CVE-2026-29145-Tester

CVE-2026-29145 Testing Environment 📌 Overview This repository contains a proof-of-concept PoC environment designed to test for CVE-2026-29145. The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS CLIENTCERT implementation. When OCSP Online Certificate Status Protocol is...

reverse_ssh

Reverse SSH Art credit to https://www.instagram.com/smart.hedgehog.art/ Want to use SSH for reverse shells? Now you can. Manage and connect to reverse shells with native SSH syntax Dynamic, local and remote forwarding Native SCP and SFTP implementations for retrieving files from your targets Full...

pared

Pared Pared is a secure, high-performance Linux host security control plane and real-time administrative web console written in Crystal. Built on Kemal and Blueprint server-rendered components with SQLite3, a small vanilla-JS/WebSocket layer, and native libsystemd journal streaming, it unifies...

InstagramMutualFollowerChecker

Instagram Mutual Followers Checker A Node.js/Express web application that checks for mutual followers between 2 or more Instagram accounts by scraping their followers data. Features ✅ Check mutual followers between multiple Instagram accounts ✅ Works with public Instagram accounts and private...

AndroidAuto

Open Android Auto An open-source implementation of the Android Auto phone-side app. This app runs on your phone and projects to a car's head unit over USB, replacing Google's proprietary com.google.android.projection.gearhead APK. ⚠️ WORK IN PROGRESS This project is in early development. The...

GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the serve...

CVE-2026-29145-Tester

CVE-2026-29145 Testing Environment 📌 Overview This repository contains a proof-of-concept PoC environment designed to test for CVE-2026-29145. The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS CLIENTCERT implementation. When OCSP Online Certificate Status Protocol is...

CVE-2024-20674

CVE-2024-20674 This is my take at an exploit of the public CVE CVE-2024-20674 to achieve Kerberos mutual authentication bypass using a logic bug in the client-side handling of Kerberos U2U TGT-REP. This can be used for instance to serve arbitrary GPOs when spoofing the DC to a client, and take...

Node.js 26.5.0 HTTPS Agent PFX Client Identity Collision

Node.js versions 22.x, 24.x, and 26.x contain an HTTPS Agent connection reuse flaw that can reuse mutual TLS client identities across requests configured with different PFX client certificates. The supplied tool performs offline comparison of operator-reported versions against fixed releases...

Security Bulletin: Multiple Security Vulnerabilities in Netty affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-59902 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final,...

twint-utils

twint-utils These are utilizations of Twint. Please check out our collaboration guidelines to contribute to these. Mutuals Detector Mufos.py uses Twint to detect a given seed accounts mutual followers. It can be incorporated into other more elaborate pipelines for social networks or millieu...

Exploit for CVE-2026-97629

CVE-2026-97629 — nginx TLS session-ticket forgery client-cert...

Atlassian Confluence < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104520)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104520 advisory. - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final,...

CVE-2026-112936

A flaw was found in filelock. The ReadWriteLock component does not properly reject symbolic links shortcuts pointing to another file path when resolving lock paths. A local user with write permissions in the lock directory can exploit this vulnerability to redirect lock file creation and database...

Use of Multiple Resources with Duplicate Identifier

Overview Affected versions of this package are vulnerable to Use of Multiple Resources with Duplicate Identifier via trybreakexpiredlock and trybreakstalelock in api.py and lease.py, where an attacker with write access to the lock directory can replace a held lock file with a symlink pointing at ...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities (CVE-2026-75595, CVE-2026-75596, CVE-2026-62243)

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-75595 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final,...

CVE-2026-112936

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory t...

CVE-2026-112911 filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory, allowing that user to alter protocol...

CVE-2026-112911 filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory, allowing that user to alter protocol...

CVE-2026-112911

The filelock Python library contains a vulnerability where StrictSoftFileLock (versions 3.30.0 to 4.2.1) and SoftReadWriteLock (versions 4.0.0 to 4.2.1) can adopt a protocol directory created by another local user within a shared parent directory. This allows a malicious local user to alter the p...