TrustworthyRAG

Trustworthy RAG Агент оценки для обнаружения дезинформации и отравления знаний в системах генерации с дополненной выборкой RAG. Обзор В этом проекте реализован фреймворк Trustworthy RAG со встроенным агентом оценки Evaluation Agent , который оценивает надёжность ответов RAG с помощью трёх...

CVE-2021-34646

CVE-2021-34646 PoC Описание уязвимости от NVD Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the processemailverification function due to a random token generation weakness in the resetandmailactivationlink functio...

CurveBall

CurveBall CVE-2020-0601 - PoC CVE-2020-0601: CurveBall 또는 ChainOffFools라고도 알려진 이 취약점은 Microsoft CryptoApi특히 Crypt32.dll의 취약점으로, 인증서의 타원 곡선 서명ECDSA이 올바르게 검증되지 않습니다. 이 문제를 매우 깔끔하게 설명해 주는 훌륭한 블로그 게시물이 여기 있습니다. 이 도구는 교육 및 연구 목적으로만 사용해야 합니다! 사용 방법 콘솔 애플리케이션에 타원 곡선 인증서의 경로를 제공하십시오. root@kitploit:...

Starlink-FI

Мод-чип для пользовательского терминала Starlink Этот репозиторий сопровождает доклад под названием «Glitched on Earth by Humans: A Black-Box Security Evaluation of the SpaceX Starlink User Terminal». Слайды доступны здесь, запись доклада должна появиться в ближайшее время. В докладе...

SSH-account-enumeration-verification-script

SSH-account-enumeration-verification-script SSH 계정 열거 확인 스크립트CVE-2018-15473...

CVE-2019-0708-test

CVE-2019-0708-test CVE-2019-0708 C Vulnerability Verification Programming Language: C Programming Software: Visual Studio 2012 Programming Environment: .Net Framework 4.5 A software written in C to verify the CVE-2019-0708 vulnerability Calls 0708detector.exe released by 360's 360Vulcan Team...

CVE-2026-40176

CVE-2026-40176 — Injection de commande dans le pilote Perforce de Composer Preuve de concept Une preuve de concept autonome, orientée objet en PHP, qui démontre et vérifie différentiellement une vulnérabilité d'injection de commande dans le pilote de dépôt Perforce de Composer. Le PoC exécute le...

CVE-2026-25250

🕷️ CVE-2026-25250: Improper Trusted Bootloader Chain Validation A Microsoft-signed third-party bootloader that loads a secondary EFI binary with no signature or integrity verification, collapsing the Secure Boot chain of trust from within. 📑 Table of Contents Research Context Official References...

kernel-c-to-rust-spike

Kernel C-to-Rust hardening spike: UVC descriptor parser Can a security-critical Linux kernel C parser be hardened by rewriting it in Rust, with the rewrite shown equivalent to the original and then formally verified? This spike runs the full loop on one target: the UVC video descriptor parser...

mlkem-native

mlkem-native mlkem-native è un'implementazione sicura, veloce e portabile in C901 di ML-KEM2. È un fork dell'implementazione di riferimento di ML-KEM3. Tutto il codice C in mlkem/src/ e mlkem/src/fips202/ è dimostrato memory-safe nessun overflow di memoria e type-safe nessun overflow di interi...

CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-75759

erlef oidcc is an Erlang OpenID Connect client library. In versions 3.2.0-beta.1 through before 3.9.0 , an improper verification of cryptographic signature flaw allows an unauthenticated attacker to impersonate an arbitrary user by submitting an encrypted ID token or JARM response that contains n...

PT-2026-83516

Name of the Vulnerable Software and Affected Versions oidcc versions 3.2.0-beta.1 through 3.8.9 Description Improper verification of cryptographic signatures allows an unauthenticated attacker to impersonate any user. The issue occurs when the software accepts a JSON Web Encryption JWE wrapping...

CVE-2026-9090-poc

CVE-2026-9090 — Bypass della firma SAML di Casdoor PoC Proof-of-concept per CVE-2026-9090 CWE-347, Verifica impropria della firma crittografica, un bypass dell'autenticazione nella piattaforma di identità Casdoor. Attribuzione. CVE-2026-9090 è stato pubblicato e coordinato da CERT/CC — vedi...

CVE-2022-21449

CVE 2022 21449 python implementation Questo progetto permette di: Tracciare una curva ellittica con i parametri desiderati, su un corpo finito o no Generare una coppia di chiavi a partire da una curva ellittica data Crittografare / Decrittografare un messaggio con ECIES Firmarlo / verificarlo...

CVE-2026-82461

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

EUVD-2026-68119

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

CVE-2026-82461 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

EUVD-2026-68118

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...