TrustworthyRAG

Trustworthy RAG 검색 증강 생성Retrieval-Augmented Generation 시스템에서 오정보misinformation와 지식 중독knowledge poisoning을 탐지하는 평가 에이전트Evaluation Agent입니다. 개요 이 프로젝트는 세 가지 상호 보완적 분석 구성 요소를 사용하여 RAG 응답의 신뢰성을 평가하는 통합 평가 에이전트Evaluation Agent 를 갖춘 신뢰할 수 있는 RAG 프레임워크Trustworthy RAG Framework 를 구현합니다: NLI 검증기NLI Verifi...

CVE-2021-34646

CVE-2021-34646 PoC 이 취약점 세부 정보는 NVD 제공 WooCommerce용 Booster WordPress 플러그인의 5.4.3 이하 모든 버전은 /includes/class-wcj-emails-verification.php 파일에 있는 resetandmailactivationlink 함수의 무작위 토큰 생성 취약점으로 인해 processemailverification 함수를 통한 인증 우회에 취약합니다. 이로 인해 공격자는 사용자를 사칭하여 관리자 계정을 포함한 임의의 계정에 대한 이메일 주소 확인을...

CurveBall

CurveBall CVE-2020-0601 - PoC CVE-2020-0601: 別名CurveBallまたはChainOffFoolsとしても知られ、Microsoft CryptoApi（具体的にはCrypt32.dll）における脆弱性であり、証明書の楕円曲線署名（ECDSA）が正しく検証されないものです。 この問題を非常に明確に説明している素晴らしいブログ記事がこちらにあります。 これは教育および研究目的でのみ使用してください！ 使い方 コンソールアプリケーションに楕円曲線証明書のパスを指定します。 root@kitploit: CurveBall.exe...

Starlink-FI

스타링크 사용자 단말기 모드칩 이 저장소는 "Glitched on Earth by Humans: A Black-Box Security Evaluation of the SpaceX Starlink User Terminal"라는 제목의 발표 자료와 함께 제공됩니다. 슬라이드 자료는 여기에서 확인할 수 있으며, 발표 녹화 영상도 곧 공개될 예정입니다. 이 발표는 커스텀 모드칩을 사용하여 전압 오류 주입voltage fault injection을 수행함으로써 스타링크 사용자 단말기에서 임의 코드를 실행한 방법을 다룹니다. 이 모드칩은...

SSH-account-enumeration-verification-script

SSH-account-enumeration-verification-script SSH 계정 열거 확인 스크립트CVE-2018-15473...

CVE-2019-0708-test

CVE-2019-0708-test CVE-2019-0708 Проверка уязвимости на C Язык программирования: C Среда разработки: Visual Studio 2012 Платформа: .Net Framework 4.5 Программа на C для проверки уязвимости CVE-2019-0708 Использует 0708detector.exe, выпущенный командой 360Vulcan Team компании 360...

CVE-2026-25250

🕷️ CVE-2026-25250: Improper Trusted Bootloader Chain Validation A Microsoft-signed third-party bootloader that loads a secondary EFI binary with no signature or integrity verification, collapsing the Secure Boot chain of trust from within. 📑 Table of Contents Research Context Official References...

kernel-c-to-rust-spike

Kernel C-to-Rust hardening spike: UVC descriptor parser Can a security-critical Linux kernel C parser be hardened by rewriting it in Rust, with the rewrite shown equivalent to the original and then formally verified? This spike runs the full loop on one target: the UVC video descriptor parser...

mlkem-native

mlkem-native mlkem-native è un'implementazione sicura, veloce e portabile in C901 di ML-KEM2. È un fork dell'implementazione di riferimento di ML-KEM3. Tutto il codice C in mlkem/src/ e mlkem/src/fips202/ è dimostrato memory-safe nessun overflow di memoria e type-safe nessun overflow di interi...

CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-75759

erlef oidcc is an Erlang OpenID Connect client library. In versions 3.2.0-beta.1 through before 3.9.0 , an improper verification of cryptographic signature flaw allows an unauthenticated attacker to impersonate an arbitrary user by submitting an encrypted ID token or JARM response that contains n...

PT-2026-83516

Name of the Vulnerable Software and Affected Versions oidcc versions 3.2.0-beta.1 through 3.8.9 Description Improper verification of cryptographic signatures allows an unauthenticated attacker to impersonate any user. The issue occurs when the software accepts a JSON Web Encryption JWE wrapping...

CVE-2026-9090-poc

CVE-2026-9090 — Bypass della firma SAML di Casdoor PoC Proof-of-concept per CVE-2026-9090 CWE-347, Verifica impropria della firma crittografica, un bypass dell'autenticazione nella piattaforma di identità Casdoor. Attribuzione. CVE-2026-9090 è stato pubblicato e coordinato da CERT/CC — vedi...

CVE-2022-21449

CVE 2022 21449 python implementation Questo progetto permette di: Tracciare una curva ellittica con i parametri desiderati, su un corpo finito o no Generare una coppia di chiavi a partire da una curva ellittica data Crittografare / Decrittografare un messaggio con ECIES Firmarlo / verificarlo...

CVE-2026-82461

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

EUVD-2026-68119

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

EUVD-2026-68118

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

CVE-2026-82461 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

poc-CVE-2026-0073

CVE-2026-0073 PoC Wireless ADB TLS Auth Bypass Dieses Verzeichnis enthält einen Python Proof-of-Concept für CVE-2026-0073. Das Skript wurde unter Verwendung KI-gestützter Codegenerierungstechniken erstellt. Zusammenfassung CVE-2026-0073 ist ein logisches Problem in der ADB-Daemon-Zertifikatsprüfu...