djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

ImpactFor views that opt into state snapshots, the snapshot statejson embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned statejson in their page and return it in the reconnect mount frame to inject arbitrary view...

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

ImpactThe SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL which creates and mounts a LiveView as the victim and POST...

djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

Impactdjust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It setattrs a view attribute whose name is client-supplied field, gated only by: reject -prefixed names; reject a 14-entry denylist of...

CVE-2026-19598-PoC

CVE-2026-19598-PoC Proof of Concept for CVE-2026-19598 affecting Pods ⚠️ Security Research / Authorized Testing Only This repository contains a Proof of Concept for CVE-2026-19598. Affected Software WordPress Pods = 3.3.9 Vulnerability Unauthenticated privilege escalation. PoC The PoC demonstrates...

EUVD-2026-90908

Use after free in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifeti...

ReplicatedRandom

Node MWC1616 See README in node folder Java LCG Given a double generated from nextDouble of a java.util.Random, recreate a Random with the same state. This ReplicatedRandom can then be used to predict the future values of the original Random. Example: Random r = new Random; ReplicatedRandom rr =...

redxor

Linux Malware C2 'RedXOR' - an example detection This package serves as a demonstration of how Zeek can be used to detect the Linux backdoor "redXOR" using state based methods. References: Corelight blog...

CVE-2026-58415

The Apache HTTP Server is vulnerable to an information disclosure flaw in the mod_dav_fs module (versions 2.4.0 through 2.4.68 ) on all platforms. A remote attacker can perform a GET request directly to the internal .DAV state directory to read internal state files. This allows unauthorized acces...

CVE-2026-58415 Apache HTTP Server: mod_dav_fs property database read access

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

CVE-2026-58415

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

CVE-2026-58415 Apache HTTP Server: mod_dav_fs property database read access

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

EUVD-2026-90897

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

EUVD-2026-81601

vm2: Incomplete nodejs. symbol filtering lets sandbox override host WebStream state checks...

CVE-2026-17053 SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

CVE-2026-17053 SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

CVE-2026-40369

This is a rewrite and summary of VoidSec’s public technical analysis of CVE-2026-40369, with an added flowchart and defensive notes for my own understanding. All core technical details come from his research. I did not perform independent reverse engineering on this bug. CVE-2026-40369: Defensive...

CVE-2022-39197

CVE-2022-39197 CVE-2022-39197 "ID": "CVE-2022-39197", "STATE": "RESERVED"...

BIT-RABBITMQ-2026-67420 RabbitMQ OAuth credential refresh retains revoked runtime tags

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...

CVE-2026-84600

CVE-2026-84600 Shortcuts Impact: A malicious shortcut may be able to send messages without user confirmation. Description: An authorization issue was addressed with improved state management. Products: iOS and iPadOS, macOS, tvOS, visionOS, watchOS Fixed In: iOS 27 and iPadOS 27 macOS Golden Gate...

AtomicMemory

Reference FPGA Implementation Cyclone V This directory contains the reference RTL modules, precompiled FPGA images, and optional TCL test scripts for the atomic measurement–collapse primitive. This primitive is a CMOS-compatible hardware measurement–collapse mechanism that enforces single-read...