http-protocol-exfil

http-protocol-exfil Use the HTTP protocol version to send a file bit by bit "HTTP/1.0" is a 0 and "HTTP/1.1" is a 1. It uses GET requests so the Blue Team would only see the requests to your IP address. However, it takes a long time to send bigger files, for example it needs 1 hour to send 200 KB...

CVE-2026-54433

CVE-2026-54433: XSS almacenado en correos de texto plano de Roundcube Este repositorio contiene una prueba de concepto configurable en Python para CVE-2026-54433 , una vulnerabilidad de cross-site scripting almacenado en el renderizador de correos de texto plano de Roundcube. Un remitente no...

espoofer

espoofer espoofer is an open-source testing tool to bypass SPF, DKIM, and DMARC authentication in email systems. It helps mail server administrators and penetration testers to check whether the target email server and client are vulnerable to email spoofing attacks or can be abused to send spoofi...

Mr.SIP

SIP Security, Attack and Audit Framework Mr.SIP is...

CVE-2026-45056 Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the user ID when decrypting an Olm-encrypted event containing t...

CVE-2026-45056

matrix-sdk-crypto (Rust crate, part of the Matrix Rust SDK) versions from 0.12.0 up to the fix are vulnerable to sender spoofing in end-to-end encrypted to-device messages. The root cause is a missing validation of the sender's user ID when decrypting an Olm-encrypted event that contains the send...

SpamChannel

SpamChannel Worker alojado en vivo en https://spamchannel.haxxx.workers.dev ACTUALIZACIÓN 13 de agosto de 2023: Dos días después de mi charla en DEFCON 31, MailChannels decidió silenciosamente exigir unDomain Lockdown Record para poder enviar correos electrónicos desde Cloudflare Workers, lo que...

voron-crypto

Voron 加密/协议库 — 评审请求 这是一个小型 E2EE 即时通讯项目的加密与消息协议核心，被单独提取出来供外部评审。它不是 完整产品——Android 客户端和部署配置被有意排除在外；这只是需要接受审查的部分。 这里包含什么 common/ — 库本身： e2ee/ — X3DH-lite（异步密钥协商）+ 其上的 Double Ratchet，基于 Curve25519/ChaCha20-Poly1305/Ed25519/HKDF 构建（JDK 提供的原语，该层没有任何手写实现）。 crypto/ — 对这些 JDK 原语的薄封装。 group/ — 通过 sender-key...

CVE-2026-28663

CVE-2026-28663 affects Android in the buildIntentSenderForUser function of LauncherAppsService.java . The root cause is a Background Activity Launch (BAL) bypass , allowing a malicious app to launch an activity from the background. This enables local privilege escalation with low privileges requi...

CVE-2026-53801

A symlink race condition in rsync's sender directory scanning logic allows a local attacker to bypass intended access restrictions. By replacing a symlink with a directory entry pointing outside the module root during an active scan, the attacker can force rsync to enumerate and transfer...

EvilAhenk

CVE-2026-6508 EvilAhenk 是 LiderAhenk 中央管理系统架构中的一个关键安全漏洞，允许所有客户端在彼此之间以 'root' 权限执行代码（未授权 RCE 与横向移动）。 系统如何工作 在 LiderAhenk 中，管理面板/中央服务器通过 XMPP 向客户端发送任务和策略消息。 中央管理面板通过授权用户连接到 XMPP 服务器， 客户端上的 ahenk agent 也连接到同一个 XMPP 基础设施， 中央向目标客户端发送诸如 EXECUTEPOLICY、EXECUTETASK 或 EXECUTESCRIPT 等消息， 客户端 agent 接收并执行这些消息...

CVE-2026-19862 JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...

CVE-2026-19862

JetFormBuilder WordPress plugin versions before 3.6.5.2 are vulnerable to unauthenticated email header injection via the Send Email action. The root cause is that the plugin does not validate or strip line breaks from address values sourced from submitted form fields before including them in outg...

SUSE CVE-2026-63435

Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode used a single Stringmatch and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle...

EUVD-2026-67141

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the...

Untrusted Sender DN Used as Format String in CMP Response Validation

...

ALPINE-CVE-2026-63073

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

AZL-97950 CVE-2026-63073 affecting package openssl for versions less than 3.3.7-6

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

CVE-2026-63073

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

CVE-2026-63073

OpenSSL CMP protocol validation contains a format string injection (CWE-134): ossl_cmp_msg_check_update() passes a peer-supplied sender distinguished name—after X509_NAME_oneline() conversion—directly as the format argument to ERR_raise_data(). A malicious or intercepted CMP endpoint can send a D...