CVE-2021-38297

Exploiting CVE-2021-38297: Vulnerability in GO Wasm Buffer Overflow Overview of the Vulnerability WebAssembly WASM serves as a binary instruction format executable in most modern web browsers. It acts as a compilation target for various high-level languages like C, C++, Rust, and GO, allowing cod...

GAMBA

GAMBA GAMBA is a tool for the simplification of mixed Boolean-arithmetic expressions MBAs. GAMBA is short for General Advanced Mixed Boolean Arithmetic simplifier. It uses the linear algebraic simplifier SiMBA to iteratively simplify linear subexpressions of a potentially nonlinear input MBA...

binprotect

Build instructions See 4. Building for build instructions. Contents 1. Introduction 2. Binary rewriter 2.1. Relative address tracking 2.2. Disassembly 2.2.1. Basic block splitting 2.2.2. Indirect control flow 2.2.2.1. Jump tables 2.2.2.1.1. Bounded jump tables 2.2.2.1.2. Unbounded jump tables...

CVE-2021-38297-Go-wasm-Replication

🚨 Exploiting CVE-2021-38297: A Journey into GO Wasm Buffer Overflow 🚨 🌐 Overview of the Vulnerability 🌐 WebAssembly WASM 🌍, a cutting-edge binary instruction format, enables the seamless execution of high-level languages like C, C++, Rust, and GO in modern web browsers. However, the discovery of...

Linear eMerge E3-Series - Cross-Site Scripting

Linear eMerge E3-Series devices contain a cross-site scripting vulnerability via the type parameter, e.g., to the badging/badgetemplatev0.php component. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site and thus steal cookie-based...

sickle-pdk

Sickle - Payload Development Kit Sickle is a tool I originally developed to help me be more effective, in both developing and understanding shellcode. However, throughout the course of its development and usage It has evolved into a payload development kit. Although current modules are mostly aim...

CVE-2022-31269

CVE : CVE-2022-31269 Exploit Title: Nortek Linear eMerge E3-Series - Information Disclosure leads to access admin dashboard...

CVE-2026-57122

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

CVE-2026-57122 PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

CVE-2026-57122

PraisonAI (a multi-agent LLM framework) is vulnerable to fail-open webhook signature verification in its WhatsApp and Linear bot adapters prior to 4.6.59 . When WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is unset—the default on a fresh install —the _handle_webhook handler skips HMAC-SHA256 veri...

EUVD-2026-77599

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bridge: brndsend: Linearize the skb before parsing ND options. The brndsend function parses neighbor discovery options from ns-opt and assumes that these options are located in the linear part of the request. Its callers only...

CVE-2026-12882

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and...

CVE-2026-12882 Mattermost Markdown autolink parsing denial of service

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and...

EntropicaPublic

March updates I need to move some work over from the private repos. The exploration into using massivly multheaded models with mixer and readout functions separated continues. Currently training up a Chinese TinyStories on a 3B-equivalent model that trains, easily, on an 8GB gpu. We're looking at...

CVE-2022-31499

CVE-2022-31499 Exploit Title: Nortek Linear eMerge E3-Series - Blind OS Command Injection...

CVE-2022-31798

CVE-2022-31798 Exploit Title: Nortek Linear eMerge E3-Series - account takeover...

CVE-2026-21001-WebAssembly-Linear-Memory-OOB-via-Table-Index-Confusion

CVE-2026-21001 – WebAssembly Linear Memory OOB via Table Index Confusion Overview A WebAssembly module uses an imported function with no bounds check on an array index. An attacker can supply an out-of-bounds index to read or write outside the linear memory, potentially leaking host secrets or...

flare-qdb

FireEye Labs Query-Oriented Debugger flare-qdb es una herramienta basada en Python, utilizable desde la línea de comandos y mediante scripts, diseñada para evaluar y manipular el estado nativo de un programa. Utiliza Vivisect para establecer un punto de interrupción en cada instrucción consultada...

GHSA-8344-3JMQ-59R6 xmldom: Quadratic-time attribute deduplication

Summary xmldom builds the attribute collection of every parsed element by inserting attributes one at a time into a DOM NamedNodeMap. Each insertion first performs a linear scan of all already-inserted attributes to enforce the DOM uniqueness rule no two attributes with the same qualified name /...