ResetNightmare

ResetNightmare Herramienta de prueba de concepto POC para ResetNightmare CVE-2026-27912. ResetNightmare es una falla de validación en el protocolo Kerberos de cambio de contraseña que permite restablecer la contraseña de cualquier cuenta de usuario/equipo objetivo, sin conocer la actual. El ataqu...

ownCloud Guests - User Enumeration

ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/email/token, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication. id:...

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

cve-2025-53779-kerberos_bypass_reproduction

CVE-2025-53779：Microsoft Windows Kerberos 身份验证绕过 CVSS 评分： 9.8（严重） 状态： 已发现在野积极利用 披露： 微软 2025 年 8 月补丁星期二（零日漏洞） 概述 CVE-2025-53779 是 Microsoft Windows Kerberos 协议实现中的一个严重身份验证绕过漏洞。未经身份验证的攻击者可利用该缺陷完全绕过 Kerberos 身份验证，冒充包括域管理员在内的任何域用户，而无需持有有效凭据或任何加密材料。 微软将该漏洞评为 CVSS...

AAMVA-PDF417-Vulnerability-Research

PDF417 身份证验证漏洞研究 概述 本仓库包含全面的安全研究，记录了影响政府身份证明、企业解决方案和消费类应用的 AAMVA 标准 PDF417 条码验证系统中的关键漏洞。研究包括一个功能完整的概念验证（PoC），展示了身份证验证系统在处理驾照条码时的系统性缺陷。 重要提示： 此代码仅供安全研究使用。有关允许的用途，请参阅 LICENSE.md 文件。 研究伦理声明 本研究遵循以下原则： 协调漏洞披露原则 120 天以上的厂商通知期（超过标准 90 天） 仅使用合成数据（无真实个人信息） 教育/防御性安全目的 ISO/IEC 29147 漏洞披露标准 通过 MITRE CVE 计划与...

CVE-2026-65381

A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious app may be able to break out of its sandbox...

EUVD-2026-77939

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...

CVE-2026-84618

A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...

CVE-2026-84618

CVE-2026-84618 is a permissions issue in Apple macOS addressed with improved validation. An app may be able to access sensitive user data . The vulnerability is fixed in macOS Golden Gate 27 , macOS Sequoia 15.8 , and macOS Tahoe 26.7 . The CVSS 3.1 base score is 5.5 (Medium) with a local attack ...

EUVD-2026-78020

A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to read arbitrary files...

CVE-2026-43692

A validation issue in macOS (fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7) was addressed through improved input sanitization . A remote user may trigger unexpected app termination or arbitrary code execution , with a CVSS 3.1 score of 8.8 (HIGH) requiring user interacti...

Astra Linux – Vulnerability in Netty

The Netty project is an event-driven, asynchronous network application framework. Starting from version 4.1.83.Final and before 4.1.86.Final, when calling DefaultHttpHeaders.set with an iterator of values, header value validation was not performed. This allowed malicious header values in the...

Astra Linux – Vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by an improper input validation vulnerability, which may lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a specially crafted file...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the X.Org X server’s validation of XKB key type requests. A local attacker could send a specially crafted request to the X server, leading to a vulnerability where out-of-bounds memory access could occur. This could result in the disclosure of sensitive information or cau...

Astra Linux – Vulnerability in Apache2

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58...

Astra Linux – Vulnerability in qtdeclarative-opensource-src

Unlimited or throttled resource allocation, improper validation of the specified quantity in input parameters, and vulnerabilities in The Qt Company’s Qt framework on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64-bit, and 32-bit platforms can lead to excessive resource allocation. This issue...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain SAUCE patches that fail to validate invalid sizes of the name field in AppAmor notification responses. This bug can be triggered by an unprivileged local user, and it could lead to the processing of malicious responses...

CVE-2026-90569 linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting

A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0. This vulnerability affects the function AdminTopicController.validate of the file litemall-vue/src/views/items/topic/index.vue of the component Admin Topic Handler. This manipulation causes cross site scripting. The attack may ...

CVE-2026-85394

python-jose through version 3.5.0 contains an algorithm confusion vulnerability in its HMAC key validation logic. The library fails to properly reject DER-encoded public keys that lack PEM armor or SSH prefixes, allowing them to be accepted as HMAC secrets. An attacker who possesses the service's...

CVE-2026-80465

A vulnerability has been identified in Mendix SAML Mendix 10 compatible All versions V4.2.3, Mendix SAML Mendix 11 compatible All versions V4.2.3, Mendix SAML Mendix 9.24 compatible All versions V3.6.27. Affected versions of the module do not properly validate the SAML response signature. This...