EUVD-2026-80290

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a...

CVE-2026-22014-GraphQL-Persisted-Queries-Injection-via-ID-Manipulation

CVE-2026-22014 – ID 操作による GraphQL 永続化クエリインジェクション プログラムコード Node.js root@kitploit: // graphqlpersisted.js - Accepts persisted query IDs const express = require'express'; const graphqlHTTP = require'express-graphql'; const queries = "abc": "query user name " ; app.post'/graphql', graphqlHTTP schema:...

kernel: smb: client: fix query directory replay double-free

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the client attempts to free the same memory buffer twice during a directory query operation. An attacker could potentially exploit this flaw to cause memory corruption,...

Linux Distros Unpatched Vulnerability : CVE-2026-75029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In a query response, an attacker may send named multiple copies of a record that should only exist once such as an SOA record. If the RDATA is the same on all t...

Elasticsearch-Exploit-CVE-2023-31419

Elasticsearch スタックオーバーフローの脆弱性 Elasticsearch に脆弱性が発見されました。影響を受ける search API では、特別に細工されたクエリ文字列によりスタックオーバーフローが発生し、最終的にはサービス拒否を引き起こす可能性があります。 影響を受けるバージョン: Elasticsearch 7.0.0 から 7.17.12 まで、および 8.0.0 から 8.9.0 までのバージョン 解決策と緩和策: この問題は Elasticsearch 7.17.13 および 8.9.1 で解決されています。 CVSSv3: 6.5 中 -...

CVE-2025-30208-Vite

CVE-2025-30208 | Viteスクリプト このツールは、対象システムが CVE-2025-30208 の脆弱性を持っているかどうかを検出するために使用されます。この脆弱性により、攻撃者は特定のパスを通じてサーバー上の機密ファイル（/etc/passwd や C:\windows\win.ini など）を読み取ることができます。このツールは単一 URL の検出とバッチ検出をサポートし、HTTP/HTTPS プロキシをオプションで使用できます。 ここでは payload ?raw?? と ?import?raw?? の関係を紹介します。最初の payload...

CVE-2026-92237

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

EUVD-2026-79941

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

CVE-2026-92237

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

CVE-2026-92237

CVE-2026-92237 affects Devolutions PowerShell Universal 2026.2.5 and earlier . The slow query logging feature writes SQL parameter values to the system log on instances backed by Microsoft SQL Server , exposing sensitive data. An authenticated user with log read permission can obtain application ...

EUVD-2026-79241

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

CVE-2026-76820

OpenCTI, an open-source cyber threat intelligence platform, is affected by a Server-Side Request Forgery (SSRF) in the synchronizerFetch GraphQL query prior to version 7.260701.0 . The backend's fetchRemoteStreams function validated only the HTTP/HTTPS scheme without applying the ingestion deny l...

top-dns

Top DNS Measurement 概要 このスクリプトは、Bro に組み込まれている確率的計測メカニズムを使用して、定義可能な期間内に発生した上位 DNS リクエスト（クエリタイプ別、すなわち CNAME、A、AAAA など）を計測します。これは、"topdns.log" という新しいログに記録されます。 確率的メカニズムを使用することで、このタスクはメモリ効率の良い方法で実現でき、このスクリプトを読み込んでも、ほとんどの導入環境では重大なパフォーマンスへの影響はないはずです。 インストール :: root@kitploit: bro-pkg refresh bro-pkg...

CVE-2026-82191

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser or an automated system that fetches it, causes the resulting redirec...

CVE-2026-82191 Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser or an automated system that fetches it, causes the resulting redirec...

CVE-2026-61667

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...

CVE-2026-55375

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-55375

canto-saas-api (PHP library for the Canto SaaS API) prior to 3.0.0 sends OAuth credentials (app_id, app_secret, refresh_token, code) in the URL query string of token POST requests rather than the request body. Because request URLs are commonly recorded in access logs, proxy logs, and APM traces, ...

EUVD-2026-78902

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-55375 canto-saas-api: OAuth credentials exposed in URL query string and exception messages

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...