EUVD-2026-92310

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17...

TID-The-Instant-Destroyer

TID — El Destructor Instantáneo Investigación de seguridad independiente en el campo de la protección contra ataques de canal lateral basados en caché. Resumen TID es un protocolo especializado diseñado para eliminar los restos de datos sensibles como claves criptográficas de las capas de caché d...

NoFrak

NoFrak NoFrak es una implementación de Prueba de Concepto para Android diseñada para prevenir los ataques de fracking descritos en "Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks", por Martin Georgiev, Suman Jana y Vitaly Shmatikov. NDSS 2014. Cordova...

enhanced-iframe-protection

Protección Mejorada de iFrame - Extensión de Navegador La Protección Mejorada de iFrame EIP es una extensión ligera que detecta automáticamente y proporciona advertencias detalladas para elementos iframe incrustados, con el fin de proteger contra ataques de Navegador-Dentro-Del-Navegador BITB...

Towards a Unified Misuse Monitoring Benchmark

LLM agents increasingly act in multi-actor environments, exposing them to misuse from multiple sources: decomposition attacks, where a harmful request is split into innocuous sub-requests, and prompt injection attacks, where a compromised tool delivers a malicious instruction. Existing evaluation...

PerSpectron: Detecting Invariant Footprints of Microarchitectural Attacks with Perceptron

Detecting microarchitectural attacks is critical given their proliferation in recent years. Many of these attacks exhibit intrinsic behaviors essential to the nature of their operation, such as creating contention or misspeculation. This study systematically investigates the microarchitectural...

PT-2026-104785

Name of the Vulnerable Software and Affected Versions VillaTheme CURCY woo-multi-currency versions prior to 2.2.18 Description An incorrect calculation issue allows integer attacks, which occur when an application fails to properly handle integer overflows or underflows, potentially leading to...

Safeguarding LLMs Via Model-Agnostic Latent Safety Signals from Dark Knowledge

LLMs have advanced rapidly, raising growing concerns about their safety. Recent work has proposed approaches to detect and defend against attacks including defenses at decoding stage that leverage models' hidden states. However, existing decoding-stage defenses suffer from two limitations. First,...

Adaptive Model Inversion Attacks Generalize a Privacy-Robustness Tradeoff

In this paper, we show that standard evaluations of high-resolution Model Inversion Attacks MIAs significantly underestimate training-data privacy leakage. State-of-the-art privacy defenses, standard training techniques such as MixUp and Adversarial Training, and undefended models all leak traini...

CVE-2026-97071: Incorrect Calculation

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17...

Online AutoML: Evaluating Poisoning Attacks on Adversarial Training Defense Strategy in IoT Networks

Machine learning ML-powered poisoning attack vectors are adversarial maneuvers whereby an attacker intentionally inserts, corrupts, or alters training data to distort an ML model's learning process. The objective is to diminish model efficacy, instill biases, induce misclassifications, or include...

Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII

The robustness of Personally Identifiable Information PII protection in Large Language Models LLMs is a critical concern, yet the risks associated with cross-lingual data extraction remain under-explored. This study evaluates the vulnerability of English-centric and multilingual models to Trainin...

edrEvasionWorkshop

edrEvasionWorkshop Materiales del taller para “Desarrollo de malware paso a paso: Evadiendo EDR desde loaders hasta el kernel” , presentado en DEF CON 34 y BSidesLV 2026. Este taller explora el desarrollo de malware personalizado, la arquitectura y evasión de EDR, la personalización de C2 y...

CLSIDFinder

CLSIDFinder Invoke-CLSIDFinder 从 Windows 注册表中枚举 CLSID 和 AppID 条目，以识别通过 LocalService 值与 Windows 服务关联的 COM 对象。 该函数关联这些条目，将结果导出到 CSV 文件，并在相关服务运行时尝试 COM 激活。它主要用于帮助在中继攻击和其他 LPE 场景中识别可用的 CLSID。 使用方法 PS C:\Users\Administrator\Desktop Import-Module .\CLSIDFinder.ps1 PS C:\Users\Administrator\Desktop...

sshamble

sshamble SSHamble es una herramienta de investigación para implementaciones de SSH que incluye: Ataques interesantes contra la autenticación Ataques de autenticación posteriores a la sesión Transiciones de estado previas a la autenticación Análisis de tiempos de autenticación Enumeración posterio...

OSCP Notes and Custom Dashboard

OSCP Field Notebook Tags: ligolo hashcat Port-indexed pentest methodology notebook: decision trees, copy-paste command patterns, and lessons from authorized practice boxes HTB / PG / personal labs. Merged from the older finalnotes-vault into this single tree. A workflow you can run under time...

Reflections and Fragments: Securing LLMs against Sequential Mosaic Attacks

Self-play red-teaming improves language-model safety by pitting attacker and defender roles against each other in a zero-sum game. However, real adversaries increasingly use mosaic attacks: multi-turn sequences whose individual fragments are innocuous in isolation yet assemble into a harmful...

Spectre-PoC

Spectre-PoC No es mío. Recopilado de un libro. Spectre Attacks: Exploiting Speculative Execution...

Windows-RCE-exploits

Mi otro repositorio de GitHub para pruebas de proveedores contra ataques sin archivos - https://github.com/smgorelik/VendorSimTestScripts Windows-RCE-exploits La base de datos de muestras de exploits es un repositorio de exploits de RCE ejecución remota de código y Pruebas de Concepto para WINDOW...

poseidon

██████╗ ██████╗ ███████╗███████╗██╗██████╗ ██████╗ ███╗ ██╗ ██╔══██╗██╔═══██╗██╔════╝██╔════╝██║██╔══██╗██╔═══██╗████╗ ██║ ██████╔╝██║ ██║███████╗█████╗ ██║██║ ██║██║ ██║██╔██╗ ██║ ██╔═══╝ ██║ ██║╚════██║██╔══╝ ██║██║ ██║██║ ██║██║╚██╗██║ ██║ ╚██████╔╝███████║███████╗██║██████╔╝╚██████╔╝██║ ╚████...