CVE-2026-36960

CVE-2026-36960: Cross-Site Request Forgery CSRF in Web Management Interface CVE ID: CVE-2026-36960 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: U-SPEED Product: U-SPEED Router Firmware Version: V1.0.0 CWE: CWE-352 - Cross-Site Request Forgery CSRF Description The U-SPEED Router firmware...

presentation-clickers

Presentation Clickers Tenía ganas de hacer un poco de ingeniería inversa de RF, así que pedí algunos clickers de presentación y me divertí un poco. Esto es un fork de nrf-research-firmware que escribí hace unos años en Bastille. He añadido soporte para algunos transceptores/protocolos nuevos, e...

CVE-2026-52482

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service spawns /app/shfortelnet...

EUVD-2026-66233

On the Trusted Firmware-M TF-M 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer...

nrf-research-firmware

RFStorm nRF24LU1+ Research Firmware Firmware and research tools for Nordic Semiconductor nRF24LU1+ based USB dongles and breakout boards. Requirements SDCC minimum version 3.1.0 GNU Binutils Python PyUSB platformio Install dependencies on Ubuntu: root@kitploit: sudo apt-get install sdcc binutils...

isa_recovery

ISA Recovery System A reverse-engineering pipeline that turns a firmware binary and its possibly-wrong disassembly into a working Ghidra processor specification. When you hit a proprietary processor with no documentation and no Ghidra support, this tool recovers the real encoding of each...

CVE-2026-82563

An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation of device status responses, observation of application requests, and potential triggering of firmware-update behavior...

CVE-2026-77974

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel...

qemu

=========== QEMU README QEMU is a generic and open source machine & userspace emulator and virtualizer. QEMU is capable of emulating a complete machine in software without any need for hardware virtualization support. By using dynamic translation, it achieves very good performance. QEMU can also...

Tenda-Router-VR-and-Exploit

Tenda-Router-VR-and-Exploit This write-up shows exactly how I emulated the AC15 V15.03.05.19 firmware’s webserver with QEMU, made it reachable from the host browser, and exercised the vulnerable /goform/setUsbUnload handler CVE-2020-10987 to get command execution inside the emulated rootfs...

CVE-2026-77974

Softish C6 Ear Camera and its EarVision Android Application contain a vulnerability where a critical function lacks proper authentication. After spoofing the device and obtaining a single user confirmation, an attacker in the adjacent network can cause the application to transmit firmware through...

EUVD-2026-75056

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel...

CVE-2026-77974 Softish C6 Ear Camera and EarVision Android Application Missing authentication for critical function

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel...

EUVD-2026-75053

An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation of device status responses, observation of application requests, and potential triggering of firmware-update behavior...

CVE-2026-82563

CVE-2026-82563 affects the Softish C6 Ear Camera and the EarVision Android Application . The vulnerability is an authentication bypass by spoofing : an attacker can impersonate the camera device, placing themselves in a man-in-the-middle or device-emulation position. This enables manipulation of ...

PS4-webkit-exploit-6.XX

This repository does not have a README...

samsung-q60t-exploit

Tizen exploit Description Exploit and firmware decryption script presented at Grehack 2021. Slides are available inside the slides . directory and the replay video onYoutube . Directories This repository contains three directories: exploit/: containing the v8 exploit and the kernel exploit,...

yealink_tools

Yealink firmware reverse engineering This repository contains some script utilities used during the reverse engineering of Yealink VOIP phones firmware. For more information about this research, please read the blogpost...

CVE-2026-56111

CVE-2026-56111 - Marlin M421 Out-of-bounds Write Proof of concept for CVE-2026-56111 , an out-of-bounds write in the M421 G-code handler of Marlin Firmware when built with MESHBEDLEVELING. Advisory: https://www.vulncheck.com/advisories/marlin-firmware-out-of-bounds-write-via-m421-g-code-handler...

EUVD-2026-74805

Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potential...