Decoupling Is a Necessity: Transformation-Agnostic Decompiled Code Recovery under Optimization and Obfuscation

Reverse engineering is essential for software security analysis and vulnerability detection. Decompilation, the process of lifting binaries to high-level pseudocode, is central to this task. However, production binaries are hostile environments: aggressive compiler optimizations and adversarial...

Low-ASR Backdoors: Exploiting Attack Success Rate Reduction and Attacker-Defender Asymmetry

Backdoor attacks are among the most effective and stealthy attacks in deep learning. Existing attacks and defenses are largely designed and evaluated under the assumption that successful backdoors exhibit high Attack Success Rates ASRs. In this paper, we show that this assumption creates a...

CVE-2026-12587 Embedded credentials in Virtuagym

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-12587

CVE-2026-12587 affects the Virtuagym application, where a static, hard-coded badge_number parameter is used as the HMAC private key for generating physical access QR codes. This value is exposed via the API endpoint /club/_id_club_/member/_id_member_/resamania_qr_info, and the cryptographic logic...

MSC-2026-11500

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

CVE-2023-44487

HTTP/2 Rapid Reset: CVE-2023-44487 Descrizione Questo repository contiene il codice proof-of-concept PoC per la vulnerabilità HTTP/2 Rapid Reset identificata come CVE-2023-44487. Panoramica della vulnerabilità ID CVE : CVE-2023-44487 Impatto : Denial of Service DoS Protocolli interessati : HTTP/2...

CVE-2026-12587: Use of Hard-coded Credentials

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

Linux Distros Unpatched Vulnerability : CVE-2026-16434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098861)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098861 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: fix iprtbug race in icmproutelookup reverse path icmproutelookup performs multiple route...

MAL-2026-14509 Malicious code in r4wk-book (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5cbca68751eb879140f7c896a0dc3c324e9f4dbc8a1651b38b246b299ba4eb On npm install, the package's postinstall hook runs node.worker.js, which detaches a background child, waits a jittered delay, and opens a TCP socket...

CVE-2026-16434

Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...

CVE-2026-16434 Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass

Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...

CVE-2026-16434 Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass

Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...

CVE-2026-16434

Adminer versions 4.6.0 through 5.5.0 contain an incomplete fix for a prior X-Forwarded-Prefix header injection (GHSA-8478-xrj3-h9c2). The validation guard in bootstrap.inc.php uses the regex ^/[^/] to reject malicious prefixes, which blocks //evil.com but allows values like /\evil.com where the s...

EUVD-2026-65195

Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...

EulerOS Virtualization 2.13.1 : rsync (EulerOS-SA-2026-3196)

According to the versions of the rsync packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list...

JetBrains TeamCity < 2019.1.5 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2019.1.5. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages. CVE-2020-7908 - In JetBrains TeamCity before 2019.1.5, some...

JetBrains TeamCity < 2019.1.4 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2019.1.4. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution. CVE-2019-18364 - In JetBrains TeamCity...

CVE-2026-76835

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

CVE-2026-76835

OAuth2 Proxy versions 7.15.2 through 7.15.4 are affected by an authentication bypass via the X-Forwarded-Uri header. When reverse-proxy mode is enabled without trusted_proxy_ip configured, buildTrustedProxyNetSet falls back to 0.0.0.0/0 and ::/0, treating every client as a trusted proxy. An unaut...