CVE-2026-29000

CVE-2026-29000 针对 CVE-2026-29000 的概念验证脚本，该漏洞是 pac4j-jwt 库中发现的一个严重身份验证绕过漏洞 免责声明 本概念验证仅用于教育和道德安全测试目的。其开发目的是在 HackTheBox 实验室环境中演示 CVE-2026-29000 的技术根本原因。 未经授权访问计算机系统属于违法行为。本仓库作者不对任何滥用此信息的行为负责，也不对因使用此脚本造成的任何损害负责。请仅在您拥有或已获得明确书面许可测试的系统上使用此工具。别犯傻。 分析 一个公共端点暴露了 RSA 公钥，使我们能够构造带有任意角色的 JWE 包装...

CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 단일 또는 배치 exp 사용 방법 공개 키 생성 python3 exp.py -u ip:port -k idrsa2048.pub -l hosts.txt로 파일 지정 일괄 실행 FOFA title="FortiGate"...

CVE-2026-103059

A flaw in Gitea allows an authentication bypass when the built-in SSH server is enabled (START_SSH_SERVER = true). The root cause is the use of an SQL LIKE comparison for looking up public keys, which is case-insensitive on certain databases like SQLite . An attacker who can construct a case vari...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-0257

CVE-2026-0257: GlobalProtect 인증 우회 개요 이 익스플로잇은 서버의 공개적으로 접근 가능한 TLS 인증서 만 사용하여 인증 쿠키를 위조함으로써 Palo Alto GlobalProtect 게이트웨이/포털에 비인증 VPN 접근 을 달성합니다. 핵심 취약점 작동 원리 GlobalProtect는 클라이언트가 인증할 수 있도록 사전 인증 쿠키portal-userauthcookie를 사용합니다. 치명적인 결함은 다음과 같습니다: Normal Flow: 1. Client authenticates username +...

CVE-2026-29000-PoC

CVE-2026-29000 — pac4j-jwt JwtAuthenticator 인증 우회 PoC CVE-2026-29000 에 대한 개념 증명PoC입니다. 이는 pac4j-jwt의 JwtAuthenticator 구성 요소에서 발생하는 인증 우회 취약점입니다 CVSS 10.0 , 치명적. 이 스크립트는 비밀 키를 전혀 알지 못해도 대상이 RSA 공개 키를 노출하기만 하면, 모든 사용자를 가장하고 모든 역할을 부여받은 토큰을 위조합니다. !WARNING 이 도구는 교육 목적 및 승인된 보안 테스트 전용 으로 제공됩니다. Hack...

Rocky Linux 9 [CIQ] Security Update: openssl / openssl-debuginfo / openssl-debugsource / openssl-devel / etc (crlsa-2026_19218)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619218 advisory. openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key CVE-2026-31790 Tenable has extracted the preceding description block...

AlmaLinux 9.6 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782812169)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782812169 advisory. - Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large...

Rocky Linux 9.6 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782812169)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782812169 advisory. - Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests (ALMALINUX9.2:CLSA-2026:1782810335)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782810335 advisory. - The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or...

Rocky Linux 10.2 [CIQ] Security Update: openssl / openssl-debuginfo / openssl-debugsource / openssl-devel / etc (crlsa-2026_19066)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619066 advisory. openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key CVE-2026-31790 Tenable has extracted the preceding description blo...

Rocky Linux 10.2 [CIQ] Security Update: edk2-aarch64 / edk2-debugsource / edk2-ovmf / edk2-tools / etc Multiple Vulnerabilities (crlsa-2026_39297)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202639297 advisory. openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key CVE-2026-31790 openssl: OpenSSL: Denial of Service due to...

GHSA-R6X4-923Q-G947 PyJWT BOM Bypass

Affected Package - Package: PyJWT pyjwt on PyPI - Repository: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt&source=gmail&ust=1781794518474000&sa=E - Affected version: 2.13.0 - Vulnerability class: Algorithm confusion / patch bypass --- Root Cause PyJWT 2.13.0 introduced a guard i...

CLEANSTART-2026-UP76614 RSA and DSA public key parsers did not enforce size limits on key parameters

Security vulnerability affects the loki package. The RSA and DSA public key parsers did not enforce size limits on key parameters...

CVE-2026-67276: Improper Verification of Cryptographic Signature

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...

pac4j-check v0.2.0

pac4j-check 离线排查 CVE-2026-29000CVSS 10.0—— 包括官方 advisory 没有列出的那些包。 English | 中文 单个 jar,约 24KB,零运行时依赖,Java 8 起可用,完全离线,不外传任何数据。 这个漏洞是什么 org.pac4j:pac4j-jwt 的 JwtAuthenticator 在处理加密 JWTJWE 时未强制校验签名。 攻击者只要拿到服务器的 RSA 公钥公钥本来就是公开的, 就能构造一个 JWE 包裹的 PlainJWT,把 subject 和 role 写成任意值, 以任意用户身份登录,包括管理员 。无需任何凭据。...

Amazon Linux 2023 : swiftlang, swiftlang-lib (ALAS2023-2026-2073)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2073 advisory. When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-31790 DESCRIPTION: Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a...

swift-crypto: swift-crypto: Denial of Service due to double-free during RSA public key initialization

A flaw was found in swift-crypto. When an RSA Rivest-Shamir-Adleman public key is initialized from DER Distinguished Encoding Rules or PEM Privacy-Enhanced Mail formatted bytes, and an error occurs during the decoding process, a double-free vulnerability can be triggered. This issue, occurring wh...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...