PoC

PoC Una colección de códigos de prueba de concepto de DARKNAVY. CVE-2025-43300 Objetivo: iOS && macOS Versión: antes de iOS 18.6.2 && macOS 14.7.8 CVE-2025-6554 Objetivo: Chrome Renderer Versión: antes de 138.0.7204.96 CVE-2024-5274 Objetivo: Chrome Renderer Versión: antes de 125.0.6422.112 Entra...

mgo3-rce

MGO3 RCE Este repositorio contiene información sobre CVE-2026-19874. documentación demo en vídeo Cronología 2026-06-26: se descubre la vulnerabilidad 2026-06-26: primer contacto con Konami 2026-07-01: se notifica la vulnerabilidad a Konami 2026-08-04: Konami parchea la vulnerabilidad...

evilqr

Evil QR Toolkit demonstrating another approach of a QRLJacking attack, allowing to perform remote account takeover, through sign-in QR code phishing. It consists of a browser extension used by the attacker to extract the sign-in QR code and a server application, which retrieves the sign-in QR cod...

CVE-2026-82183

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...

EUVD-2026-69861

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...

CVE-2026-82183

The OAuth Single Sign On WordPress plugin, versions 6.25.0 through 7.0.0 , fails to verify the Steam OpenID identity assertion returned during its single sign-on flow. This allows an unauthenticated attacker to log in as an arbitrary non-administrator user or create new accounts. The root cause i...

CVE-2026-82183 OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...

CVE-2026-19874

A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kicknum" to determine the number of...

CVE-2026-19874

CVE-2026-19874 is a heap-based buffer overflow (CWE-122) in Konami's Metal Gear Online 3 (Steam AppID 287700, version 1.1.2.8 ), rated CVSS 9.1 Critical . The vulnerability resides in the parsing of Steam lobby metadata for the player-removal feature: the kick_num field is not validated against t...

EUVD-2026-64916

A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kicknum" to determine the number of...

CVE-2026-19874 Konami's Metal Gear Online 3 contains a heap-based buffer overflow

A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kicknum" to determine the number of...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/fence: Fixed an oops due to incorrect initialization of drmsched before its fini. Currently, amdgpu calls drmschedfini from the fence driver’s fini routine. Such a call is expected to occur only after the respective in...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Prevent NULL pointer dereferencing in steamrecv,sendreport It is possible for a malicious device to fail to submit a Feature Report. The HID Steam driver currently does not handle this situation and dereferences the...

Konami's Metal Gear Online 3 contains a heap-based buffer overflow

Overview Konami's Metal Gear Online 3 video game contains a heap-based buffer overflow that can be triggered by an input‑validation vulnerability that allows match hosts to remotely execute arbitrary code on lobby members' machines through specially crafted data. Description Metal Gear Online 3 i...

PT-2026-80897

A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kick num" to determine the number o...

Valve warns Steam hardware buyers: Expect fake delivery scams

Most of us are wise to phishing emails that don't contain much personal information. Generic "your account is suspended" messages usually get binned on sight. But what about the phishing emails that use your real name and address, and reference the specific product you bought last month? Even for...

FBI Arrests Florida Man in $220,000 Steam Crypto Theft Case

FBI agents arrested a Florida man accused of spreading Steam game malware that stole $220,000 in crypto, including $32,000 from a terminally ill cancer patient...

Siggen Backdoor Hits Windows Developers Via Infected Visual Studio Projects

Dr.Web details Siggen Windows backdoor that uses Steam for C2, steals credentials and crypto data and infects Visual Studio projects to spread among developers...

Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk

Since late 2025, malware has been spreading rapidly through the Steam Workshop, the gaming platform's built-in service for players to create and share custom content. The attackers are primarily targeting gamers in China and Russia, aiming to hijack their accounts. To pull this off, they are...

A week in security (June 8 – June 14)

Last week on Malwarebytes Labs: Stolen iPhones could soon be worth a lot less to thieves Fake verification pages are stealing Steam accounts from players Google can be liable for false AI Overviews, court rules VRChat says reported data breach never happened Children’s phones must block nude imag...