S'inscrire
← Back to Events
UPCOMING

2026 Embedded Capture the Flag

📅 Event Schedule

Start: 14 Jan 2026, 12:00
End: 15 Avr 2026, 12:00
Duration: 2184 hours

📍 Location

Type: 🌐 Online Event

📝 Event Description

The Embedded Capture the Flag (eCTF) is an embedded security competition run by MITRE that puts participants through the experience of trying to create a secure system and then learning from their mistakes. The main target is a real physical embedded device, which opens the scope of the challenge to include physical/proximal access attacks. The eCTF is a two-phase competition with attack and defense components. In the first phase, competitors design and implement a secure system based on a set of challenge requirements. The second phase involves analyzing and attacking the other teams’ designs.

In the 2026 eCTF, teams will design and implement a secure storage solution for a chip foundry. The system must allow users with various roles to access the proper data without leaking sensitive chip designs to unauthorized parties.

The eCTF is only open to active students.

CERT-FR CERTFR-2026-ALE-014 ALERTE [Màj] Multiples vulnérabilités dans PHP (21 octobre 2026) 21/10/2026 ◆ NVD CVE-1999-0095 HIGH 10 The debug command in Sendmail is enabled, allowing attackers to… 01/10/1988 ◆ CISA KEV CVE-2026-114625 EXPLOITÉE Arista VeloCloud Orchestrator SQL Injection Vulnerability 23/10/2026 ◆ EXPLOIT-DB CVE-2026-109618 EXPLOIT PUBLIC [remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 -… 22/10/2026 ◆ CERT-FR CERTFR-2026-ALE-013 ALERTE Vulnérabilité dans Ivanti Connect Secure (ICS) (14 octobre 2026) 14/10/2026 ◆ NVD CVE-1999-0082 HIGH 10 CWD ~root command in ftpd allows root access. 11/11/1988 ◆ CISA KEV CVE-2026-110447 EXPLOITÉE Collabora Online – Built-in CODE Server OS Command Injection Vulnerability 23/10/2026 ◆ EXPLOIT-DB EDB-52696 EXPLOIT PUBLIC [remote] Edimax BR-6478AC firmware v2.20 - authenticated command injection 21/10/2026 ◆ CERT-FR CERTFR-2026-ALE-012 ALERTE Incident de sécurité ciblant les contrôleurs à distance des installations… 12/10/2026 ◆ NVD CVE-1999-1471 HIGH 7.2 Buffer overflow in passwd in BSD based operating systems 4.3… 01/01/1989 ◆ CISA KEV CVE-2026-106931 EXPLOITÉE EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability 20/10/2026 ◆ EXPLOIT-DB EDB-52697 EXPLOIT PUBLIC [webapps] Automotive Shop Management System 1.0 - SQLi 21/10/2026 ◆ CERT-FR CERTFR-2026-ALE-011 ALERTE Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway (28 septembre… 28/09/2026 ◆ NVD CVE-1999-1122 MEDIUM 4.6 Vulnerability in restore in SunOS 4.0.3 and earlier allows local… 26/07/1989 ◆ CISA KEV CVE-2026-96656 EXPLOITÉE Plex Media Server External Control of File Name or Path… 20/10/2026 ◆ EXPLOIT-DB EDB-52698 EXPLOIT PUBLIC [webapps] Open eClass 3.15 - RCE 21/10/2026 ◆ CERT-FR CERTFR-2026-ALE-010 ALERTE Vulnérabilité dans Metabase (10 septembre 2026) 10/09/2026 ◆ NVD CVE-1999-1467 HIGH 10 Vulnerability in rcp on SunOS 4.0.x allows remote attackers from… 26/10/1989 ◆ CISA KEV CVE-2026-96655 EXPLOITÉE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability 20/10/2026 ◆ EXPLOIT-DB EDB-52699 EXPLOIT PUBLIC [webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover 21/10/2026 ◆ CERT-FR CERTFR-2026-ALE-009 ALERTE Multiples vulnérabilités dans SonicWall Secure Mobile Access (02 septembre 2026) 02/09/2026 ◆ NVD CVE-1999-1506 HIGH 7.5 Vulnerability in SMI Sendmail 4.0 and earlier, on SunOS up… 29/01/1990 ◆ CISA KEV CVE-2026-96654 EXPLOITÉE Plex Media Server Improper Neutralization of Encoded URI Schemes in… 