gsscred-move-uaf

GSSCred-move-uaf The com.apple.GSSCred XPC service, which runs as root on macOS and iOS, does not properly implement the "move" command, leading to a use-after-free condition in the doMove function. The GSSCred service can be reached from within the default application sandbox on iOS. This progra...

CVE-2026-108895

A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MACaddr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the...

CVE-2026-108896

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument 6rdprefix/6rdprefixlen results in os command injection. The attack can be launched remotely. The exploit has been made public and...

CVE-2026-108898

A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. The vendor was...

CVE-2026-108897

A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is possible to be carried out remotely. The...

CVE-2026-103529

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's install method which will then be executed upon installation, enabling remote...

osmedeus

Osmedeus Osmedeus - A Modern Orchestration Engine for Security What is Osmedeus? Osmedeus is a security focused declarative orchestration engine that simplifies complex workflow automation into auditable YAML definitions, complete with encrypted data handling, secure credential management, and...

CVE-2026-20700

dyld-signing-oracle-poc A controlled exploration of dyld's page-in linking and chained fixup machinery as a PAC signing oracle, in the context of CVE-2026-20700. On arm64e, every function pointer is hardware-authenticated. The goal here is to show that dyld itself can be directed — through a...

CVE-2026-108899

The tobychui zoraxy software (up to version 3.3.4 ) is vulnerable to improper authorization within the Path Exception Matcher component. The flaw exists in the handleBasicAuth function located in mod/dynamicproxy/authProviders.go, where manipulation of the PathPrefix argument allows for unauthori...

EUVD-2026-97488

A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack...

CVE-2026-108899 tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization

A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack...

pico-usb-wifi

= pico-usb-wifi :toc: macro :toclevels: 3 :idprefix: :idseparator: - pico-usb-wifi is firmware for the Raspberry Pi Pico W that turns it into a driverless USB Wi-Fi adapter, enumerating as a USB CDC-NCM device. :figure-caption: AI Slop .pico-usb-wifi Diagram...

CVE-2022-20474

CVE-2022-20474 Analysis — Self-changed Bundle under LazyValue Preface A friendly reminder: before reading this article, you should have a basic understanding of Bundle Mismatch vulnerabilities. If you haven't read the following references, it is recommended to read them first: 1. Bundle Feng Shui...

CVE-2022-29885

CVE-2022-29885 The tool is only used for security research. It is prohibited to use the tool to launch illegal attacks, and the user is responsible for the consequences 工具仅用于安全研究以及内部自查，禁止使用工具发起非法攻击，造成的后果使用者负责 Introduce Apache Tomcat DoS CVE-2022-29885 Exploit Denial of Service in EncryptIntercept...

RF-CHAOS

RF CHAOS - Chaos via BLE / BT / WiFi / NFC / Etc via Android Phones RF CHAOS is an Android-Native WiFi, Bluetooth, BLE, and NFC scanner, logger, and explotation tool. Created ByScramblr AKA @notdan AKA alotofnamesyoudontknow ℹ️ If you're itching to get the APK now, compiled releases are...

SecureAI-Scan

SecureAI-Scan An offline scanner for the code that talks to LLMs, MCP servers, vector stores, and Agent Skills. It finds prompt injection, MCP command injection and path traversal, RAG data leaks, and poisoned skills, and it proves each finding with a source → sink trace through your real imports...

bulk_extractor

bulkextractor is a high-performance digital forensics exploitation tool. It is a "get evidence" button that rapidly scans any kind of input disk images, files, directories of files, etc and extracts structured information such as email addresses, credit card numbers, JPEGs and JSON snippets witho...

CVE-2023-28252

Since February 2022 was reported a new ransomware that appears to be using a Windows 0-day vulnerability, according to the research conducted by Trend Micro. More information about this ransomware can be found at this link. According to analysis by Kaspersky, the Nokoyawa ransomware group has use...

weblogic-XMLDecoder

This software is for learning and communication only, any illegal use is prohibited Weblogic-XMLDecoder-GUI CVE-2017-10352 A Python GUI experimental tool. Its main function is to exploit the deserialization vulnerability caused by Weblogic XMLDecoder. Developed for learning the Python tkinter...

CVE-2022-32988

CVE-2022-32988 Affected products We have not yet tested Asus models other than those listed. However we suspect it may also work on other models with the same firmware version. DSL-N14UB1 V.1.1.2.3805 Overview In router Asus DSL-N14U-B1 1.1.2.3805 was discovered to contain a stored cross-site...