September 8, 2026-KB5126144 Cumulative Update for .NET Framework 3.5, 4.7.2 and 4.8 for Windows 10, version 1809 and Windows Server 2019

None None...

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component CVE-2026-74934 firefox: thunderbird: Privilege escalation in the Networking: Cookies component CVE-2026-74953 firefox: thunderbird:...

Stuxnet

Stuxnet This repository contains a strictly educational and research-oriented reconstruction of the infamous Stuxnet worm. It is the product of countless hours of reverse engineering work conducted by the global security research community on the original binary samples discovered in 2010...

inception

Nota: Esta herramienta ya no está en desarrollo activo; por favor, mira PCILeech en su lugar. INCEPTION Inception es una herramienta de manipulación de memoria física y hacking que explota DMA basado en PCI. La herramienta puede atacar a través de FireWire, Thunderbolt, ExpressCard, PC Card y...

CVE-2026-82756

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

CVE-2026-81638

Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...

gradient-untangler

gradient-untangler A local research harness that searches for the exact tokens that make an open-weight language model start its answer the way you specify. Open-weight models ship as ordinary files: config.json, a tokenizer, and one or more .safetensors or .bin shards. A Hugging Face id is only ...

UninstalledAppCanary

Uninstalled App Canary Prior Work This builds on the deception engineering work around Windows Service Canaries https://research.nccgroup.com/2021/03/04/deception-engineering-exploring-the-use-of-windows-service-canaries-against-ransomware/ Thesis Certain threat actors uninstall a number of...

yj_nearbyglasses v1.0.10

yjnearbyglasses attempting to detect smart glasses nearby and warn you. ⚠ WARNING! ⚠ nearby-glasses-alert.pages.dev is NOT RELATED TO MY PROJECT. Many apps in Play Store and App Store look or are even called very similar to Nearby Glasses. They seem to hijack the name and try to make a quick prof...

impersonate-proxy

impersonate-proxy English | 日本語 | 简体中文 A local MITM proxy that lets you control TLS fingerprints JA3/JA4, HTTP/2 fingerprints, HTTP header order, User-Agent, and source IP headers — all from a single YAML config file. A Chrome extension is included for toggling the proxy and switching fingerprint...

CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...

EUVD-2026-72541

Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...

CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...

EEF-CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Summary Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3...

CVE-2026-81638

ash_double_entry (Elixir library by ash-project) contains an Improper Handling of Alternate Encoding vulnerability in its ULID type. Although a 128-bit ULID is rendered as 26 Crockford base-32 characters, the first character encodes only 3 bits (canonical values 0–7). The decode/1 function masks ...

CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...

CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

CVE-2026-82756

ash_authentication_oauth2_server (ash-project) is vulnerable to header parameter injection in its BearerPlug and RequireScopePlug. A tenant-derived resource_metadata URL is interpolated directly into the WWW-Authenticate challenge without escaping, allowing an unauthenticated attacker in a multi-...

CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

EEF-CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Summary Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer...