RockyLinux 10 : python3.12 (RLSA-2026:77020)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:77020 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

AAMVA-PDF417-Vulnerability-Research

PDF417 ID Validation Vulnerability Research Overview This repository contains comprehensive security research documenting critical vulnerabilities in AAMVA-standard PDF417 barcode validation systems affecting government IDs, enterprise solutions, and consumer applications. The research includes a...

log4shell-hotfix-side-effect

Caso de prueba del efecto secundario del hotfix de Log4Shell Quería saber si se genera alguna ClassNotFoundException o excepción inesperada similar cuando se aplica el hotfix de CVE-2021-44228, también conocido como Log4Shell, según lo recomendado aquí. Resultado: parece que no surge ninguna...

CVE-2026-67693

A flaw was found in GnuTLS. The certificate verification process fails to properly reject end-entity digital certificates containing contradictory Key Usage KU and Extended Key Usage EKU extensions, which define the permitted cryptographic operations of a certificate. A remote attacker could...

CVE-2026-107675

A flaw was found in FFmpeg. The libssh-based SFTP SSH File Transfer Protocol handler fails to verify remote host keys when establishing connections. A remote network attacker capable of intercepting network traffic could exploit this flaw to impersonate legitimate SFTP servers, potentially exposi...

CVE-2026-107660

A flaw was found in ffmpeg. When establishing secure connections using the mbedTLS library, hostname verification is omitted for destinations specified directly by an IP address. A remote network attacker can exploit this flaw by presenting a certificate issued by any trusted Certificate Authorit...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

CVE-2026-107723

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...

GHSA-8WPC-H4Q6-8FXV fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...

CVE-2026-107723

The fast-jwt library (versions prior to 6.3.0 ) is vulnerable to a silent claim-validator bypass when a JWT payload is a JSON array . The root cause is located in src/decoder.js, where the system verifies that the payload is an object but fails to reject arrays. Because the claim validator loop l...

CVE-2026-88647

A flaw was found in GnuTLS. This vulnerability can lead to information disclosure by allowing an attacker to bypass certificate hostname verification. A remote attacker presenting a crafted certificate can circumvent the Common Name fallback check, enabling them to eavesdrop on or intercept...

zeroheight-account-verification-bypass-CVE-2025-65925

CVE-2025-65925 — Zeroheight Incorrect Access Control in Account Creation Flow Disclosure Date: 2025-06-11 Vendor fix date per vendor: 2025-06-13 Researcher validation date: 2025-06-26 Discovered by: Sneden Rebello Summary A legacy user creation API pathway allowed accounts to be created without...

ICPin

ICPin An Integrity-Check Monitoring Pintool What A pintool that records the reads and writes to the executable in memory. It also tracks dynamically executed code and handles some antidebug checks it is immune to most antidebug by pintools design and outputs backtraces of watched behavior. How...

anti-anti-automation

Anti-Anti-Automation Framework A framework for techniques to bypass common anti-automation security controls. Common Anti-Automation Controls Email Verification CAPTCHA SMS/Phone Credit Card WASC-21: Insufficient Anti-automation...

CVE-2026-84271

IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges...

CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Flow Bypass Lab Tổng quan Lab mô phỏng lỗ hổng CVE-2026-18963 CVSS 9.1 trong Keycloak, cho phép kẻ tấn công chiếm quyền tài khoản bất kỳ thông qua bypass xác minh email trong luồng đặt lại mật khẩu. Chỉ sử dụng cho mục đích nghiên cứu bảo mật và giáo dụ...

CVE-2026-73309

CVE-2026-73309: Empty OAuth2 credentials bypass XenForo before 2.3.13 can skip OAuth2 client-secret and PKCE verification when an empty string reaches the token endpoint. What happens The endpoint checks whether clientsecret and codeverifier keys exist, then performs the comparisons only when the...

thymeleaf-check

thymeleaf-check ThymeleafCVE-2026-40477 / CVE-2026-41901 offline triage tool — zero dependencies, single jar, no network. Two CVSS 9.0 SSTI bypasses, with two fixed releases shipped within nine days. It first answers "which of these am I affected by," then answers the harder question: On my versi...

CVE-2026-76904

GeoServer WFS Inventory and Authorized Verification This repository contains two Python scripts for investigating GeoServer WFS endpoints. Overview wfsinventory.py Purpose: Inventory layers, XSD fields, and WFS values, and optionally verify candidates via a time-based check. Execution examples:...