objection

📱objection - Runtime Mobile Exploration objection is a runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without needing a jailbreak. Supports both iOS and Android. Inspect and interact with container file systems...

frida-ssl-bypass

🔓 Frida SSL Pinning Bypass Universal SSL/TLS Certificate Pinning Bypass for Android Author: Danieldev GitHub: @danieldev23 | Telegram: @zadevz A comprehensive Frida toolkit that defeats SSL pinning on any Android app — covering both Java and Native layers, from standard OkHttp pinning to Facebook...

frida

frida This repository contains various Frida scripts for Android application penetration testing. I created this project to demonstrate the capabilities of the Frida dynamic-analysis framework. You can read my "Introduction to Frida" blog post on Medium, where I'm explaining how to use Frida with...

ssl-kill-switch3

SSL Kill Switch 3 Next Generation of iOS Tweak SSLKillSwitch https://github.com/nabla-c0d3/ssl-kill-switch2 with much more functionality! What's New? FIXED Fishhook Support iOS 15+, ARM64/ARM64e, so that you can hook in non-jailbreak era FIXED Rootless Support iOS 15+, ARM64/ARM64e, happy rootles...

MobileApp-Pentest-Cheatsheet

Mobile Application Penetration Testing Cheat Sheet The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics and checklist, which is mapped OWASP Mobile Risk Top 10 for conducting pentest. Mobil...

Apepe

📲 Apepe 📲 Enumerate information from an app based on the APK file 🕵️ What is Apepe? 🕵️ Apepe is a project developed to help to capture informations from a Android app through his APK file. It can be used to extract the content, get app settings, suggest SSL Pinning bypass based on the app detected...

Anthropic Claude Code < 2.1.179 Plugin Hash Pinning Bypass (CVE-2026-86063)

The version of Anthropic Claude Code installed on the remote host is prior to 2.1.179. It is, therefore, affected by a hash pinning bypass vulnerability: - The plugin install flow in Claude Code checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting...

CVE-2026-87866

A flaw in curl allows a malicious server to bypass public key pinning when the application is built with the wolfSSL backend. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the certificate—tricked by a manipulated validity length field —extracts an...

CVE-2026-87866

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...

CVE-2026-87866

A flaw was found in curl. This vulnerability allows a malicious server to bypass public key pinning when curl is built with the wolfSSL backend. By presenting a specially crafted certificate with a manipulated validity length field, the attacker can trick curl into improperly re-parsing the...

curl: curl: wolfSSL public-key pinning bypass

A flaw was found in curl. This vulnerability allows a malicious server to bypass public key pinning when curl is built with the wolfSSL backend. By presenting a specially crafted certificate with a manipulated validity length field, the attacker can trick curl into improperly re-parsing the...

CURL-CVE-2026-87866 wolfSSL public-key pinning bypass

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...

Fedora 44 : curl (2026-a06b828d65)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a06b828d65 advisory. - Fix incomplete mTLS config matching in conn reuse CVE-2026-8932 - Fix OpenLDAP SASL authentication bypass CVE-2026-13608 - Fix OpenSSL pinning...

objection

📱objection - Exploración Móvil en Tiempo de Ejecución objection es un kit de herramientas de exploración móvil en tiempo de ejecución, impulsado por Frida, diseñado para ayudarte a evaluar la postura de seguridad de tus aplicaciones móviles, sin necesidad de un jailbreak. Soporta tanto iOS como...

CentOS Linux 8.5 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1789899690)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1789899690 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790154364)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790154364 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:4048-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4048-1 advisory. - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass bsc1277476. -...

CVE-2026-81871

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

PT-2026-94032

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions prior to 0.21.0 Description The exporters/otlp/otlplog/otlploggrpc package loads TLS settings from environment variables into cfg.tlsCfg using the loadEnvTLS function, but the newGRPCDialOptions function fails to appl...

Security update for curl

This update for curl fixes the following issues: CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass bsc1277476. CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free bsc1277479. CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated...