CVE-2026-100891

A vulnerability exists in Trusted Domain Project OpenDMARC up to version 1.4.2 . The issue is located within the Internationalized Domain Name Handler component, specifically in the opendmarc_policy_query_dmarc function of the libopendmarc/opendmarc_policy.c library. An encoding error can be trig...

creak

creak Realiza algunos de los ataques MITM más famosos sobre direcciones objetivo ubicadas en una red local. Entre estos, deniega las capacidades de navegación y descarga de un host objetivo en la red local realizando un ataque de envenenamiento ARP y enviando paquetes TCP reset a cada solicitud...

Bluetooth-Attacks-CVE-2025-27840

This paper discusses how an attacker can introduce a hidden list of vulnerabilities through module updates, which can lead to compromise of ESP32 devices and gaining unauthorized access to private keys, affecting billions of devices using this microcontroller. One of the key issues is the...

BitUnlocker

BitUnlocker Downgrade Attack A proof of concept for accessing BitLocker-encrypted disks in under 5 minutes on fully patched Windows 11 machines through a boot manager downgrade attack, leveraging the SDI vulnerability originally documented as CVE-2025-48804. The July 2025 patch fixes this in...

CVE-2025-24071-PoC

CVE-2025-24071 - Windows File Explorer Spoofing Vulnerability Proof of Concept Overview CVE-2025-24071 is a spoofing vulnerability in Windows File Explorer that allows an unauthenticated attacker to expose sensitive information over a network. The vulnerability arises due to the implicit trust an...

derf

The DeRF DeRF Detection Replay Framework is an "Attacks As A Service" framework, allowing the emulation of offensive techniques and generation of repeatable detection samples from a UI - without the need for End Users to install software, use the CLI or possess credentials in the target...

BlueHound

BlueHound is an open-source tool that helps blue teams pinpoint the security issues that actually matter. By combining information about user permissions, network access and unpatched vulnerabilities, BlueHound reveals the paths attackers would take if they were inside your network It is a fork o...

CVE-2026-100890 Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcspfipv6explode in the library libopendmarc/opendmarcspf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possibl...

EUVD-2026-88054

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcspfipv6explode in the library libopendmarc/opendmarcspf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possibl...

CVE-2026-100890

A null pointer dereference vulnerability exists in the Trusted Domain Project OpenDMARC (up to version 1.4.2 ). The flaw is located in the opendmarc_spf_ipv6_explode function within the SPF Parser component (specifically libopendmarc/opendmarc_spf.c). Manipulation of the cp argument triggers the ...

Microsoft Windows Cloud Files Mini Filter Driver CldiStreamPrepareRequestForMoreProcessing Type Confusion vulnerability

Summary A type confusion vulnerability exists in the CldiStreamPrepareRequestForMoreProcessing functionality of Windows Cloud Files Mini Filter Driver versions: 10.0.26100.8457 WinBuild.160101.0800 and 10.0.26100.8655 WinBuild.160101.0800. A specially crafted sequence of Cloud Filter API calls ca...

bitcracker

BitCracker BitCracker es la primera herramienta de código abierto para descifrar contraseñas de dispositivos de almacenamiento Disco Duro, Pendrive USB, tarjeta SD, etc... cifrados con BitLocker, una función de cifrado disponible en Windows Vista, 7, 8.1 y 10 ediciones Ultimate, Pro y Enterprise...

CVE-2021-30146

CVE-2021-30146 Seafile 7.0.5 Persistent XSS Suggested description: Application Server Version: 7.0.5 Seafile is vulnerable to Persistent XSS via share library functionality. Additional Information: Seafile is an open source, self-hosted file sync and share solution with high performance and...

joombrute

JoomBrute Modern Joomla auth-attack toolkit J3 / J4 / J5 - CVE-2023-23752 · CVE-2023-23755 · CVE-2025-25227 Description Joomla credential-attack toolkit covering CMS versions 3, 4, and 5. Six subcommands handle the full attack chain end-to-end: detect - version fingerprint manifest XML → generato...

XSScope

Go beyond the alert XSScope is one of the most advanced GUI Framework for XSS Clientside attacks. It can perform different XSS attack and HTML Injection in real time. Features Perform XSS botnet attacks. Every victim who is affected by XSS payload in the webserver, will contantly bind the payload...

CVE-2022-21907

CVE-2022-21907 Description - POC for CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability. - create by antx at 2022-01-17. Detail - HTTP Protocol Stack Remote Code Execution Vulnerability. - Similar to https://github.com/antx-code/CVE-2021-31166CVE-2021-31166. - This problem...

aad-bofs

This repository contains a collection of BOFs for various Azure AD attacks. All the bofs have been battle-tested during engagements. Please also feel free to contribute :...

LKWA

LKWA Lesser Known Web Attack Lab is for intermediate pentester that can test and practice lesser known web attacks such as Object Injection, XSSI, PHAR Deserialization, variables variable ..etc. Write-ups are welcome. My own walk-through is here . Installation - Local Just clone the git with git...

CVE-2026-100889 Trusted Domain Project OpenDKIM Decoder util.c dkim_qp_decode off-by-one

A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkimqpdecode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor w...

CVE-2026-100889

A vulnerability exists in Trusted Domain Project OpenDKIM up to version 2.11.0 . The issue is caused by an off-by-one error in the dkim_qp_decode function within the util.c file of the Decoder component. This flaw can be triggered via a remote attack. While the documents confirm that an exploit i...