React2Shell_cve-2025-55182

RCE em React Server Components - CVE-2025-55182 Olá! Espero que você esteja tendo um ótimo dia! 😊✨ Sobre o que é isso? As versões 19.0.0 , 19.1.0 , 19.1.1 e 19.2.0 do React Server Components têm um sério problema de segurança. Os pacotes react-server-dom-parcel, react-server-dom-turbopack e...

andriller

Andriller CE Community Edition Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices. It has features, such as powerful Lockscreen cracking for Pattern, PIN code, or Password...

dissect.cobaltstrike

Cobalt Strike mit Python analysieren .. image:: https://github.com/fox-it/dissect.cobaltstrike/workflows/Tests/badge.svg :target: https://github.com/fox-it/dissect.cobaltstrike/actions :alt: GitHub Actions status .. image:: https://readthedocs.org/projects/dissect-cobaltstrike/badge/?version=late...

Linux Distros Unpatched Vulnerability : CVE-2026-62982

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and...

EUVD-2026-57314

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...

CVE-2026-68340

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only...

DEBIAN-CVE-2026-18497

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbttGetGlyphShapeTT function within the nothings stbtruetype.h library when parsing malformed TTF TrueType Font file...

CVE-2026-18497 The nothings stb TrueType library contains a heap buffer overflow vulnerability

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbttGetGlyphShapeTT function within the nothings stbtruetype.h library when parsing malformed TTF TrueType Font file...

CVE-2026-54212

CVE-2026-54212 affects Tobit Laboratories AG TeamDavid’s Webbox — an API endpoint is vulnerable to a buffer overflow in JSON parsing. A crafted JSON body (e.g., ≥8 chars starting with a number) can crash the server, causing denial of service and, depending on stack state or potential stack canary...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the OERInputStream.parseElement method, which processes the SEQ, CHOICE, and Supplier children of an IEEE 1609.2 structure recursively without enforcing a depth limit. An attacker can crash the parsing thread o...

Linux Distros Unpatched Vulnerability : CVE-2026-51298

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree, the program still access...

USN-8586-1 libgphoto2 vulnerabilities

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS image format data. An attacker with physical access could possibly use this issue to obtain sensitive information. CVE-2026-40333 It was discovered that libgphoto2 did not properly null-terminate buffer...

PT-2026-63392

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.25.2 Description A heap buffer overflow occurs when the validator builds the canonical RDATA form for an RRSIG-covered PX, RP, MINFO, or SOA RRset. The system computes the address of the second embedded...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the buildPath function of lib/helpers/formDataToJSON.js, which recurses over bracket-delimited...

CVE-2026-55639

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation...

CVE-2026-55639 xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY)

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation...

CVE-2026-55639 xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY)

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation...

JLSEC-2026-744 Heap buffer overread in `wc_PKCS7_DecodeEnvelopedData` when parsing crafted PKCS7 EnvelopedData

Heap buffer overread in wcPKCS7DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS...

httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the ajpparsedata function attempts to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially lea...

python-multipart vulnerable to Content-Type Header ReDoS

SummaryWhen using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options.An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely minutes or...