randy

Randy What This is a pre-authenticated RCE exploit for Inductive Automation Ignition that impacts versions = 8.1.16. We failed to exploit the bugs at Pwn2Own Miami 2022 because we had a sloppy exploit and no debug environment, but since then we have found the time and energy to improve it! Author...

Exploits_and_Advisories

Exploits y Avisos Repositorio que rastrea exploits, vulnerabilidades y avisos públicos que co-descubrí o co-redacté. CVEs CVE| ID| Objetivo| Descripción| Divulgación ---|---|---|---|--- CVE-2020-10881| ZDI-20-333| TP-Link Archer A7/C7| desbordamiento de pila DNS| Pwn2Own Tokyo 2019 CVE-2020-10882...

aethel_core

Aethel-Core: Automated Cognitive Defense & Cyber Threat Simulation WAF A high-fidelity, high-velocity hybrid cyber security system optimized for Real-time Threat Mitigation , LLM Instruction Tuning , and Neuro-Symbolic AI Training , built in SWI-Prolog. 🚀 Key Innovations & Architecture Modules 1...

lean-cve-poc

CVE-2026-72844: Lean 4 Kernel Soundness Bug Proving0 = 1 axiom-free via nested inductive projection validation bypass...

CVE-2026-77393 Inductive Automation Ignition Incorrect Default Permissions

In Ignition 8.1.53 and earlier, the Gateway "Create Project Roles" setting shipped blank, which permitted any authenticated user to create projects if they can execute gateway scripts. Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3...

Inductive Automation Ignition

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow any authenticated user to create projects. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control...

CVE-2026-72704

The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has been changed by transport. A fixpoint may apply a rewrite along an equality between types to its recursive argument, which the guard checker accepts because...

CVE-2026-72704

CVE-2026-72704 affects the guard checker in Rocq Prover through 9.2.0 . The checker does not re-validate the recursive tree of an inductive type parameter after a transport -induced rewrite. A fixpoint can apply a type-equality rewrite to its recursive argument; the guard checker accepts the resu...

CVE-2026-72844

The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::addinductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are replaced by auxiliary types, so their...

CVE-2026-72844

CVE-2026-72844 is a kernel soundness break in Lean 4 , the theorem prover. The root cause is a missing type check in environment::add_inductive (src/kernel/inductive.cpp): nested inductive applications replaced by auxiliary types had their parametric arguments unchecked, and the kernel did not ve...

CVE-2026-72844 Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections

The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::addinductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are replaced by auxiliary types, so their...

EUVD-2026-63487

The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::addinductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are replaced by auxiliary types, so their...

CVE-2026-72844 Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections

The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::addinductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are replaced by auxiliary types, so their...

PT-2026-79074

Name of the Vulnerable Software and Affected Versions Lean 4 affected versions not specified Description The kernel fails to verify that the structure named in a projection expression matches the type of the value being projected. Additionally, the environment::add inductive function in...

Filter-Then-Verify: A Multiphase GNN and ModernBERT Framework for Social Engineering Detection in Email Networks

Social engineering attacks exploit human trust rather than software vulnerabilities, making them difficult to detect using conventional filters. We propose a two-stage filter-then-verify framework combining inductive Graph Neural Networks GNNs for structural anomaly detection with a co-attention...

PT-2026-25038

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition affected versions not specified Description An Ignition user importing a specially crafted external file can lead to the execution of embedded malicious code during deserialization. This can occur intentionally or...

Inductive Automation Ignition 代码问题漏洞

Inductive Automation Ignition is an integrated software platform developed by Inductive Automation in the United States, designed for SCADA systems. This platform supports SCADA Supervisory Control and Data Acquisition and HMI Human Machine Interface applications. Inductive Automation Ignition ha...

SCAFFOLD-CEGIS: Preventing Latent Security Degradation in LLM-Driven Iterative Code Refinement

The application of large language models to code generation has evolved from one-shot generation to iterative refinement, yet the evolution of security throughout iteration remains insufficiently understood. Through comparative experiments on three mainstream LLMs, this paper reveals the iterativ...

Corrupting LLMs Through Weird Generalizations

Fascinating research: Weird Generalization and Inductive Backdoors: New Ways to Corrupt LLMs. Abstract LLMs are useful because they generalize so well. But can you have too much of a good thing? We show that a small amount of finetuning in narrow contexts can dramatically shift behavior outside...

CVE-2022-35869

This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 b2022030114. Authentication is not required to exploit this vulnerability. The specific flaw exists within com.inductiveautomation.ignition.gateway.web.pages. The...