
CVE-2026-97859-CYB-Analysis
Cybersecurity assignment on CVE-2026-97859, severity analysis, patching, and the Cyber Kill Chain.

Cybersecurity assignment on CVE-2026-97859, severity analysis, patching, and the Cyber Kill Chain.

Hardened PHP replacement handlers for PeachPay Stripe capture and void AJAX endpoints, adding nonce verification, capability checks, and strict order…

Reproducible Docker lab + PoC: Keycloak manage-users -> realm-admin escalation via composite roles (CVE-2026-94000 variant). Validated on 26.8.1.

The authorization layer CVE-2026-93328 was missing: scoped grants, path confinement, and signed receipts in front of MCP storage tools. CVE…

Python CLI that detects and exploits CVE-2026-90907, a Joomla! com_users authorization bypass enabling unauthenticated account creation;…

Keycloak 26.8.1 Medium 6.6 Remote authenticated auth leftover. A help-desk admin with manage-users can pin a pre-built composite of manage-realm onto…

Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs

Curated collection of web and API vulnerability checklists covering XSS, SQLi, CSRF, IDOR, authentication bypass, file upload, and bug bounty testing…

HDU IS Work 1 - Secure REST API (Flask) with CI/CD (pytest + bandit + pip-audit) and CVE-2018-17246 analysis

Apache Traffic Server 10.2.0 - High - Remote - Privilege leftover - authproxy prefix

Apache Traffic Server 10.2.0 - High - Remote - Privilege leftover - realip PLUGIN ACL fail-open

Approve sudo on a Linux workstation with a fingerprint on your Android phone. LAN only; the ECDSA key never leaves the phone's TEE and speaks the…

A small Windows local-privilege-escalation (LPE) misconfiguration auditor with a terminal UI, built with C++20 and FTXUI

Secret-Use Delegation Protocol — protocol-level secret use for agentic systems

Zero-trust reverse proxy and ABAC authorization gateway in Go with embedded OPA policy evaluation and distributed token revocation.

[🎖️ Honorable Mention in HAIPS @COLM'26] The first benchmark to evaluate how well do LLM agents act in alignment with their assigned authorization…

Proof-of-concept lab for an Apache Superset 6.1.0 authorization flaw where a Gamma dashboard editor plants dataset SQL via unversioned v0 dashboard…

Local static security scanner for Next.js, Supabase and Stripe apps: 24 AST-based checks for leaked keys, missing RLS and grants, unsafe webhooks.…