CVE-2025-60751

CVE-2025-60751: GeographicLib Stack-based Buffer Overflow 📌 This repository contains the analysis and technical documentation of vulnerability CVE-2025-60751 , a stack-based buffer overflow flaw located in the C++ library GeographicLib. 📝 Description The vulnerability is located in the function...

CVE-2025-54322

CVE-2025-54322 - XSpeeder SXZOS Pre-Auth RCE Scanner A multi-threaded vulnerability scanner for CVE-2025-54322, an unauthenticated remote code execution vulnerability in XSpeeder SXZOS firmware affecting 70,000+ hosts globally. 📋 Table of Contents About the Vulnerability Features Installation Usa...

AlmaLinux 9 : kernel (ALSA-2026:77689)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:77689 advisory. kernel: ipvlan: Make the addrslock be per port CVE-2026-23103 kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use CVE-2026-53360 kernel:...

CVE-2026-108954

A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc of the component Offline Transducer Greedy Search Decoder. The manipulation of the...

EUVD-2026-98232

A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc of the component Offline Transducer Greedy Search Decoder. The manipulation of the...

gibbonlms-filewrite_rce

Gibbon LMS Arbitrary File Write / RCE Vulnerability Information Arbitrary File Write in Gibbon LMS for RCE CVE-2023-45878 GibbonEdu Gibbon LMS version 25.0.1 and earlier allows Arbitrary File Write because rubricsvisualisesaveAjax.php does not require authentication. The endpoint accepts the img,...

CVE-2026-28956-jxl-messages-surface

JPEG XL auto-decodes in the iOS Messages preview path A delivery-surface finding for CVE-2026-28956 AppleJPEGXL, plus the patch-diff attribution and a reliability reality-check on the public PoC. TL;DR — Conventional wisdom and our own prior measurement with EXR is that iOS Messages renders...

CVE-2026-76070

CVE-2026-76070: Unauthenticated Pre-Auth Stack Buffer Overflow via Base64-Decoded Password in Netis NC63 login.cgi Leading to RCE Researcher: Özcan Ersan @ozcanpng Disclosure status CVE: CVE-2026-76070 Vendor: Netis Systems Co., Ltd. Product: Netis NC63 Wireless AC1200 Router Tested firmware:...

xz-cve-2024-3094

root@ubuntu:/xz/ apt update root@ubuntu: /xz/ apt install -y gcc g++ vim net-tools make cmake build-essential libncurses-dev flex bison libssl-dev libelf-dev bc liblz4-tool liblz4-dev liblzma-dev ... ... root@ubuntu:/xz/ bash ./decode.sh root@ubuntu: /xz/ tar xf xz-5.6.1.tar.xz && cd xz-5.6.1...

MAL-2026-17793 Malicious code in perp-funding-rates (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 123418539e0264e9d58c8b51976723aff3eceec10520c231d7bc847edd51d691 The gem's native-extension script ext/perpfundingrates/extconf.rb contains no real build logic: it declares createmakefile'bitcoinrpclitenative' but...

decode-spam-headers

decode-spam-headers.py Che tu stia cercando di capire perché una specifica e-mail è finita in SPAM/Junk per le tue attività amministrative quotidiane o per i tuoi scopi di simulazione di Phishing Red-Team, questo script è qui per aiutarti! L'idea è nata durante la consegna di esercizi commerciali...

EUVD-2026-78647

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification...

GHSA-4VH2-39RQ-RQ8J Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...

RLSA-2026:77690 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipvlan: Make the addrslock be per port CVE-2026-23103 kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use CVE-2026-53360 kernel: vsock/virtio: fix zerocopy completion for...

Improper Validation of Specified Type of Input

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the decode function in src/decoder.js, where a JWT with a JSON array as its payload passes the object type check because typeof ===...

AZL-107129 CVE-2026-106435 affecting package python-pymongo 4.2.0-9

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

DEBIAN-CVE-2026-106435

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

EUVD-2026-95254

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435

The MongoDB Python Driver contains an out-of-bounds read vulnerability in its binary accelerator. This occurs when an application decodes malformed BSON containing a truncated regular-expression element missing a trailing NUL byte. An attacker who can supply BSON to the decode or decode_all APIs ...

Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...