138646 matches found
CVE-2026-107824: Missing Authentication for Critical Function
x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...
Aiohttp HTTP Client DoS
The vulnerability of the Aiohttp HTTP client is related to the allocation of unlimited memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
PT-2026-109272
Name of the Vulnerable Software and Affected Versions x64dbg-MCP Server versions prior to 1.2 Description The software exposes debugger functionality over HTTP and listens on 0.0.0.0 by default. In the src/core/mcp server.zig file, the parseContentLength function parses an unbounded Content-Lengt...
CVE-2026-75597: Generation of Error Message Containing Sensitive Information
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc...
CVE-2026-107938: Improper Validation of Certificate with Host Mismatch
In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...
CVE-2026-107820: Integer Overflow or Wraparound
x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcpserver.zig parses an unbounded Content-Length value in parseContentLength and uses it in unchecked usize addition in wsRecv before token...
PT-2026-108812
Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The Netty-based HTTP client transport cxf-rt-transports-http-netty-client fails to verify that the hostname in the server TLS...
MAL-2026-17719 Malicious code in @brick-v2/tour (npm)
@brick-v2/tour is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...
Aiohttp HTTP Client DoS
The vulnerability of the Aiohttp HTTP client is related to the improper processing of highly compressed input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...
Malicious code in @brick-v2/table (npm)
@brick-v2/table is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...
Aiohttp HTTP Client Source Verification Confidential Data Access
The vulnerability of the Aiohttp HTTP client is related to a lack of mechanisms for verifying the source of the connection. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential data...
Aiohttp HTTP Client CRLF DoS
The vulnerability of the Aiohttp HTTP client is related to the lack of measures taken to neutralize CRLF sequences. Exploiting this vulnerability can allow a remote attacker to cause service failures...
Aiohttp HTTP Client DoS
The vulnerability of the Aiohttp HTTP client is related to the allocation of unlimited memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
Aiohttp HTTP client Host Certificate DOSS
The vulnerability of the Aiohttp HTTP client is related to the lack of checking host certificate data. Exploiting this vulnerability can allow a remote attacker to cause service failures...
Aiohttp HTTP Client Unauthorized Access
The vulnerability of the Aiohttp HTTP client is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
Aiohttp Memory Initialization Error DoS
The vulnerability of the Aiohttp HTTP client is related to memory initialization errors. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
Aiohttp HTTP Client Resource Leak DoS
The vulnerability of the Aiohttp HTTP client is related to errors during resource release. Exploiting this vulnerability can allow a remote attacker to cause service failures...
Aiohttp HTTP Client DoS
The vulnerability of the Aiohttp HTTP client is related to the allocation of unlimited memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
HTTP/3 Server Data Compromise
The vulnerability of HTTP/3 server-side software such as HAProxy is related to errors in processing input data length parameters. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information...
CVE-2026-107807: Cleartext Storage of Sensitive Information
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...