EUVD-2026-95983

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

CVE-2026-107854 Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

CVE-2026-107852

In Jexactyl (a game management and billing system), a vulnerability exists prior to version 4.0.5 in the POST /api/client/billing/stripe/process endpoint. The system fails to verify if the amount_total or currency of a client-supplied Stripe Checkout Session matches the referenced order's require...

CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

CVE-2019-11043

CVE-2019-11043 0th3rs Security Team ====================== In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 Tested under PHP 7.2.20/7.3.10 Instructions 1、较为稳定,只要爆破出query长度和Header头字段长度 2、autosession检测漏洞存在性 3、实现判断目标worker进程数实现健壮性 4、全worker进程污染 Nginx configuration locati...

linux-insides

linux-insides A book-in-progress about the Linux kernel and its insides. Introduction • Chapter status • Requirements • Translations • Contributing • Author Introduction linux-insides is a book-in-progress about the Linux kernel and its insides. The goal of this project is simple - to share...

Percino

Percino Evasive Golang Loader Percino is a Golang loader that execute shellcode utilizing the process hollowing technique with anti-sandbox and anti-analysis measures. The shellcode is encrypted with the Triple DES 3DES encryption algorithm. Full EDR bypass with any C2 Framework. Tested with Coba...

CVE-2026-23744-PoC

CVE-2026-23744-PoC Disclaimer: This proof-of-concept is provided exclusively for authorised security research, educational purposes, and controlled lab environments e.g., HTB, CTF, or internal penetration testing with explicit written consent. Unauthorised use against any system without permissio...

ACF

Android Connections Forensics This software enables a forensic investigator to map each connection to its originating process. It doesn't require root privliges on the system, but do require adb & USB debugging. Supported OS ACF works currently only on Linux Ubuntu 14.04 Installation git clone...

GHSA-VQ8P-M3WM-GV5F pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

Description: The API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file uploa...

CVE-2026-48484 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...

EUVD-2026-95910

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...

CVE-2026-48484 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...

CVE-2026-48484

The pyLoad download manager is vulnerable to a Denial of Service (DoS) due to a lack of input size validation. Specifically, the rpc function in api_blueprint.py processes multipart/form-data uploads by using file.read() to load the entire file into memory before further processing. Because no si...

Security update for perl-DBI

This update for perl-DBI fixes the following issues: CVE-2026-78030: arbitrary modules loaded due to unvalidated dbmtype and dbmmldbm attributes in DBD::DBM bsc1281704. CVE-2026-88815: numeric value incorrectly treated as strings in sqltypecastsvpv allows for process crash bsc1283055...

SUSE-SU-2026:4612-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - CVE-2026-78030: arbitrary modules loaded due to unvalidated dbmtype and dbmmldbm attributes in DBD::DBM bsc1281704. - CVE-2026-88815: numeric value incorrectly treated as strings in sqltypecastsvpv allows for process crash bsc1283055. -...

CVE-2026-75429_PowerJob_friend_process_RCE

PowerJob Server Remote Code Execution via Unauthenticated /friend/process Groovy Injection 1. Summary The PowerJob Server distributed job scheduling / computing framework exposes the /friend/process endpoint on its Worker↔Server transport-layer HTTP port 10010 with no authentication whatsoever...

EUVD-2026-95897

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a...

Malicious code in @galicia-toolkit-nestjs/archetype (npm)

Source: amazon-inspector 63cdc34da85584342e27bc84d22c01a826c71020b7bf07987626cbe457e2e560 The package ships a minimal index.js stub that loads a prebuilt native ELF addon at prebuilds/linux-x64/metrics.node on require. The addon reads CI/CD and cloud credentials from the environment AWSACCESSKEYI...

DEBIAN-CVE-2026-95702

Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The...