CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account Takeover Unauthenticated account takeover in Keycloak's reset-credentials flow. An attacker who knows only a username/email can reset any user's password — including admins — without ever receiving the verification email. ⚠️ Disclaimer —...

AVTECH DVR - Login Verification Code Bypass

AVTECH DVR products are vulnerable to verification code bypass just by entering the "login=quick" parameter to bypass verification code. id: CVE-2013-4982 info: name: AVTECH DVR - Login Verification Code Bypass author: ritikchaddha severity: low description: | AVTECH DVR products are vulnerable t...

epson-eh-tw5350-advisories

Epson EH-TW5350 — CVE-2021-43716, CVE-2021-43717, CVE-2021-43718 Three vulnerabilities discovered in the Epson EH-TW5350 projector firmware 150075647YWWV110 by team B-BEAM-BOB during the KITRI Best of the Best BoB program, 2021. CVE IDs were assigned by MITRE on 2021-12-21 but the records remaine...

otp-bot

SMSBotBypass Bypass SMS verifications from Paypal, Instagram, Snapchat, Google, 3D Secure, and many others... using a Discord Bot or the private API. It's really simple. Imagine that your friend got a Snapchat account, you try to reset his password using the sms system : he's gonna receive the sm...

GO-2026-6767 GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli...

Starlink-FI

Starlink User Terminal Modchip This repository accompanies the talk titled "Glitched on Earth by Humans: A Black-Box Security Evaluation of the SpaceX Starlink User Terminal". A slide deck is available here, a recording of the talk should be available soon. The talk covers how we managed to execu...

CVE-2026-85248

CVE-2026-85248 — camel-pqc: concurrent Signature race signature verification bypass Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the PQC producer held a singlejava.security.Signature instance and used it for every exchange without synchronization. Signature is...

CVE-2026-97629

A flaw was found in nginx. Under specific configurations where shared SSL session caching is enabled without explicit session ticket key rotation, a remote unauthenticated attacker may be able to forge client Secure Sockets Layer SSL sessions. This flaw allows an attacker to bypass client...

python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

A flaw was found in Python. When establishing secure connections using the SSLContext.wrapbio function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rathe...

Important: Red Hat Security Advisory: python3 security update

An update for python3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Exploit for CVE-2026-85248

CVE-2026-85248 — camel-pqc: concurrent Signature race signa...

CVE-2026-85248 Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance

Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. The producer held a single java.security.Signature instance and used it for...

CVE-2026-85248 Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance

Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. The producer held a single java.security.Signature instance and used it for...

CVE-2026-85248

The Apache Camel PQC component is vulnerable to a race condition due to improper synchronization of a shared java.security.Signature instance. Because the Signature class is stateful and not thread-safe, concurrent exchanges can cause update() and verify() calls to interleave. This results in non...

CVE-2020-10759-poc

Summary Exploits CVE-2020-10759 - fwupd PGP signature verification bypass. See https://github.com/justinsteven/advisories/blob/master/2020fwupddanglings3bucketandCVE-2020-10759signatureverificationbypass.md for more details. Requirements Note: You need to install python3-gpg from your OS vendor...

ALSA-2026:85239 Important: python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Important: python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2026-102946

A flaw was found in joserfc. When processing a JSON Web Signature JWS in General JSON Serialization format, the library improperly treats tokens containing an empty signatures list as valid. A remote attacker without a valid signing key can exploit this flaw by submitting an arbitrary payload wit...

SMSBotBypass

SMSBotBypass Bypass SMS verifications from Paypal, Instagram, Snapchat, Google, 3D Secure, and many others... using a Discord Bot or the private API. It's really simple. Imagine that your friend got a Snapchat account, you try to reset his password using the sms system : he's gonna receive the sm...

Amazon Linux 2023 : gnutls, gnutls-c++, gnutls-dane (ALAS2023-2026-3238)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3238 advisory. A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate. CVE-2026-88647 Tenable has...