Published file metadata, source observations, indicators, and research history in one bounded catalog.
106Reachable catalog records
3 / 5Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_350d40f2cc69277bcaCollection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
106 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Written in Go, Hugo is an open source static site generator available under the Apache Licence 2.0. Hugo supports TOML, YAML and JSON data file types, Markdown and HTML content files and uses shortcodes to add rich content. Other notable features are taxonomies, multilingual mode, image processing, custom output formats, HTML/CSS/JS minification and support for Sass SCSS workflows. Hugo makes use
First reported Apr 11, 2020 11:15 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
We have identified several new heap buffer overflow vulnerabilities in Samsung’s baseband implementation (mainly used in Exynos chipsets): three different heap buffer overflows in the same function, to be precise. The most critical of these vulnerabilities can be exploited to achieve arbitrary code execution in the baseband runtime. The vulnerabilities we are disclosing in this advisory affected a
First reported Jul 29, 2024 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes a stack buffer overflow, which leads to remote code execution. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released in April 2026 c
First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes an authentication bypass vulnerability in the HTTP server implementation. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released was
First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes an authentication bypass vulnerability in the HTTP server implementation. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released in A
First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Additional posts in this series: Part 1 Part 2 In my Basebanheimer talk at Hardwear.io, I explained a method for exploiting the Mediatek Baseband Pivot vulnerability CVE-2022-21765 for arbitrary code execution in the Linux kernel on Mediatek’s older (“Helio”) chipsets, which use 32-bit kernels. I also mentioned that using previous ideas, the vulnerability could theoretically be exploited on Mediat
First reported Dec 07, 2023 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
In this blogpost, the newest full-time member of our research team describes his internship project. If you would also like to try your hand at our hacking tools and techniques, don’t hesitate to check out our training offerings! Currently available: https://www.offensivecon.org/trainings/2026/exploiting-smartphones-through-baseband.html Last summer, I had an opportunity to join TASZK Security Lab
First reported Mar 16, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes a path traversal which can lead to leaking secrets. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released in January 2026 and update
First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
We have identified a new stack buffer overflow vulnerability in Mediatek’s Linux Kernel driver implementation of cellular-to-application processor communication interface (CCCI). The vulnerability can be exploited by a malicious (compromised) baseband runtime to achieve arbitrary code execution in the Linux Kernel. The vulnerability we are disclosing in this advisory affected a wide range of Media
First reported Nov 28, 2023 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending malformed requests over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes a cryptographic design vulnerability, which enables offline password bruteforce, which may leads to TAPO cloud account compromise. The vulnerability we are disclosing in this advisory affects a wide range of TP-Link devices, including TAPO Smart Camer
First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is unbounded recursion based stack overflow in the baseband, triggered by malformed VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. The January 2024 issue of
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
We have identified a new vulnerability in Huawei’s Hypervisor implementation. The vulnerability can be exploited to bypass Huawei’s HKIP (Kernel Integrity Protection) exploit mitigations. The vulnerability we are disclosing in this advisory affected a wide range of Huawei devices, including phones on the newest chipsets. The vendor did not produce a fix/CVE for the reported vulnerability. Vulnerab
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
We have identified a new stack buffer overflow vulnerability in Samsung’s Android Radio Interface Layer implementation. The vulnerability can be exploited by a malicious (compromised) baseband runtime to achieve denial of service in Android in the radio context. The vulnerability we are disclosing in this advisory affected a wide range of Samsung devices, including phones on the newest Exynos chip
First reported Nov 28, 2023 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is Arbitrary Heap Overflow in the baseband, triggered by malformed VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. This vulnerability is assigned CVE-2025-207
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is DoS in the baseband, triggered by malformed VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. This vulnerability is assigned CVE-2025-20725. Vulnerability De
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is Heap Overflow in the baseband, triggered by malformed VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. This vulnerability is assigned CVE-2025-20725. Vulner
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is Heap Overflow in the baseband, triggered by malformed VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. The January 2024 issue of the Mediatek Security Bulle
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
We have identified a new heap buffer overflow vulnerability in Samsung’s Android Radio Interface Layer implementation. The vulnerability can be exploited by a malicious (compromised) baseband runtime to achieve arbitrary code execution in Android in the radio context. The vulnerability we are disclosing in this advisory affected a wide range of Samsung devices, including phones on the newest Exyno
First reported Nov 28, 2023 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. This report describes an unbounded recursion issue, which leads to stack overflow. (Note: the issue is stack overflow not stack buffer overtflow, i.e. an out-of-bounds write beyond a stack frame’s end). The vulnerability described in this advisory affected a wid
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is DoS in the baseband, triggered by malformed VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. This vulnerability is assigned CVE-2025-20725. Vulnerability De
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is intra-structure overflow in the baseband, triggered by malformed SDP data in VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. The January 2024 issue of the
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is DoS in the baseband, triggered by malformed VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. This vulnerability is assigned CVE-2025-20725. Vulnerability De
First reported Oct 01, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
We have identified a new heap buffer overflow vulnerability in Samsung’s Android Radio Interface Layer implementation. The vulnerability can be exploited by a malicious (compromised) baseband runtime to achieve arbitrary code execution in Android in the radio context. The vulnerability we are disclosing in this advisory affected a wide range of Samsung devices, including phones on the newest Exyno
First reported Nov 28, 2023 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
An attacker sending malformed miIO messages over WiFi to a Xiaomi Smart camera device can trigger the vulnerability described here. This report describes a secure protocol design issue, which leads to authentication bypass in the proprietary Xiaomi miIO protocol. The vulnerability described in this advisory affects a potentially wide range of Xiaomi Smart devices. This vulnerability has not yet be
First reported Mar 16, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.