETGEAR Nighthawk affected versions not specified Description A command injection flaw allows a network-adjacent attacker who can intercept and modify local network traffic attacker-in-the-middle to compromise the confidentiality and integrity...

CVE-2026-43779

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to intercept network connections intended for another process...

CVE-2026-43779

CVE-2026-43779 is a logic issue in macOS components that could allow an app to intercept network connections intended for another process. Publicly documented fixes target macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6, indicating improved restrictions to prevent cross-process ne...

EUVD-2026-49487

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to intercept network connections intended for another process...

CVE-2026-43779

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to intercept network connections intended for another process...

PT-2026-65183

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 Description A logic issue exists where an application may be able to intercept network connections intended for another process...

CVE-2026-54342

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend ePA Aktensystem, Konnektor, IDP, TSS can present a self-signed TLS certificate and intercept the connection. For non-VAU connections Konnektor, IDP, this allows direct read and modification of...