covertchannels-steganography

Many people ask me how to start in the field of steganography/covert channels or how to improve their skills. I wrote this recopilation to help them with some good references, tools and books that I used and read I will add more soon. Books & Papers/Articles Information Hiding Techniques for...

CVE-2026-48813-POC

Flawfinder-ANSI-Exploit-POC In version 2.0.19 of Flawfinder, no filename sanitization occurs when parsing possibly malicious filenames. Known affected terminals are libvte based, and the example below shows a mate-terminal. This exploit has since been fixed in version 2.0.20 as of 5/17/26 by Davi...

steg-tools

steg-tools This is a list of tools and resources for learning and experimenting with steganography and information hiding. Tools Exiftool is a Perl library and a command line application for the manipulation of metadata of different files, including EXIF, GPS, XMP, and ID3. Strings is part of the...

CVE-2026-116272

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundaryc="A" or boundary="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a...

DEBIAN-CVE-2026-116272

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundaryc="A" or boundary="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a...

CVE-2026-116266

MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous. The multipartboundary method decodes RFC 2047 encoded words anywhere in the boundary, but the ambiguity check only fires when the whole value is one encoded wor...

DEBIAN-CVE-2026-116265

MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections boundary0=, boundary1= and so on is joined after...

DEBIAN-CVE-2026-116264

MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops...

CVE-2026-116265

MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections boundary0=, boundary1= and so on is joined after...

CVE-2026-116272

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundaryc="A" or boundary="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a...

EUVD-2026-112305

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundaryc="A" or boundary="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a...

CVE-2026-116272 MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundaryc="A" or boundary="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a...

CVE-2026-116272

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundaryc="A" or boundary="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a...

CVE-2026-116266

The MIME::Head component in Perl (versions 5.518 through 5.520 ) is vulnerable to an interpretation conflict where the multipart_boundary() method decodes RFC 2047 encoded words within a multipart boundary but fails to flag the parse as ambiguous unless the entire value is a single encoded word. ...

CVE-2026-116266

MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous. The multipartboundary method decodes RFC 2047 encoded words anywhere in the boundary, but the ambiguity check only fires when the whole value is one encoded wor...

CVE-2026-116265

The MIME::Field::ParamVal component in Perl (versions before 5.521 ) fails to flag ambiguous multipart boundaries written as RFC 2231 continuations. The root cause is that boundary ambiguity checks only examine plain boundary= parameters, while RFC 2231 sections (e.g., boundary*0=, boundary*1=) a...

CVE-2026-116265 MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations

MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections boundary0=, boundary1= and so on is joined after...

CVE-2026-116264 MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary

MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops...

CVE-2026-116264

MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops...

EUVD-2026-112293

MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops...