CVE-2026-42978-PoC-Research

CVE-2026-42978 Модуль Windows Push Notifications для AI Security Tool Экосистема безопасности нового поколения на базе ИИ, мультипротокольный терминал и набор автономных агентов Сайт · Документация продукта · Хост-приложение · Чат сообщества Навигация по сайту: Главная · Обновления · Загрузки ·...

browser-identity-attacks-matrix

Matrice des attaques navigateur et identité Ce dépôt est une collection de techniques d'attaque ciblant le navigateur et l'identité, couvrant les applications SaaS, les attaques basées sur le navigateur, les fournisseurs d'identité et l'hameçonnage. Il est conçu comme une ressource pour les...

talisman

Talisman A tool to detect and prevent secrets from getting checked in Table of Contents What is Talisman? Installation Install onto path recommended approach Installation as a global hook template Configuring a project Using with hook frameworks Pre-commit Husky Directly invoking talisman Upgradi...

CVE-2026-3854-lab

Flagship Lab 001: от push-опций Git к RCE Локальная Learning Lab и Research Lab, вдохновлённые публично задокументированными концепциями уязвимости, лежащими в основе CVE-2026-3854. Обе части используют реальные аутентифицированные push-операции Git против ForgeDock — вымышленного Git-сервера;...

terminalphone

TerminalPhone Communication vocale push-to-talk chiffrée via des services cachés Tor. TerminalPhone est un script Bash unique et autonome qui fournit une communication vocale et textuelle anonyme et chiffrée de bout en bout entre deux ou plusieurs parties sur le réseau Tor. Il fonctionne comme un...

GitBackdorizer

GitBackdorizer BÊTA GitBackdorizer est une preuve de concept, entièrement inspirée de la conférence 50 ton of backdoors d'Ulisses Castro, qui abuse du manque d'attention des utilisateurs pour voler les identifiants d'accès Git. Fonctionnement GitBackdorizer se compose de trois éléments : le...

authelia

!OpenSSF Scorecardhttps://shieldcn.dev/badge/dynamic/json.svg?url=https://img.shields.io/ossf-scorecard/github.com/authelia/authelia.json&query=$.message&label=openssf%20scorecard&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmc...

CVE-2026-42978-PoC-Research

CVE-2026-42978 PoC & Recherche — Use-After-Free dans les notifications push Windows Condition de concurrence dans le service de notifications push Windows WpnService qui s'exécute en tant que NT AUTHORITY\SYSTEM. Un attaquant ayant un accès local peut déclencher une use-after-free lors de l'arrêt...

PasswordPusher v1.45.11-v2.9.5 - Unauthenticated Anonymous Push Deletion via Ownership Bypass

PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous pushes due to a nil==nil ownership-check bypass CWE-863. The deletion guard evaluates @push.user == currentuser || @push.deletablebyviewer. For anonymous pushes, @push.user is nil; for unauthenticated requests,...

ghe-push-option-rce-scanner

CVE-2026-3854 — RCE в GitHub Enterprise Server через инъекцию push-опций Обзор Некорректная нейтрализация значений push-опций в GHE. Злоумышленник с доступом на push получает RCE на инстансе. Поле| Значение ---|--- CVE| CVE-2026-3854 Критичность| CRITICAL Продукт| GitHub Enterprise Server CISA KE...

mythic_telegram_profile

Mythic용 Telegram C2 프로필 Telegram은 Athena 및 Apollo 에이전트를 위한 Mythic C2 프로필을 제공합니다. 이는 Telegram 비공개 봇 간 메시지를 전송 수단으로 사용하고, Mythic의 Push C2 gRPC 서비스를 컨트롤러 브리지로 사용합니다. 아키텍처 Athena 또는 Apollo 에이전트 봇 Telegram Bot API 컨트롤러 봇 Telegram C2 서비스 Mythic 실행 중인 각 에이전트는 자체 Bot API 토큰을 사용합니다. C2 서비스는 하나의 컨트롤러 봇 토큰을...

hermes-the-messenger

Hermes the messenger PoC для обеспечения персистентности через push-уведомления в Windows Более подробные технические детали и описание читайте в нашем блоге: https://www.persistent-security.net/post/beacon-on-demand-abusing-push-notifications-for-persistence Использование Прежде всего вам нужно...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: tigera-operator, cert-manager-cmctl, maru, kargo, rancher-helm, cluster-api-helm-controller, gitness, helm-set-status, k8sgpt, k9s, manifest-tool, kyverno-notation-aws, helm-mapkubeapis, flux-helm-controller, kube-arangodb, opentofu, xeol, helm-push...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: tigera-operator, cert-manager-cmctl, maru, kargo, rancher-helm, cluster-api-helm-controller, gitness, helm-set-status, k8sgpt, k9s, manifest-tool, kyverno-notation-aws, helm-mapkubeapis, flux-helm-controller, kube-arangodb, opentofu, xeol, helm-push...

PrivExchange

PrivExchange Outils POC accompagnant le blog Abusing Exchange: One API call away from Domain Admin. Prérequis Ces outils nécessitent impacket. Vous pouvez l'installer via pip avec pip install impacket, mais il est recommandé d'utiliser la dernière version depuis GitHub. privexchange.py Cet outil ...

Exploit for CVE-2026-94541

CVE-2026-94541 — WPMobile.App Table of Contents - Execut...

CVE-2026-94541

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacke...

EUVD-2026-91334

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacke...

CVE-2026-94541 WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacke...

CVE-2026-94541

The WPMobile.App – Android and iOS App Builder plugin for WordPress (slug wpappninja) is vulnerable to an authorization bypass in all versions up to and including 11.82 . The flaw stems from a failure to verify user permissions when handling the wpapp_category[] parameter. If the plugin's mail-to...