BIT-THRIFT-2026-92834 Apache Thrift: C++ WebSocket server transport does not read a full request length

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-PYTHON-MIN-2026-19445 Use-after-free of a server-side SSLContext when sni_callback switches contexts

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

ROOT-OS-DEBIAN-11-CVE-2026-56000 CVE-2026-56000 in xorg-server - Patched by Root

Root has patched CVE-2026-56000 in the xorg-server package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-55999 CVE-2026-55999 in xorg-server - Patched by Root

Root has patched CVE-2026-55999 in the xorg-server package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2023-5574 CVE-2023-5574 in xorg-server - Patched by Root

Root has patched CVE-2023-5574 in the xorg-server package for Root:Debian:11. Multiple fixed versions available...

CVE-2026-94503

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

EUVD-2026-95633

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

CVE-2026-56154

A use-after-free flaw was found in the modrewrite module of Apache HTTP Server when evaluating URL lookahead expressions that reference HTTP request headers, such as %LA-U:HTTP:.... A remote attacker may be able to trigger invalid memory access in a server using an affected rewrite configuration,...

CVE-2026-106155

In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views t...

CVE-2026-106145

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server...

CVE-2026-57941

A flaw was found in the modhttp2 module of Apache HTTP Server. A remote, unauthenticated attacker could exploit a use-after-free condition—where memory is accessed after being released—through re-entrant processing of shared session buffers. This flaw can allow an attacker to potentially execute...

CVE-2026-106155

Progress Telerik Report Server prior to version 12.2.26.1007 is vulnerable to a stored cross-site scripting (XSS) flaw in the shared reporting engine. An authenticated report author can embed javascript: or vbscript: URLs within report navigation actions or HTML text box links. If another user vi...

EUVD-2026-95524

In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views t...

CVE-2026-106155 Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers

In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views t...

EUVD-2026-95523

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server...

CVE-2026-106145 Privilege Escalation in Telerik Report Server Service-Agent Hub

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server...

CVE-2026-106145

Progress Telerik Report Server prior to version 12.2.26.1007 is vulnerable to a privilege escalation flaw due to incorrect privilege assignment in the service-agent SignalR hub . An authenticated user, such as a low-privilege or guest account with a valid bearer token, can register as a trusted s...

Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling External Authentication Server and are addressed in SEAS 6115 fixpack Vulnerability Details CVEID:CVE-2026-77310 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

nginxpwner

Nginxpwner Nginxpwner es una herramienta simple para buscar configuraciones incorrectas y vulnerabilidades comunes de Nginx. Instalación: cd /opt git clone https://github.com/stark0de/nginxpwner cd nginxpwner chmod +x install.sh ./install.sh Instalar usando Docker git clone...

columbus-server

Servidor Columbus ¡Este repositorio está obsoleto! ‼️ El componente del servidor se ha movido a https://github.com/elmasy-com/columbus. Columbus Project es un servicio de descubrimiento de subdominios basado en API, un servicio de enumeración de subdominios extremadamente rápido con funciones...