json-interop-vuln-labs

مختبرات ثغرات التوافق البيني لـ JSON الوصف هذه هي المختبرات المرافقة لمقالتي البحثية "استكشاف ثغرات التوافق البيني في JSON". المختبر 1: عمليات شراء مجانية في تطبيق تجارة إلكترونية هجمات تصادم المفاتيح: أسبقية غير متناسقة للمفاتيح المكررة تمثيلات غير متناسقة للأرقام الكبيرة المختبر 2: تصعيد...

netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...

GHSA-2MC4-J865-9Q4R netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...

CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

RemoteMonologue

RemoteMonologue RemoteMonologue هي تقنية لالتقاط بيانات اعتماد ويندوز تتيح اختراق المستخدمين عن بُعد من خلال استغلال مفتاح RunAs الخاص بالمستخدم التفاعلي وإجبار مصادقات NTLM عبر DCOM. اقرأ مقال X-Force Red RemoteMonologue: Weaponizing DCOM for NTLM Authentication Coercions للحصول على معلومات مفصل...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

meshtastic-cve-2025-52464-poc

Meshtastic CVE-2025-52464 إثبات المفهوم نظرة عامة هذا المشروع هو إثبات مفهوم برمجي بحت يوضح CVE-2025-52464 ، وهي ثغرة أمنية تؤثر على إصدارات البرنامج الثابت Meshtastic من 2.5.0 إلى 2.6.10. يعيد هذا التنفيذ إنتاج السلوك التشفيري للبرنامج الثابت المُعرَّض للثغرة ويوضح كيف يمكن للمفاتيح التشفيرية...

Exploit for CVE-2026-71960

CVE-2026-71960 — Hard-coded JWT Secret in Cudy WR3000 2.0 Mesh...

CVE-2026-74283

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC version 2 component. This vulnerability allows a local unprivileged attacker to bypass administrative permission checks when performing network link operations. Consequently, the attacker can modify critical TIPC...

CVE-2026-44725

In EMQX versions prior to 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, missing five-minute grant lifetime and SHA-256 package binding let a compromised admin/API key upload attacker-controlled Erlang code via POST /api/v5/plugins/install, achieving remote code execution. Patched in all listed ...

Microsoft Partner Center Information Disclosure Vulnerability

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

CVE-2026-77073

n8n versions before 2.34.1 contain a credential validation bypass in the MCP createworkflowfromcode tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references...

EUVD-2026-63262

n8n versions before 2.34.1 contain a credential validation bypass in the MCP createworkflowfromcode tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references...

CVE-2026-77073 n8n before 2.34.1 Cross-Project Credential Access via MCP

n8n versions before 2.34.1 contain a credential validation bypass in the MCP createworkflowfromcode tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references...

CVE-2026-77073 n8n before 2.34.1 Cross-Project Credential Access via MCP

n8n versions before 2.34.1 contain a credential validation bypass in the MCP createworkflowfromcode tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references...

CVE-2026-73196 Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding

A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a...

CVE-2026-73196

FreeIPA is vulnerable to an authenticated denial-of-service in the otptoken-add operation. A low-privilege authenticated user can submit an oversized One-Time Password (OTP) key value , which is decoded and re-encoded without proper size limits, consuming excessive CPU and memory and degrading th...

CVE-2026-73196

A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a...

cryptography-research-demo

ملحقات بحث "المزيد من هجمات استرداد المفتاح الأحادي على AES ذي الجولات المقلّصة" الكود المصدري لكل تجربة مذكورة في الورقة. ولا يتم تضمين أي مخرجات قياس أو جدول مُجهز مسبقًا: كل برنامج يطبع أو يكتب نتائجه الخاصة، لذلك يمكن إعادة توليد كل رقم من الصفر. تعتمد ادعاءات استرداد المفتاح في الورقة على...

chaos-client

Chaos Client عميل Go للتواصل مع واجهة برمجة تطبيقات مجموعة بيانات Chaos. English • 中文 التثبيت root@kitploit: go install -v github.com/projectdiscovery/chaos-client/cmd/chaos@latest الاستخدام root@kitploit: chaos -h سيعرض هذا مساعدة الأداة. فيما يلي جميع الخيارات التي تدعمها. root@kitploit: -key...