CVE-2026-97071 WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17...

EUVD-2026-92310

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17...

TID-The-Instant-Destroyer

TID — The Instant Destroyer Independent security research in the field of protection against cache-based side-channel attacks. Overview TID is a specialized protocol designed to eliminate sensitive data remnants such as cryptographic keys from CPU cache layers $L1, L2, \text and L3$ immediately...

NoFrak

NoFrak NoFrak هو تنفيذ لإثبات المفهوم Proof of Concept لنظام Android صُمِّم لمنع هجمات fracking الموصوفة في ورقة "Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks"، بقلم Martin Georgiev وSuman Jana وVitaly Shmatikov. NDSS 2014. Cordova Android Cordova...

enhanced-iframe-protection

Protection iFrame améliorée - Extension de navigateur La Protection iFrame améliorée EIP est une extension légère qui détecte automatiquement les éléments iframe intégrés et fournit des avertissements détaillés afin de protéger contre les attaques Browser-In-The-Browser BITB. Captures d'écran Dan...

Towards a Unified Misuse Monitoring Benchmark

LLM agents increasingly act in multi-actor environments, exposing them to misuse from multiple sources: decomposition attacks, where a harmful request is split into innocuous sub-requests, and prompt injection attacks, where a compromised tool delivers a malicious instruction. Existing evaluation...

PerSpectron: Detecting Invariant Footprints of Microarchitectural Attacks with Perceptron

Detecting microarchitectural attacks is critical given their proliferation in recent years. Many of these attacks exhibit intrinsic behaviors essential to the nature of their operation, such as creating contention or misspeculation. This study systematically investigates the microarchitectural...

Online AutoML: Evaluating Poisoning Attacks on Adversarial Training Defense Strategy in IoT Networks

Machine learning ML-powered poisoning attack vectors are adversarial maneuvers whereby an attacker intentionally inserts, corrupts, or alters training data to distort an ML model's learning process. The objective is to diminish model efficacy, instill biases, induce misclassifications, or include...

PT-2026-104785

Name of the Vulnerable Software and Affected Versions VillaTheme CURCY woo-multi-currency versions prior to 2.2.18 Description An incorrect calculation issue allows integer attacks, which occur when an application fails to properly handle integer overflows or underflows, potentially leading to...

Safeguarding LLMs Via Model-Agnostic Latent Safety Signals from Dark Knowledge

LLMs have advanced rapidly, raising growing concerns about their safety. Recent work has proposed approaches to detect and defend against attacks including defenses at decoding stage that leverage models' hidden states. However, existing decoding-stage defenses suffer from two limitations. First,...

Adaptive Model Inversion Attacks Generalize a Privacy-Robustness Tradeoff

In this paper, we show that standard evaluations of high-resolution Model Inversion Attacks MIAs significantly underestimate training-data privacy leakage. State-of-the-art privacy defenses, standard training techniques such as MixUp and Adversarial Training, and undefended models all leak traini...

Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII

The robustness of Personally Identifiable Information PII protection in Large Language Models LLMs is a critical concern, yet the risks associated with cross-lingual data extraction remain under-explored. This study evaluates the vulnerability of English-centric and multilingual models to Trainin...

CVE-2026-97071: Incorrect Calculation

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17...

edrEvasionWorkshop

edrEvasionWorkshop Matériel d'atelier pour « Développement de logiciels malveillants pas à pas : contourner les EDR des chargeurs au noyau » , présenté à la DEF CON 34 et au BSidesLV 2026. Cet atelier explore le développement de logiciels malveillants personnalisés, l'architecture des EDR et leur...

CLSIDFinder

CLSIDFinder Invoke-CLSIDFinder enumerates CLSID and AppID entries from the Windows registry to identify COM objects associated with Windows services via the LocalService value. The function correlates these entries, exports the results to a CSV file, and attempts COM activation when the related...

sshamble

sshamble SSHamble est un outil de recherche pour les implémentations SSH qui comprend : Des attaques intéressantes contre l'authentification Des attaques d'authentification post-session Des transitions d'état de pré-authentification Une analyse temporelle de l'authentification Une énumération...

OSCP Notes and Custom Dashboard

OSCP Field Notebook Tags: ligolo hashcat Port-indexed pentest methodology notebook: decision trees, copy-paste command patterns, and lessons from authorized practice boxes HTB / PG / personal labs. Merged from the older finalnotes-vault into this single tree. A workflow you can run under time...

Reflections and Fragments: Securing LLMs against Sequential Mosaic Attacks

Self-play red-teaming improves language-model safety by pitting attacker and defender roles against each other in a zero-sum game. However, real adversaries increasingly use mosaic attacks: multi-turn sequences whose individual fragments are innocuous in isolation yet assemble into a harmful...

Spectre-PoC

Spectre-PoC ليس من صنعي. جُمع من كتاب. هجمات Spectre: استغلال التنفيذ التخميني...

Windows-RCE-exploits

Mon autre dépôt GitHub pour les tests de fournisseurs contre les attaques sans fichier - https://github.com/smgorelik/VendorSimTestScripts Windows-RCE-exploits La base de données d'échantillons d'exploits est un référentiel pour les exploits RCE exécution de code à distance et les preuves de...