wholeaked

Introducción , ,' ', Utku Sen's |,-' wholeaked /c '\ ' |' -. "When you have eliminated the impossible, /-' \ whatever remains, however improbable, /'-'\ must be the truth" - Sherlock Holmes ' \ wholeaked es una herramienta para compartir archivos que permite encontrar a la persona responsable en...

CVE-2026-108698

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in loadwasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the tag can serve an unsigned malicious...

CVE-2026-108699

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...

CVE-2026-108699

The hyper-mcp framework (versions through 0.8.3 ) is vulnerable to an improper signature verification flaw involving OCI WebAssembly plugins. The root cause is that the cosign_verify_args() function accepts any signer identity and OIDC issuer by default. This allows an attacker who controls a plu...

CVE-2026-108699 hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...

CVE-2026-108699 hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...

EUVD-2026-96999

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...

CVE-2026-108698 hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in loadwasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the tag can serve an unsigned malicious...

CVE-2026-108698 hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in loadwasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the tag can serve an unsigned malicious...

EUVD-2026-96998

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in loadwasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the tag can serve an unsigned malicious...

CVE-2026-108698

The hyper-mcp software (versions through 0.8.3 ) contains a TOCTOU (Time-of-Check Time-of-Use) Race Condition vulnerability within the load_wasm function in src/wasm/oci.rs. The root cause is that the system verifies the Cosign signature of a separately resolved tag instead of the actual loaded m...

jwt-key-id-injector

Inyector de ID de Clave JWT Script simple de Python para verificar una vulnerabilidad hipotética de JWT. Supongamos que hay una aplicación que utiliza tokens JWT firmados con el algoritmo HS256. Un token de ejemplo se ve así:...

CVE-2026-108699: Improper Verification of Cryptographic Signature

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...

PT-2026-110167

🚨 CVE-2026-108699 hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign verify args accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sig...

PT-2026-110166

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the tag can serve an unsigned malicious...

CVE-2026-108698: Time-of-check Time-of-use (TOCTOU) Race Condition

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in loadwasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the tag can serve an unsigned malicious...

dynmx

dynmx Prototipo dynmx pronunciato dinamiche è un approccio di rilevamento basato su firme per caratteristiche comportamentali di malware basate su sequenze di chiamate API di Windows. In modo semplificato, puoi pensare a dynmx come una sorta di YARA per tracce di chiamate API i cosiddetti functio...

CVE-2026-97468

A flaw was found in Apache CXF. The Security Token Service STS and token validation components cache validated security tokens using a weak, non-cryptographic hash function and treat cache matches as proof of validity. A remote attacker can craft a security token that generates a hash collision...

CVE-2026-107805

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...

CVE-2026-107805

The Nginx UI web user interface is vulnerable to a resource exhaustion flaw in versions 2.5.0 through 2.6.0 . The root cause lies in the node-signature authentication path , which stages an attacker-controlled request body into a temporary file and synchronizes it before validating the cryptograp...