GHSA-VP5Q-FF62-JWQV russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

Summary The agent server in russh::keys::agent::server never calls Agent::confirm before signing with a key that was added with the confirm constraint. That constraint is SSHAGENTCONSTRAINCONFIRM RFC 9987 §5.2.7.2, which is what ssh-add -c sends. The call was replaced by a hard-coded true in...

russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

Summary The agent server in russh::keys::agent::server never calls Agent::confirm before signing with a key that was added with the confirm constraint. That constraint is SSHAGENTCONSTRAINCONFIRM RFC 9987 §5.2.7.2, which is what ssh-add -c sends. The call was replaced by a hard-coded true in...

GHSA-9WFM-JCJ8-JFV9 russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

Summary All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment. The SSH agent server that ships with russh russh::keys::agent::server::serve...

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

Summary All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment. The SSH agent server that ships with russh russh::keys::agent::server::serve...

GHSA-6VFX-W7Q3-42GQ AdminNeo SQLite Database-List Drop Arbitrary File Deletion

Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db values direct...

AdminNeo SQLite Database-List Drop Arbitrary File Deletion

Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db values direct...

GHSA-RX7M-WXWQ-VXR9 AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

Summary AdminNeo inserts the database server's version string into a tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes arbitrary code. Because the script tag already has ...

AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

Summary AdminNeo inserts the database server's version string into a tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes arbitrary code. Because the script tag already has ...

GHSA-WM25-49W3-5QRG AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery

Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token via network sniffing, log files, Referrer header, or XSS to instantly recove...

AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery

Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token via network sniffing, log files, Referrer header, or XSS to instantly recove...

CVE-2026-84753

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-84753 Write-up: https://abraxaslabs.tech/research/CVE-2026-84753 CVE-2026-84753 Mail Mint 1.31.0 - WPFunnels I am @abraxasnull. Loopback lab. The client is CVE-2026-84753-Abraxas-Labs.py. The function is name...

adaptix-serverless-c2

Adaptix Serverless C2 Serverless C2 transport plugin for AdaptixC2 v1.2 using AWS Lambda + DynamoDB as the relay infrastructure. Agent traffic appears as outbound HTTPS to AWS endpoints, requiring no inbound ports or public IPs on the C2 server. Architecture Kharon Agent target | | HTTPS GET/POST...

GitHub-gato

Gato Github Attack TOolkit Gato, or GitHub Attack Toolkit, is an enumeration and attack tool that allows both blue teamers and offensive security practitioners to evaluate the blast radius of a compromised personal access token within a GitHub organization. The tool also allows searching for and...

ricerca-tesi

thesis-research research resources for cve-2026-7228 Tools VirtualBox installation VirtualBox installation: https://www.virtualbox.org/wiki/Downloads Windows 11 ISO installation https://www.microsoft.com/it-it/software-download/windows11 Linux distro installation: lubuntu...

SOC235---Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515

EVENTID-197 field| Value ---|--- EventID| 197 Event Time| Nov, 09, 2023, 09:47 AM Rule| SOC235 - Atlassian Confluence Broken Access Control 0-Day CVE-2023-22515 Level| Security Analyst Hostname| Confluence Data Center Destination IP Address| 172.16.17.234 Source IP Address| 43.130.1.222 HTTP...

WebMirage

WebMirage Adversarial Images Hijack Web Agents from Visual Grounding to Browser Execution Wanjing Han, Levi Taiji Li, Mu Zhang, Yue Jiang, Guanhong Tao — University of Utah WebMirage is a red-teaming framework for vision-grounded web agents. It crafts localized adversarial perturbations on...

smokedmeat

SmokedMeat CI/CD Red Team Framework Like Metasploit, but for CI/CD pipelines. From the makers of thepoutine Build Pipeline SAST scanner at BoostSecurity Labs. Warning: This tool is for authorized security testing only. SmokedMeat exists because CI/CD pipeline threats are deeply underestimated...

CVE-2026-78804_Dolibarr_authenticated_SQL_injection

Dolibarr — Authenticated SQL Injection PoC SQL injection affecting the product stock management functionality through the seuilstockalerte parameter. Affected Versions Tested and confirmed on: 19.0.4 20.0.4 21.0.4 22.0.5 23.0.3 24.0.0 It was working until the report. Vulnerable Parameter...

CanaryTokenScanner

CanaryToken / HoneyToken Scanner Detect suspicious URLs including CanaryTokens inside Microsoft Office documents and PDFs. Supported formats: Office Open XML: .docx, .xlsx, .pptx .pdf .zip generic archives Why this exists CanaryTokens an HoneyTokens and other tracking or malicious URLs are often...

cve-2026-86060

CVE-2026-86060 — MikroTik RouterOS SSH Pre-Authentication Privilege Escalation to Full Administrative Control Field| Value ---|--- CVE| CVE-2026-86060 Product| MikroTik RouterOS SSH service Affected versions| RouterOS 6.x and 7.0.0 – 7.23.3 inclusive Fixed versions| RouterOS 7.23.4 and later...