break-golf

break-golf 実行されるのではなく、証明された 暗号解析結果のためのボード。 チャレンジは、2つのワールドとあなたが証明しなければならないステートメントを固定する。あなたは、それらを区別する敵対者（adversary）と証明を書く。勝利は証明である。何も実行・サンプリング・再生はされず、また、それが有効かどうかを判断するために人間が提出物を読むこともない。 ステータス: 概念実証。 サイトは静的であり、提出はGitHub issueを開き、人間が判断する。背後にはまだLean検証器はない。 レイアウト パス| 内容 ---|---...

CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

UBUNTU-CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

EUVD-2026-68440

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

CVE-2026-6060-QUIC-Handshake-Amplification-via-Address-Validation-Bypass

CVE-2026-6060 – アドレス検証バイパスによるQUICハンドシェイク増幅 プログラムコード（Pythonシミュレーション） root@kitploit: quicserversim.py - Vulnerable QUIC server simulated handshake import socket def sendquicinitialconn, addr, serversalt: Respond with a large "server hello" without validating source address In real QUIC, the server...

CVE-2026-62243

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

dnsmasq-cve-2026

dnsmasq CVE-2026 QA 검증 도구 6가지 dnsmasq 취약점2026년 5월을 검증하는 자동화 블랙박스 도구입니다. 공격 패킷을 실제 DUT에 전송하고 PASS/FAIL을 보고합니다. 소스 코드 접근이 필요하지 않습니다. 빠른 시작 root@kitploit: 먼저 GUI를 통해 DUT DNS를 노트북의 WAN IP로 설정한 후: sudo python3 dnsmasqcveverify.py --laptop --dut --dut-pass 예시: sudo python3 dnsmasqcveverify.py --laptop...

cve-2026-47777

CVE-2026-47777 — Mastodon おすすめコレクションの認可バイパス 概要 私は、Mastodon の実験的な おすすめコレクション フェデレーションパイプラインに影響を与える 高重要度の認可バイパス 脆弱性を責任ある形で開示しました。 CVE ID： CVE-2026-47777 影響を受けるコンポーネント ActivityPub::VerifyFeaturedItemService 脆弱性の分類 CWE-345 — データの真正性の検証不足 CWE-863 — 不正確な認可 CVSS v3.1 スコア| ベクトル ---|--- 7.5（高）|...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

CVE-2025-26465

CVE-2025-26465 OpenSSH 클라이언트는 6.8p1 9.9p1포함 버전 사이에 논리 오류가 있어, VerifyHostKeyDNS 옵션이 활성화된 경우 능동적 MitM 공격에 취약해집니다. 이로 인해 악의적인 침입자가 클라이언트가 연결을 시도할 때 합법적인 서버로 위장할 수 있습니다. 이 탐지 방법은 어떻게 작동하나요? 이 템플릿은 다음 취약한 버전을 매칭합니다: root@kitploit: - "SSH-2.0-OpenSSH6.8p1" - "SSH-2.0-OpenSSH6.9p1" -...

pwnage24mtk

pwnage24mtk Exploit de certificados para dispositivos MTK. Hay una falla lógica en el proceso de verificación de certificados de MTK. Similar a CVE-2023-20696. Puede estar parcheado en junio. Aviso legal Este proyecto se utiliza únicamente para investigación. Asegúrate de obtener autorización ant...

Linux Distros Unpatched Vulnerability : CVE-2026-82662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2...

CVE-2026-51152

CVE-2026-51152 is a critical SSRF (CVSS 9.1) in QD (a HAR file processing tool by QD-Today), affecting versions 20220208 through 20250803 . The root cause is in Fetcher.build_request() in libs/fetcher.py, which constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL sc...

EUVD-2026-68648

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

PT-2026-83867

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.build request in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication...

PT-2026-83780

Name of the Vulnerable Software and Affected Versions Phison PS3111-S11 controller firmware affected versions not specified Description The firmware verifies RSA signatures using a public modulus embedded within the firmware image instead of using one anchored in immutable storage. This allows an...

Fedora 43 : curl (2026-f903f9ff11)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f903f9ff11 advisory. - fix proto-default skips SSH verification CVE-2026-12064 - fix wrong STARTTLS connection reuse CVE-2026-8286 - fix SASL double-free CVE-2026-8925 -...

TrustworthyRAG

Trustworthy RAG 検索拡張生成（RAG）システムにおける誤情報とナレッジポイズニングを検出するための評価エージェント。 概要 このプロジェクトは、統合された評価エージェント（Evaluation Agent）を備えた Trustworthy RAGフレームワークを実装しています。このエージェントは、3つの相補的な分析コンポーネントを用いてRAG応答の信頼性を評価します： NLI Verifier（NLI検証器） ：自然言語推論（BART-MNLI）による事実整合性チェック Poison Detector（ポイズン検出器）...