CVE-2026-106570

A flaw was found in ImageMagick. An unauthenticated attacker on an adjacent network can cause a Denial of Service DoS by repeatedly establishing connections to the distributed pixel cache server. This behavior exhausts the pool of available connections, preventing legitimate clients from accessin...

CVE-2026-94127

CVE-2026-94127 — F5 BIG-IP APM Detection Tool Defensive Author: https://github.com/FurkanKAYAPINAR/ A defensive, non-exploit detector for CVE-2026-94127 , a heap-based buffer overflow CWE-122 in F5 BIG-IP APM that allows an unauthenticated remote attacker to achieve remote code execution RCE. CVS...

USN-8898-1 apache2 vulnerabilities

It was discovered that Apache HTTP Server's modrewrite module incorrectly handled memory when performing certain variable lookups. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-56154 Lucian Nitescu, Simon Kappel, and Gianluca...

USN-8898-1: Apache HTTP Server vulnerabilities

It was discovered that Apache HTTP Server's modrewrite module incorrectly handled memory when performing certain variable lookups. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-56154 Lucian Nitescu, Simon Kappel, and Gianluca...

CVE-2026-93536

A flaw was found in the X.Org Server. When a window is removed during an active gesture, the server fails to clean up references to the destroyed window in its gesture tracking data. A local attacker can exploit this flaw to cause a use-after-free condition—where the system accesses memory after ...

CVE-2026-93524

A flaw was found in xorg-x11-server. An authenticated local user can trigger an out-of-bounds heap memory read by sending specially crafted X Keyboard Extension XKB requests with inconsistent key range parameters. This flaw leads to information disclosure, allowing the user to read sensitive data...

CVE-2026-93520

A flaw was found in xorg-x11-server. In the X Keyboard Extension XKB, key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-bas...

CVE-2026-93515

A flaw was found in xorg-x11-server. A use-after-free vulnerability, where the application accesses memory after it has already been released, occurs in the Present extension because window notification entries are not properly unlinked before cleaning up window resources. An authenticated local ...

CVE-2026-93519

A flaw was found in xorg-x11-server. The server writes pointer barrier events into a fixed-size buffer without properly validating boundaries. An authenticated client can trigger this issue by configuring excessive pointer barriers and generating cursor motion events, causing a buffer overflow...

CVE-2026-93518

A flaw was found in xorg-x11-server. Due to an integer truncation issue during memory allocation calculations within the X Keyboard Extension XKB, the server allocates an undersized buffer when resizing key types. An authenticated local client can exploit this vulnerability by sending specially...

CVE-2026-93517

A flaw was found in xorg-x11-server. The GLX OpenGL Extension to the X Window System interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially...

CVE-2024-45337

Exploit de prueba de concepto para CVE-2024-45337 Este repositorio contiene un exploit de prueba de concepto para CVE-2024-45337. Se puede utilizar para envolver ssh al interactuar con un servidor SSH implementado con golang.org/x/crypto = v0.30.0., mientras se almacenan en caché los permisos en ...

NextJS-app-CVE-2025-55182

Prueba de Concepto de Next.js CVE-2025-55182 Esta es una aplicación Next.js de prueba de concepto vulnerable a CVE-2025-55182 también conocida como "React2Shell", una vulnerabilidad crítica de Ejecución Remota de Código RCE en React Server Components. ⚠️ ADVERTENCIA Esta aplicación es...

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger vulnerability discovered by ? in WordPress Npm ghost versions = 1.18.0, 6.27.0...

ish

iSH A project to get a Linux shell running on iOS, using usermode x86 emulation and syscall translation. For the current status of the project, check the issues tab, and the commit logs. App Store page TestFlight beta Discord server Wiki with help and tutorials README中文 如若未能保持最新，请提交PR以更新 Hacking...

CVE-2026-107272

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

CVE-2026-107206

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

DEBIAN-CVE-2026-106574

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...

CVE-2026-106574

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...

DEBIAN-CVE-2026-106570

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is...