Starkiller

Starkiller Starkiller is a Frontend for Powershell Empire. It is a web application written in VueJS. If you'd like to contribute please follow the Contribution guide. If you'd like to request a feature or report a bug, please follow the Issue template. Getting Started As of Empire 5.0 and...

bc-check

bc-check 离线排查你的 Java 应用受 Bouncy Castle 2026 年这批 CVE 的哪几条影响。 零依赖、单个 jar、不联网、不上传任何数据。 java -jar bc-check.jar ./app.jar java -jar bc-check.jar --gav bcprov-lts8on:2.73.5 --detail 为什么需要一个工具（而不是看一眼版本号） 官方所有 CVE 描述统一写的是一句话： Bouncy Castle for Java before 1.85 但真正在用的人里，有两条产品线的版本号根本不长这样： 产品线| artifact 形如|...

EUVD-2026-108987

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mailmessages/add/mailContentId.json endpoint accepts submissions without enforcing the form's authcaptcha setting. BcMail\Controller\Api\MailMessagesController::a...

CVE-2026-115480

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mailmessages/add/mailContentId.json endpoint accepts submissions without enforcing the form's authcaptcha setting. BcMail\Controller\Api\MailMessagesController::a...

CVE-2026-115480 baserCMS: Public Web API mail-form submission bypasses image CAPTCHA

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mailmessages/add/mailContentId.json endpoint accepts submissions without enforcing the form's authcaptcha setting. BcMail\Controller\Api\MailMessagesController::a...

PT-2026-122105

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail messages/add/mailContentId.json endpoint accepts submissions without enforcing the form's auth captcha setting. BcMailControllerApiMailMessagesController::ad...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1690 more potentially affected by unknown CVE via pyjwt (>=2.0.0a2, <=2.13.0)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-PYJWT-21431293...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Bouncy Castle

Summary IBM App Connect Enterprise Toolkit and Runtime are vulnerable to multiple vulnerabilities due to Bouncy Castle. Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on al...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tipc: The process of creating a BC link has been moved back to tipcnodecreate. Shuang Li reported a NULL pointer dereference crash: - Bug: NULL pointer dereference in the kernel; address: 0000000000000068 - RIP: 0010:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8mblk-ctrl: fix out-of-range access of bc-domains Fix out-of-range access of bc-domains in imx8mblkctrlremove...

ROOT-APP-MAVEN-CVE-2024-29857 CVE-2024-29857 in org.bouncycastle:bcprov-jdk18on - Patched by Root

Root has patched CVE-2024-29857 in the org.bouncycastle:bcprov-jdk18on package for Root:Maven. Multiple fixed versions available...

bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...

bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The GOSTCTR implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the G3413CTRBlockCiphe...

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The GOSTCTR implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the G3413CTRBlockCiphe...

bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1593 more potentially affected by CVE-2026-102275 via pyjwt (>=2.1.0, <=2.14.0)

pyjwt PYPI version =2.1.0, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.5.2, =1.5.6 and more Source cves: CVE-2026-102275 Source advisory: OSV:GHSA-X33G-CR3X-6449...