AZL-94299 CVE-2026-6879 affecting package python3 for versions less than 3.12.9-14

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CVE-2026-6879

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure Detection

ADB formerly Pirelli Broadband Solutions P.DGA4001N router with firmware PDGTEFSP4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service device restart as demonstrated by a direct request to 1...

Apache S2-032 Struts - Remote Code Execution Detection

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when dynamic method invocation is enabled, allows remote attackers to execute arbitrary code via method: prefix related to chained expressions. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts 2.""" import re fr...

Jira - Incorrect Authorization Detection

Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access. !/usr/bin/env...

Pichome 2.1.0 - Arbitrary File Read Detection

A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed t...

EvilGinx - Detect

Evilginx2 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies which in turn allows bypassing 2-factor authentication protection. !/usr/bin/env python3 -- coding: utf-8 -- """Evilginx2 is a man-in-the-middle attack framework used for phishing logi...

Majordomo2 - SMTP/HTTP Directory Traversal Detection

A directory traversal vulnerability in the listfileget function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. dot dot sequences in the help command, as demonstrated using 1 a crafted email and 2 cgi-bin/mjwwwusr in the web interface...

OpenBullet 2 - Panel Detection

Openbullet was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Openbullet was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenBullet 2 - Panel Detection', 'description': 'Openbullet was detected....

Apache Struts 2 - Remote Command Execution Detection

Apache Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is susceptible to remote command injection attacks. The Jakarta Multipart parser has incorrect exception handling and error-message generation during file upload attempts, which can allow an attacker to execute arbitrary commands via a...

Apache Struts 2.0.0-2.5.25 - Remote Code Execution Detection

Apache Struts 2.0.0 through Struts 2.5.25 is susceptible to remote code execution because forced OGNL evaluation, when evaluated on raw user input in tag attributes, may allow it. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts 2.""" import re from kittysploit import from...

Yii 2 < 2.0.38 - Remote Code Execution Detection

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. !/usr/bin/env python3 -- coding: utf-8 -- """Yii 2 yiisoft/yii2 before version 2.""" from kittysploit import from lib.protocols.http.httpclient import...

CVE-2026-59248

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...

CVE-2026-8450 affecting package perl-HTTP-Daemon for versions less than 6.16-2

CVE-2026-8450 affecting package perl-HTTP-Daemon for versions less than 6.16-2. A patched version of the package is available...

TencentOS Server 2: xorg-x11-server (TSSA-2026:0764)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0764 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

CVE-2026-47219: Improper Input Validation

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup function passes req.method into...

CVE-2026-59248: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...

CVE-2026-6879: Inefficient Algorithmic Complexity

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-127 (ALASKERNEL-5.10-2026-127)

The version of kernel installed on the remote host is prior to 5.10.260-259.1054. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.10-2026-127 advisory. In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after...

Amazon Linux 2 : docker, --advisory ALAS2ECS-2026-133 (ALASECS-2026-133)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-133 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing...