torchat

TorChat - Anonymer P2P-Chat Sicherer, privater und anonymer Peer-to-Peer-Chat über das Tor-Netzwerk. Was ist TorChat? Es ist ein leichtgewichtiges, datenschutzorientiertes Nachrichtentool, mit dem Sie direkt mit anderen über das Tor-Netzwerk kommunizieren können – ohne zentrale Server. Es wurde f...

java-remote-class-loader

Questo strumento ti permette di inviare bytecode Java sotto forma di file class ai tuoi client o potenziali obiettivi da caricare ed eseguire utilizzando Java ClassLoader insieme all'API Reflect. Il client riceve il file class dal server e restituisce il rispettivo output di esecuzione. I payload...

EUVD-2026-65488

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

CVE-2026-75803

OpenSSL's EVP_Cipher() API, when used as a one-shot decryption call for ChaCha20-Poly1305 and AES-OCB ciphers, skips the AEAD authentication tag verification if the input ciphertext is empty. A successful return value in that case does not guarantee the tag was actually validated, so applications...

java-remote-class-loader

This tool allows you to send Java bytecode in the form of class files to your clients or potential targets to load and execute using Java ClassLoader together with Reflect API. The client receives the class file from the server and return the respective execution output. Payloads must be written ...

Concryptor

Concryptor Eine multi-threaded AEAD-Verschlüsselungs-Engine, entwickelt in Rust. Verschlüsselt und entschlüsselt Dateien mit Gigabyte-pro-Sekunde-Durchsatz mittels einer dreifach gepufferten iouring-Pipeline, paralleler Chunk-Verarbeitung über Rayon und assembleroptimierten Chiffren via ring. ⚠️...

CESS

CESS — Kryptologisch verzaubertes Shamir-Geheimnis Ist das KI-Unsinn oder Schrott? Ein Kryptograf oder ein ernsthafter Implementierer, der CESS prüft, öffnet in der Regel zuerst vectors/ und testdata/, bevor er den Prosa-Teil liest. Die Testsuite ist der Beweis der Arbeit: Sie kodiert...

EphemeralNet

EphemeralNet Ein sicheres P2P-Netzwerk mit benutzerdefiniertem Relay für feindliche NATs, entwickelt in C++20. Programmierbares Vergessen für hochzuverlässige Peer-to-Peer-Speicherung. Warum EphemeralNet? Shardian entwickelt Infrastruktur für Teams, die Löschgarantien ebenso ernst nehmen wie...

CVE-2026-64314 crypto: chacha20poly1305 - validate poly1305 template argument

In the Linux kernel, the following vulnerability has been resolved: crypto: chacha20poly1305 - validate poly1305 template argument chachapolycreate still accepts the compatibility poly1305 parameter in the template name, but it assumes the second template argument is always present and immediatel...

JLSEC-2026-728 In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in `wolfSSL_EVP_CipherFinal` (and...

In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSLEVPCipherFinal and related EVP cipher finalization functions fails to verify the authentication tag before returning plaintext to the caller. When an application uses the EVP API to perform ChaCha20-Poly1305 decryption,...

Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

SummaryTerrapin is a prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at...

PYSEC-2026-1758 Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

Summary Terrapin is a prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server a...

DEBIAN-CVE-2026-13758

CryptX versions before 0.088001 for Perl compare AEAD authentication tags in non-constant time in the streaming decryptdone path. The decryptdone$tag form compares it against the computed tag with memNE memcmp != 0, which short-circuits on the first differing byte, so its run time depends on the...

UBUNTU-CVE-2026-13758

CryptX versions before 0.088001 for Perl compare AEAD authentication tags in non-constant time in the streaming decryptdone path. The decryptdone$tag form compares it against the computed tag with memNE memcmp != 0, which short-circuits on the first differing byte, so its run time depends on the...

CVE-2026-13758

CryptX versions before 0.088001 for Perl compare AEAD authentication tags in non-constant time in the streaming decryptdone path. The decryptdone$tag form compares it against the computed tag with memNE memcmp != 0, which short-circuits on the first differing byte, so its run time depends on the...

GHSA-6VVH-PXR4-25R7 PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption

Impact The experimental Chacha20Poly1305 key-encryption algorithm generates the 16-byte Poly1305 authentication tag during encryptKey but discards it: the tag is never written to the header and therefore never reaches the wire. On the receiving side, decryptKey calls...

Updated libssh packages fix security vulnerabilities

CVE-2025-4877 Write beyond bounds in binary to base64 conversion functions CVE-2025-4878 Use of uninitialized variable in privatekeyfromfile CVE-2025-5318 Likely read beyond bounds in sftp server handle management CVE-2025-5351 Double free in functions exporting keys CVE-2025-5372 sshkdf returns ...

Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption

Impact The experimental Chacha20Poly1305 key-encryption algorithm generates the 16-byte Poly1305 authentication tag during encryptKey but discards it: the tag is never written to the header and therefore never reaches the wire. On the receiving side, decryptKey calls...

CVE-2026-41565

CryptX versions before 0.088001 for Perl have a stack buffer overflow in four AEAD decryptverify helpers. The gcmdecryptverify, ccmdecryptverify, chacha20poly1305decryptverify and eaxdecryptverify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer...

PT-2026-44386

Name of the Vulnerable Software and Affected Versions CryptX versions prior to 0.088 001 Description A stack buffer overflow exists in four AEAD decrypt verify helpers. The XS routines gcm decrypt verify, ccm decrypt verify, chacha20poly1305 decrypt verify, and eax decrypt verify copy a...