openssl

Welcome to the OpenSSL Project !openssl logowww.openssl.org !github actions ci badgegithub actions ci OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit for the Transport Layer Security TLS, formerly SSL, Datagram TLS DTLS, and QUIC protocols. The protocol implementations ar...

CryKeX

Properties: Cross-platform Minimalism Simplicity Interactivity Compatibility/Portability Application Independable Process Wrapping Process Injection Dependencies: Unix - should work on any Unix-based OS BASH - the whole script root privileges optional Limitations: AES and RSA keys only Fails most...

CVE-2026-0073

ADB TLS Auth Bypass Exploit CVE-2026-0073 An automated network scanner and exploitation tool for CVE-2026-0073 , a vulnerability in the Android Debug Bridge daemon adbd that allows unauthenticated Remote Code Execution RCE and interactive shell access via Wireless Debugging. This tool is...

tp-link-decrypt

NOTE as of 5 October 2025 this project is now depreciated. Nate Robbins has kindly taken over and added switch decryption - https://github.com/robbins/tp-link-decrypt ====================================================================================================== If you found this tool...

ROCA-attack-on-vulnerability-CVE-2017-15361

ROCA-attack-on-vulnerability-CVE-2017-15361 This repository contains the thesis developed for my bachelor's degree in Mathematical Engineering at Polytechnic of Turin. It's a script based on python and sage. The goal of the script is to generate an RSA key, evaluete if it's vulnerable by the ROCA...

keypair

keypair Generate a RSA PEM key pair from pure JS Usage var keypair = require'keypair'; var pair = keypair; console.logpair; outputs $ node example.js public: '-----BEGIN RSA PUBLIC...

rocacheck

rocacheck Package rocacheck is a Go implementation of the key fingerprint algorithm that checks if an RSA key was generated by broken Infineon code and is vulnerable to factorization via the Return of Coppersmith's Attack ROCA / CVE-2017-15361...

CLEANSTART-2024-BC33765 remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0

Security vulnerability affects the putty package. A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0...

CVE-2026-29000---pac4j-jwt-Authentication-Bypass-PoC

CVE-2026-29000 - pac4j-jwt Authentication Bypass PoC Note: This is not my original work. I am keeping this here for a reference. Working methodology: python3 exploit.py http://IP:PORT Fetching JWKS... + Got RSA public key kid: enc-key-1 Crafted PlainJWT with sub=admin, role=ROLEADMIN + Forged JWE...

heartbleed-tools

OpenSSL Heartbleed CVE-2014-0160 vulnerability scanner, data miner and RSA key-restore tools. Author: Einar Otto Stangvik / @einaros / https://hacking.ventures Since the cat is long since out of the bag, and others have begun publishing their tools, I'm putting mine out there too. Hopefully this...

jwt-spoof-tool

jwt-spoof-tool Tool Description : I made this tool for learning purpose and automating jwt token hijacking without depending on using burpsuite the code is well documented and easy to follow Based on CVE-2018-0114 The Vulnerabilty happend because in backend the server check jwk object embeded...

GHSA-H6CR-WJV9-3CPP Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

Summary BigInteger.prototype.modInverse in node-forge's bundled jsbn library enters an infinite loop when the value or the modulus is negative, for example when a negative public exponent is passed to forge.pki.rsa.generateKeyPair. This is an incomplete fix of CVE-2026-33891 GHSA-5m6q-g25r-mvwx,...

EUVD-2026-113392

joserfc: Unbounded JWE General JSON recipients Array Leads to CPU Exhaustion DoS via Repeated RSA Private-Key Decryption...

Linux Distros Unpatched Vulnerability : CVE-2026-119283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjso...

UBUNTU-CVE-2026-119283

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjson accepts a JWE General JSON Serialization recipients array without a count limit and calls decryptcek for every entry. An unauthenticate...

CVE-2026-119283

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjson accepts a JWE General JSON Serialization recipients array without a count limit and calls decryptcek for every entry. An unauthenticate...

DEBIAN-CVE-2026-119283

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjson accepts a JWE General JSON Serialization recipients array without a count limit and calls decryptcek for every entry. An unauthenticate...

CVE-2026-119283

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjson accepts a JWE General JSON Serialization recipients array without a count limit and calls decryptcek for every entry. An unauthenticate...

CVE-2026-118778 Forge: TLS client crash when the server sends no certificate

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client...

CVE-2026-118778

The Forge (also known as node-forge ) JavaScript TLS implementation is vulnerable to a crash in versions prior to 1.4.1 . The flaw exists in the TLS client when using forge.tls.createConnection(), c.session.serverCertificate, and RSA key exchange . Specifically, the client checks the incorrect pr...