CVE-2020-5248

CVE-2020-5248 POC Environment Setup and Test Test Method Environment Setup vim docker/nginx/default.conf servername docker host ip ; -change mysqlserver: mysql id: root pw: root Run cd docker/app/ tar -xvf /docker/app/glpi-9.4.5.tgz chmod -R 777 glpi docker-compose up -d Access glpi at...

miLazyCracker

miLazyCracker Mifare Classic Plus - Hardnested Attack Implementation for LibNFC USB readers SCL3711, ASK LoGO, etc Installation: ./miLazyCrackerFreshInstall.sh Usage example: place a tag and enjoy mkdir mydumps cd mydumps miLazyCracker Possible issue: error libnfc.driver.pn53xusb Unable to set US...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – Post-Quantum KEM Timing Side-Channel Kyber Decapsulation Overview A vulnerable implementation of the Kyber KEM decapsulation leaks secret key bits through timing differences in the ciphertext rejection step, enabling full key recovery. Severity: Critical Private Key Compromise...

PadBuster

PadBuster - Automated script for performing Padding Oracle attacks Author: Brian Holyfield - Gotham Digital Science [email protected] Credits to J.Rizzo and T.Duong for providing proof of concept web exploit techniques and S.Vaudenay for initial discovery of the attack. Credits also to James...

CVE-2026-23006-Kyber-Ciphertext-Length-Side-Channel

CVE-2026-23006 – Kyber Ciphertext Length Side‑Channel Program Code Python kyberlengthleak.py - Leaks secret key bit based on ciphertext length import random Simulate encapsulation: ciphertext length depends on message bit def encapsulatepk, bit: In a flawed implementation, the ciphertext size...

ml-kem-key-recovery

Full key recovery from a partial Fujisaki-Okamoto comparison in wolfSSL ML-KEM CVE-2026-6330 NEON and CVE-2026-10097 AVX2. Fixed in wolfSSL 5.9.2. The full technical write-up is published as Cryptology ePrint Archive, Paper 2026/1682 local copy in paper/. See Citation below. Introduction ML-KEM...

CVE-2019-6690-python-gnupg-vulnerability

CVE-2019-6690: Improper Input Validation in python-gnupg 0.4.3 We discovered a way to inject data trough the passphrase property of the gnupg.GPG.encrypt and gnupg.GPG.decrypt methods when symmetric encryption is used. The supplied passphrase is not validated for newlines, and the library passes...

meesho-android-improper-encryption-cve-2026-5682

🔐 Proof of Concept: Meesho Android App – Insecure Cryptographic Implementation AES-CBC without Integrity + Weak Key Derivation Author: Soyam Arya aka honestcorrupt Date of Discovery: March 2026 Affected App: Meesho Android App com.meesho.supply Status: Under Verification Category: Insufficient...

CLEANSTART-2026-JO84876 flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext

Security vulnerability affects the nettle package. A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext...

Linux Distros Unpatched Vulnerability : CVE-2026-119186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM...

EUVD-2026-113363

Forge: AES-GCM authentication bypass via unvalidated tagLength option...

Improper Validation of Specified Quantity in Input

Overview node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the modes.gcm.prototype.start method in...

Improper Validation of Specified Quantity in Input

Overview org.webjars.npm:node-forge is a WebJar for node-forge. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the modes.gcm.prototype.start method in lib/cipherModes.js. An attacker can have forged ciphertext accepted as authentic, and...

CVE-2026-119186

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start during decryption through forge.cipher.createDecipher. When an application derived tagLength from received da...

AZL-112475 CVE-2026-119186 affecting package python-tensorboard 2.16.2-6

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start during decryption through forge.cipher.createDecipher. When an application derived tagLength from received da...

UBUNTU-CVE-2026-119186

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start during decryption through forge.cipher.createDecipher. When an application derived tagLength from received da...

CVE-2026-119186

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start during decryption through forge.cipher.createDecipher. When an application derived tagLength from received da...

CVE-2026-119186

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start during decryption through forge.cipher.createDecipher. When an application derived tagLength from received da...

PT-2026-132806

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1 Description Forge also known as node-forge fails to validate the tagLength option passed to the start function during decryption via forge.cipher.createDecipher. If an application uses a tagLength derived from...

CVE-2026-119186: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start during decryption through forge.cipher.createDecipher. When an application derived tagLength from received da...