20/10/2026 ◆ EXPLOIT-DB EDB-52700 EXPLOIT PUBLIC [remote] Synametrics Syncrify 6.2 - command execution 21/10/2026 ◆ CERT-FR CERTFR-2026-ALE-008 ALERTE Multiples vulnérabilités dans Microsoft Sharepoint (22 juillet 2026) 22/07/2026 ◆ NVD CVE-1999-0084 HIGH 8.4 Certain NFS servers allow users to use mknod to gain… 01/05/1990 ◆ CISA KEV CVE-2026-96652 EXPLOITÉE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability 20/10/2026 ◆ EXPLOIT-DB EDB-52701 EXPLOIT PUBLIC [remote] South River Technologies Titan MFT Server 26.0.0 - code… 21/10/2026 ◆ CERT-FR CERTFR-2026-ALE-014 ALERTE [Màj] Multiples vulnérabilités dans PHP (21 octobre 2026) 21/10/2026 ◆ NVD CVE-1999-0095 HIGH 10 The debug command in Sendmail is enabled, allowing attackers to… 01/10/1988 ◆ CISA KEV CVE-2026-114625 EXPLOITÉE Arista VeloCloud Orchestrator SQL Injection Vulnerability 23/10/2026 ◆ EXPLOIT-DB CVE-2026-109618 EXPLOIT PUBLIC [remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 -… 22/10/2026 ◆ CERT-FR CERTFR-2026-ALE-013 ALERTE Vulnérabilité dans Ivanti Connect Secure (ICS) (14 octobre 2026) 14/10/2026 ◆ NVD CVE-1999-0082 HIGH 10 CWD ~root command in ftpd allows root access. 11/11/1988 ◆ CISA KEV CVE-2026-110447 EXPLOITÉE Collabora Online – Built-in CODE Server OS Command Injection Vulnerability 23/10/2026 ◆ EXPLOIT-DB EDB-52696 EXPLOIT PUBLIC [remote] Edimax BR-6478AC firmware v2.20 - authenticated command injection 21/10/2026 ◆ CERT-FR CERTFR-2026-ALE-012 ALERTE Incident de sécurité ciblant les contrôleurs à distance des installations… 12/10/2026 ◆ NVD CVE-1999-1471 HIGH 7.2 Buffer overflow in passwd in BSD based operating systems 4.3… 01/01/1989 ◆ CISA KEV CVE-2026-106931 EXPLOITÉE EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability 20/10/2026 ◆ EXPLOIT-DB EDB-52697 EXPLOIT PUBLIC [webapps] Automotive Shop Management System 1.0 - SQLi 21/10/2026 ◆ CERT-FR CERTFR-2026-ALE-011 ALERTE Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway (28 septembre… 28/09/2026 ◆ NVD CVE-1999-1122 MEDIUM 4.6 Vulnerability in restore in SunOS 4.0.3 and earlier allows local… 26/07/1989 ◆ CISA KEV CVE-2026-96656 EXPLOITÉE Plex Media Server External Control of File Name or Path… 20/10/2026 ◆ EXPLOIT-DB EDB-52698 EXPLOIT PUBLIC [webapps] Open eClass 3.15 - RCE 21/10/2026 ◆ CERT-FR CERTFR-2026-ALE-010 ALERTE Vulnérabilité dans Metabase (10 septembre 2026) 10/09/2026 ◆ NVD CVE-1999-1467 HIGH 10 Vulnerability in rcp on SunOS 4.0.x allows remote attackers from… 26/10/1989 ◆ CISA KEV CVE-2026-96655 EXPLOITÉE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability 20/10/2026 ◆ EXPLOIT-DB EDB-52699 EXPLOIT PUBLIC [webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover 21/10/2026 ◆ CERT-FR CERTFR-2026-ALE-009 ALERTE Multiples vulnérabilités dans SonicWall Secure Mobile Access (02 septembre 2026) 02/09/2026 ◆ NVD CVE-1999-1506 HIGH 7.5 Vulnerability in SMI Sendmail 4.0 and earlier, on SunOS up… 29/01/1990 ◆ CISA KEV CVE-2026-96654 EXPLOITÉE Plex Media Server Improper Neutralization of Encoded URI Schemes in… 20/10/2026 ◆ EXPLOIT-DB EDB-52700 EXPLOIT PUBLIC [remote] Synametrics Syncrify 6.2 - command execution 21/10/2026 ◆ CERT-FR CERTFR-2026-ALE-008 ALERTE Multiples vulnérabilités dans Microsoft Sharepoint (22 juillet 2026) 22/07/2026 ◆ NVD CVE-1999-0084 HIGH 8.4 Certain NFS servers allow users to use mknod to gain… 01/05/1990 ◆ CISA KEV CVE-2026-96652 EXPLOITÉE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability 20/10/2026 ◆ EXPLOIT-DB EDB-52701 EXPLOIT PUBLIC [remote] South River Technologies Titan MFT Server 26.0.0 - code… 21/10/2026 ◆