mimikatz-missing-manual

Mimikatzの欠落マニュアル Windows ID、Kerberos、PKI研究のための決定版ガイド。 本教材は、もともとセキュリティカンファレンス向けの非公開の高水準トレーニングカリキュラムとして開発されましたが、現在は一般公開されています。ここで文書化されている技術的な深さと内部ロジックの多くは、Mimikatzの作者であるBenjamin Delpy 氏の直接の協力と洞察によって洗練されました。 本マニュアルについて...

malware_training_vol1

malwaretrainingvol1 Materiales para el entrenamiento de análisis de malware en Windows volumen 1 🚧 ADVERTENCIA: ¡trabajo en progreso! Se añadirá más material gradualmente. Contenido El objetivo de este entrenamiento es desarrollar la comprensión de diversas técnicas comunes utilizadas por el...

publications

来自Calif的出版物 MAD Bugs：AI发现漏洞月 Apple Internals 一系列逆向工程苹果内部结构的文章。 安全研究 竞赛中的竞赛：利用Linux数据包套接字中的CVE-2025-38617 安全审计 Shamir39安全审计，由一位匿名客户委托。 Mbed TLS 3.6.2安全审计，由Google委托。...

CVE-2025-66478-Research-Proof-of-Concept

CVE-2025-66478-Research-Proof-of-Concept 概述 此仓库包含与 CVE-2025-66478 相关的研究和概念验证实现，该漏洞影响某些 Next.js / React 服务器组件配置。 该项目是在受控实验室环境中开发的，用于教育和防御性安全目的。 免责声明 此仓库仅供以下用途提供： 安全研究 防御性测试 教育目的 授权的实验室环境 请勿在未经明确授权的情况下针对系统使用此代码。 作者对滥用行为不承担任何责任。 技术摘要 该漏洞允许攻击者通过不安全地处理 React 服务器组件负载，触发非预期的代码执行。 受影响的应用程序可能暴露能够在特定条件下访问...

linux-insides

Linux insides This repository contains a book-in-progress about the Linux kernel and its insides. The goal of this project is simple – to share knowledge about the Linux kernel internals and related low-level topics. If you're curious about what's under the hood, see the Table of Contents. Chapte...

Azure-AccessPermissions

Azure-AccessPermissions 简单易用的 PowerShell 脚本，用于枚举 Azure Active Directory 环境中的访问权限。 相关背景详情可参考配套博客文章： 解开 Azure Active Directory 主体与访问权限的谜团 解开 Azure Active Directory 权限之谜 II：特权访问 要求 运行此脚本需要以下两个 PowerShell 模块： Microsoft.Graph AADInternals AzureADPreview 所有模块均可直接在 PowerShell 中安装： root@kitploit: PS:...

Astra Linux – Vulnerability in Chromium

Leakage of side-channel information in Google Chrome’s network internals before version 89.0.4389.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

The use of after-free in Base Internals in Google Chrome before version 101.0.4951.41 allowed a remote attacker to perform arbitrary read/write operations through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 89.0.4389.72, using "After Free" in the Network Internals section of Google Chrome on Linux allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

study_embedded_security

studyembeddedsecurity A hands-on study...

CVE-2026-16812

CVE-2026-16812 affects VeloCloud Orchestrator (VCO) On-Prem. The vulnerability is an OS command injection that could allow a remote attacker to access privileged internal functionality and impact the VCO host, compromising confidentiality, integrity, and availability of the orchestrator and manag...

CVE-2026-16812 VeloCloud Orchestrator OS Command Injection

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

PYSEC-2026-1518 LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates

Context A template injection vulnerability exists in LangChain's prompt template system that allows attackers to access Python object internals through template syntax. This vulnerability affects applications that accept untrusted template strings not just template variables in ChatPromptTemplate...

PT-2026-55891

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description Improper input validation in the Apache Camel AWS2-SQS component allows an attacker to inject...

CVE-2026-41730

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

EUVD-2026-35907

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

CVE-2026-41730

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

CVE-2026-41730

Spring Data REST is the affected component. The CVE describes that it serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence‑layer internals to HTTP clients. Affected versions include Spring Data REST 3.7.0–3.7.19; 4.3.0–4.3.16; 4.4.0–4.4.14; 4...

CVE-2026-41730 Spring Data REST exposes persistence-layer internals in error responses

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

CVE-2026-41730 Spring Data REST exposes persistence-layer internals in error responses

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...