ketshash

Ketshash A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs. The tool was published as part of the "Pass-The-Hash detection" research - more details on "Pass-The-Hash detection" are in the blog post:...

CVE-2026-78006-POC

CVE-2026-78006-POC POC para CVE-2026-78006 The Events Calendar = 6.17.4 - Inyección de Objetos PHP No Autenticada a Ejecución Remota de Código CONTACTO telegram para cualquier consulta : @soldout0O 💙 Apoya el Proyecto Si aprecias mi trabajo, considera apoyar el proyecto vía USDT TRC20:...

LAB-DFIR-cve-2023-38831

LAB-DFIR-cve-2023-38831 Este laboratorio simula un ataque CVE-2023-38831 y debe investigar la imagen de disco, conteniendo una variedad de preguntas que incluyen la comprensión del registro de Windows, archivos NTFS, caché del navegador, y un entendimiento completo de las funciones que emanan de...

CVE-2026-78006

The Events Calendar WordPress plugin (versions ≤ 6.17.4 ) is vulnerable to unauthenticated Remote Code Execution via PHP Object Injection in the is_safe_widget_instance function. The root cause is a bypass of the unsafe-object guard: PHP magic methods fire during pre-parse, and enable_rendering_w...

EUVD-2026-76833

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

EUVD-2026-76832

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the issafewidgetinstance function. This is due to insufficient protection in issafewidgetinstance, which can be bypassed because PHP fires magic methods during its...

CVE-2026-78159

The Events Calendar WordPress plugin (versions ≤ 6.17.3 ) is vulnerable to unauthenticated remote code execution via the Element_Classes::parse_array() function. Insufficient validation of the widget classes map allows a plain-array payload to bypass the is_safe_widget_instance() object check and...

exploit-CVE-2022-0482

Divulgación de PII de Easy!Appointments Easy!Appointments --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder All events since default: 2015-01-11 All events until default: today --debug Display arguments -h, --help Show this screen Examples:...

EUVD-2026-42683

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft...

CVE-2026-89513

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine component for RISC-V architectures. A malicious guest operating system could exploit an integer overflow vulnerability by providing a crafted number of Performance Monitoring Unit PMU events during the SBI PMU EVENTGETINFO...

Hunt-Weird-ImageLoads

Hunt-Weird-ImageLoads Este proyecto fue creado para jugar con diferentes IOCs causados por eventos ImageLoad. Aprovecha ETW para monitorear eventos ImageLoad y recorre el callstack para identificar algunos posibles IOCs, tales como: Página RWX en el callstack Módulo stomped en el callstack Module...

CVE-2026-45057

CVE-2026-45057 affects the matrix-sdk-ui Rust crate (part of matrix-rust-sdk) prior to version 0.16.1 . The message edit validation logic is missing a check: when replacing an encrypted event, the replacement event is not required to be encrypted itself. This allows a malicious homeserver adminis...

CVE-2026-45057 matrix-sdk-ui: Incomplete edit validation

matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the matrix-sdk-ui crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious...

DEBIAN-CVE-2026-89750

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...

CVE-2026-89629

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...

AZL-100575 CVE-2026-89462 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040getvcell and max17040getsoc ignore errors returned by regmapread. When an I2C transfer fails, the uninitialized register value is converted and reported to userspace...

CVE-2026-89750 tracing/user_events: Clear copied tracing state before fork duplication

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...

CVE-2026-89629 HID: corsair-void: Check size of status and firmware events before reading them

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...

CVE-2026-89629 HID: corsair-void: Check size of status and firmware events before reading them

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...

EUVD-2026-76541

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...