CVE-2026-90452

CVE-2026-90452 affects a reverse proxy component where requests to an identity-provider service (for token discovery, introspection, and credential exchange) do not verify the IdP's server certificate . An attacker positioned on the network path between the proxy and the identity provider could i...

CVE-2026-90452

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD ServerKeyVerifier lambda that returns true unconditionally for every outbound SSH connection used by git+ssh:// mirrors. The accompanying lines disable the knownhosts and /.ssh/config fallbacks, and a repo-wide searc...

EUVD-2026-38206

Central Dogma: SSH host-key verification permanently disabled in Git mirror SshGitMirror...

CVE-2025-46408

CVE-2025-46408 Improper Hostname Verification in EagleEyes Lite Android Application 1. Overview Name : EagleEyesLite Version : 2.0.0 Vendor : AVTECH CWE : CWE-297: Improper Validation of Certificate with Host Mismatch CVSS : 9.8 CRITICAL Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:...

mitmAP

root@kitploit: | / \ | \ | | / /\ | |/ / | ' | | | ' | || / | | | | | | | || | | | | | | | || | || || ||||| || || |/| 2.2 ⚠️ Advertencia! Este proyecto ya no tiene mantenimiento y puede no funcionar como se espera. Un programa en Python para crear un AP falso y capturar datos. nuevo en 2.0:...

ssh-mitm

SSH MITM v2.3-dev Author: Joe Testa @therealjoetesta Overview This penetration testing tool allows an auditor to intercept SSH connections. A patch applied to the OpenSSH v7.5p1 source code causes it to act as a proxy between the victim and their intended SSH server; all plaintext passwords and...

ssh-mitm

SSH MITM v2.3-dev Autor: Joe Testa @therealjoetesta Resumen Esta herramienta de pruebas de penetración permite a un auditor interceptar conexiones SSH. Un parche aplicado al código fuente de OpenSSH v7.5p1 hace que actúe como un proxy entre la víctima y su servidor SSH destino; todas las...

btlejuice

Marco BtleJuice Introducción BtleJuice es un marco completo para realizar ataques de Hombre en el Medio Man-in-the-Middle en dispositivos Bluetooth Smart también conocidos como Bluetooth Low Energy. Está compuesto por: un núcleo de interceptación un proxy de interceptación una interfaz web dedica...

isip

isip Interactive sip toolkit for packet manipulations, sniffing, man in the middle attacks, fuzzing, simulating of dos attacks. Video https://asciinema.org/a/11128 Setup root@kitploit: git clone https://github.com/halitalptekin/isip.git cd isip pip install -r requirements.txt Usage Packet...

isip

isip Kit interactivo de SIP para manipulación de paquetes, sniffing, ataques man-in-the-middle, fuzzing, simulación de ataques DoS. Video https://asciinema.org/a/11128 Configuración root@kitploit: git clone https://github.com/halitalptekin/isip.git cd isip pip install -r requirements.txt Uso Las...

CVE-2026-11109-Bluetooth-Classic-KNOB-Attack-Key-Negotiation-of-Bluetooth-

CVE-2026-11109 – Bluetooth Classic KNOB Attack Key Negotiation of Bluetooth Program Code Python Simulated root@kitploit: knobattacksim.py - Simulates negotiation of encryption key size to 1 byte import random, hashlib class BluetoothDevice: def negotiatekeysizeself, proposedsize: Vulnerable:...

PT-2026-90521

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

deephack

docs/man/man1/pythontruss.1.ronn...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

CVE-2026-85217

Autodesk Fusion Desktop is vulnerable to a Man-in-the-Middle (MITM) attack via a maliciously crafted add-in that, when installed and executed, can modify persistent network proxy settings without user notification or consent. A successful exploit allows an attacker to redirect authenticated Fusio...

CVE-2025-65753

CVE-2025-65753 Proof of concept for CVE-2025-65753: Remote code execution on the Gryphon Guardian access point, firmware version 01.06.0006.22, through an improper TLS certificate validation. Description The Gryphon Guardian WiFi access point, with firmware version 01.06.0006.22, does not properl...

EUVD-2026-75268

A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle MitM access to execute code with root privileges on the Broker VM...