EUVD-2026-113774

Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 242 in version 10.02.002...

CVE-2026-110970 Lack of traffic encryption in Płatnik

Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 242 in version 10.02.002...

CVE-2026-110970

The software Płatnik is vulnerable to a Man-In-The-Middle (MitM) attack because it utilizes the unencrypted HTTP protocol to download updates, libraries, and support files. An attacker capable of intercepting the network traffic can obtain transmitted data and replace original files with maliciou...

CVE-2025-57392

CVE-2025-57392 🔒 Security Vulnerability Report Product: BenimPOS Desktop V3.0 Vulnerability Type: Insecure File Permissions Affected Components: BenimPOS.exe, unins000.exe, System.Data.SQLite.dll Vulnerability Class: CWE-276: Incorrect Default Permissions Proof of Concept by: Fatih Bülbül Test...

CVE-2023-32784-password-combinator-fixer

🔒 CVE-2023-32784 Password Combinator Fixer USEFUL FOR KEEPER HTB MACHINE After using the KeePass password dumper, some characters might be parsed as ● incorrectly. This script helps you identify the real characters and fix the issue efficiently. 🚀 🛠️ How to Use 1. Run the Script Execute the script...

PINKPANTHER

PINKPANTHER Brief Windows x64 kernel-mode handcrafted shellcode to replace primary access token of executing process with SYSTEM process token for Elevation of PrivilegeEoP. Supported OS Versions Windows 7/Windows Server 2008 R2 Build 7601 Windows 8/Windows Server 2012 Build 9200 Windows...

forensicscanner

This repository does not have a README...

assethook

AAssetHook AAssetHook is an LDPRELOAD-based hooking library that allows for replacing APK asset files dynamically without modifying an APK. It's also written in rust. It redirects asset file loads to a filepath on an Android device under /data/local/tmp/assethook/com.pkg.name. Needless to say, du...

PT-2026-133448

Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 242 in version 10.02.002...

decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

Summary decodeUriComponent takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. Details When...

npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs vulnerability discovered by ? in WordPress npm decode-uri-component versions = 0.5.0...

GHSA-QR28-FPJM-WQ7F decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

Summary decodeUriComponent takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. Details When...

invoker

Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...

CVE-2026-93851

Mattermost versions 11.9.x <= 11.9.1 , 11.8.x <= 11.8.5 , and 11.7.x

GHSA-6JP4-8V48-CC5V Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it

Summary The main Electrum server the client connects to is trusted with mempool "unconfirmed" transactions. This is documented design. 0 However now someone figured out a way to practically exploit it: - when the client broadcasts a new tx1, a malicious server can swallow it, - and update the...

EUVD-2026-110850

Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it...

CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

CVE-2026-118664

The decode-uri-component library (prior to version 0.5.1 ) is vulnerable to a Denial of Service (DoS) attack. The issue resides in the decodeUriComponent function within index.js, where a fallback mechanism (customDecodeURIComponent) handles malformed input by collecting distinct percent-encoded ...

CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...