229 matches found
Debug output exposes NIP-46 and NIP-60 credentials
Several NIP-46 and NIP-60 types used derived Debug implementations even though their fields contained credentials or decrypted application data. Formatting these values exposed NIP-46 connection secrets and request parameters, as well as NIP-60 private keys, Cashu bearer proofs, and quote...
CVE-2026-12966
The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with othe...
CVE-2026-52686
A flaw was found in pdns-recursor. This vulnerability allows a remote attacker to bypass DNSSEC Domain Name System Security Extensions validation. The flaw occurs because the system accepts wildcard expansion proofs NSEC/NSEC3 records without proper signature validation when the wildcard answer i...
SUSE CVE-2026-52686
The issue is a DNSSEC validation bypass where wildcard expansion proofs NSEC/NSEC3 records are accepted without signature validation when the wildcard answer is a CNAME or DNAME record...
CVE-2026-52686
The issue is a DNSSEC validation bypass where wildcard expansion proofs NSEC/NSEC3 records are accepted without signature validation when the wildcard answer is a CNAME or DNAME record...
EUVD-2026-47931
The issue is a DNSSEC validation bypass where wildcard expansion proofs NSEC/NSEC3 records are accepted without signature validation when the wildcard answer is a CNAME or DNAME record...
CVE-2026-52686
The CVE-2026-52686 entry describes a DNSSEC validation bypass in wildcard proof handling: when a wildcard expansion yields a CNAME or DNAME, NSEC/NSEC3 proofs are accepted without signature validation. This concerns the DNS resolver logic (noted in the PowerDNS advisory) and can bypass proper DNS...
exploitarium
https://discord.gg/WytKH65ZR join up for research, help, documen...
bak-exploitarium
https://discord.gg/WytKH65ZR join up for research, help, documen...
PYSEC-2026-284 Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
Impact When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs LDP-VCs, the result of verifying the presentation document.proof was not factored into the final verified value true/false on the presentation record. Below is an example result from verifying a JSON-LD...
zuixingongju-resources
zuixingongju-resources HW Red Team Arsenal – Resource fil...
GHSA-X845-2F78-7V36 Blocky DNSSEC validation bypass and validation-cache scope pollution
Summary Blocky accepts and caches forged DNS answers while dnssec.validate: true is enabled. The issue has two related exploit paths: 1. Basic DNSSEC validation bypass. If an untrusted upstream returns an unsigned positive answer for a DNSSEC-signed public domain, Blocky classifies the response a...
EUVD-2026-36119
Plonky3 is a toolkit for polynomial IOPs PIOPs. Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This issue has been patched in versions 0.4.3 and 0.5...
Smart_Contract_Researcher_POC
Smart Contract Security Research Portfolio hailthelord...
Kernel-Exploit-Dojo-425
Kernel-Exploit-Dojo-425 CTF kernel exploitation notes, PoCs,...
Kernel-Exploit-Dojo-243
Kernel-Exploit-Dojo-243 CTF kernel exploitation notes, PoCs,...
Kernel-Exploit-Dojo-239
Kernel-Exploit-Dojo-239 CTF kernel exploitation notes, PoCs,...
Kernel-Exploit-Dojo-248
Kernel-Exploit-Dojo-248 CTF kernel exploitation notes, PoCs,...