private-landing

Private Landing Learn authentication by building it right. Live Demo · Threat Model · Auth Flows · ADRs Demo note: The login endpoint is protected by adaptive PoW challenges — repeated failures return increasing proof-of-work difficulty. Cache-backed rate limiting is implemented and tested but no...

ssh-auditor

SSH Auditor Features ssh-auditor will automatically: Re-check all known hosts as new credentials are added. It will only check the new credentials. Queue a full credential scan on any new host discovered. Queue a full credential scan on any known host whose ssh version or key fingerprint changes...

simplify

Simplify Generic Android Deobfuscator Simplify virtually executes an app to understand its behavior and then tries to optimize the code so that it behaves identically but is easier for a human to understand. Each optimization type is simple and generic, so it doesn't matter what the specific type...

CVE-2017-3000

CVE-2017-3000 Полная эксплуатация CVE-2017-3000 на Flash Player Constant Blinding PRNG Вставьте WANG и wang в динамически создаваемую кучу кода в конце...

e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout

CVE-2026-17543 — Injection SQL dans l'extension PHP ext/pgsql via l'évasion de E'...' par barre oblique inversée Preuve de concept pour CVE-2026-17543 CVSS 9.8 Critique, CWE-89, une vulnérabilité d'injection SQL dans l'extension PostgreSQL procédurale de PHP. Résumé de la vulnérabilité pginsert,...

fips203

NCC Group : Norme FIPS 203 de mécanisme d'encapsulation de clé à base de treillis modulaires FIPS 203 projet initial public — Norme de mécanisme d'encapsulation de clé à base de treillis modulaires, écrite en Rust pur pour les applications serveur, de bureau, navigateur et embarquées. Le dépôt...

EUVD-2026-65215

Grav: Non constant time nonce comparison in Utils::verifyNonce used for CSRF protection...

CVE-2023-4863

tout le crédit revient au script de DARKNAVY. Ceci est juste une version modifiée avec les constantes OFFSET et VALUE ajoutées en haut du fichier pour faciliter les ajustements...

CVE-2026-70658 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

CVE-2026-70658

Pay is a payments engine for Ruby on Rails 6.0+. Prior to version 11.6.2 , the method Pay::Webhooks::PaddleBillingController#valid_signature? compares the computed 64-character SHA-256 HMAC against the attacker-controlled h1 token from the Paddle-Signature header using Ruby's String#== (a non-con...

CVE-2026-70658 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: SCTP: The comparison of MACs has been fixed to require constant-time operations. To prevent timing attacks, MACs need to be compared in constant-time. Use the appropriate helper function for this purpose...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/tcpmd5: The comparison of MACs has been fixed to require constant time. To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper functions for this purpose...

Astra Linux – Vulnerability in Heimdal

The fix for CVE-2022-3437 involved changing the memcmp function to run in constant time, as well as providing a workaround for a compiler bug by adding comparisons of the result with the value “!= 0” to the memcmp function. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0...

CVE-2025-50360

Débordement de tampon tas dans le langage Pepper Pepper Language est un langage de programmation interprété rapide pour la simplicité et la verbosité. Il est typé dynamiquement et prend en charge le ramasse-miettes. Version concernée : Version 0.1.1 et antérieures, Commit...

CVE-2017-11499

Специфические уязвимости безопасности Node.js Постоянные семена хеш-таблицы CVE-2017-11499 Node.js был подвержен удаленным DoS-атакам с помощью хеш-флудинга, так как семя хеш-таблицы было постоянным для данной выпущенной версии Node.js. Это было следствием сборки с включенными по умолчанию снимка...

mlkem-native

mlkem-native mlkem-native est une implémentation sécurisée, rapide et portable en C901 de ML-KEM2. Il s'agit d'un fork de l'implémentation de référence de ML-KEM3. Tout le code C dans mlkem/src/ et mlkem/src/fips202/ est prouvé sûr en mémoire aucun débordement mémoire et sûr en types aucun...

apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation

A flaw was found in Apache Portable Runtime Utility apr-util. The aprpasswordvalidate function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without crypt such as Windows, BeOS,...

apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation

A flaw was found in Apache Portable Runtime Utility apr-util. The aprpasswordvalidate function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without crypt such as Windows, BeOS,...

DRUPAL-CONTRIB-2026-144

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module uses cryptographic constructions that do not align with current security best practices. The module performs certain signature...