Malicious code in shadowmd (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

flash-exploit-defense-system

flash-exploit-defense-system Комплексная многоуровневая система защиты от эксплойтов Adobe Flash CVE CVE-2012-0754, CVE-2015-xxxx, CVE-2016-xxxx, CVE-2018-xxxx с защитой на уровне браузера, мобильных устройств, сервера и системы...

lldp

lldp Профиль C2 для Mythic, обеспечивающий одноранговую связь peer-to-peer через IEEE 802.1AB LLDP. Данные C2 передаются внутри организационно-специфичных TLV Type 127 с настраиваемым OUI, благодаря чему кадры сливаются с вендорскими расширениями LLDP в трафике. LLDP — протокол только второго...

CVE-2025-44136

CVE-2025-44136 XSS non authentifié dans MapTiler Tileserver-php v2.0. Description MapTiler Tileserver-php v2.0 est vulnérable aux Cross Site Scripting XSS. Le paramètre GET « layer » est reflété dans un message d'erreur sans encodage HTML. Cela conduit à une XSS et permet à un attaquant non...

CVE-2021-31630-OpenPLC-3-Authenticated-RCE

CVE-2021-31630 OpenPLC 3 WebServer: аутентифицированное удаленное выполнение кода. Описание Наличие внедрения команд Command Injection в Open PLC Webserver v3 позволяет удаленным злоумышленникам выполнять произвольный код, используя компонент «Hardware Layer Code Box», расположенный на странице...

DEBIAN-CVE-2026-71885

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

CVE-2026-71885

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

EUVD-2026-92003

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

CVE-2026-71885

In Bouncy Castle for Java versions before 1.86 , the Messaging Layer Security (MLS, RFC 9420) implementation failed to bind an X.509 credential to a LeafNode's signature_key . Because the X.509 certificate chain was stored but never parsed or validated, the end-entity certificate's public key was...

CVE-2026-71885 MLS X.509 credential not bound to the LeafNode signature key

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

CVE-2026-71885

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

CVE-2022-23884

CVE-2022-23884 В официальном сервере Minecraft: Bedrock Edition также известном как Bedrock Server есть уязвимости сетевого уровня, которые позволяют атакующему запустить DoS-атаку. CVE-2022-23884 затрагивает Mojang Bedrock Dedicated Server 1.16.0-1.18.12, вызывая большой цикл и краш сервера из-з...

Linux Distros Unpatched Vulnerability : CVE-2026-71885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey...

CVE-2026-71885: Improper Certificate Validation

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

CVE-2026-17507

A flaw was found in Bouncy Castle's Messaging Layer Security MLS implementation. Due to an improper signed integer comparison, an out-of-range leaf identifier incorrectly bypasses group membership checks. A group member can exploit this flaw by sending a specially crafted message, causing unbound...

Check Risk WAF

Check Risk WAF Solution cloud WAF complète russe pour la protection des applications web et de l'infrastructure Solution cloud WAF intégrée russe pour la protection des applications web et de l'infrastructure Site · Documentation · Russe · Anglais Version russe Check Risk WAF – Solution cloud WAF...

pocs_slides

Делюсь своими бюллетенями advisory, PoC, слайдами и скриптами по безопасности IoT и протоколов. Вы можете найти меня: Medium: https://medium.com/@cq674350529 Блог: https://cq674350529.github.io/ Почта: [email protected] Twitter: @cq674350529 Слайды OffByOne2025: Патч-диффинг — ты мой меч!...

BlockChainConstruction

Предисловие В этой статье мы в основном расскажем о нескольких аспектах аудита публичных блокчейнов, заслуживающих внимания. Для аудиторов безопасности и разработчиков публичных блокчейнов это проект, достойный изучения и размышлений. Архитектура Прежде чем знакомиться с построением системы...

overload

Surcharge Un outil de test de résistance réseau basé sur Python proposant des méthodes d’attaque de couche 2, couche 4 et couche 7 pour les tests de sécurité autorisés. !WARNING Ce projet a été archivé et n’est plus activement maintenu. Bien que le code source reste disponible, aucune nouvelle...

shadowd

Logo Shadow Daemon est un pare-feu applicatif web qui intercepte les requêtes au niveau de l'application. Ce dépôt contient le composant principal de Shadow Daemon qui gère l'analyse et le stockage des requêtes. Documentation Pour la documentation complète, veuillez vous référer à...