EUVD-2025-201222

In the Linux kernel, the following vulnerability has been resolved: fs/notify: call exportfsencodefid with sumount Calling intotifyshowfdinfo on fd watching an overlayfs inode, while the overlayfs is being unmounted, can lead to dereferencing NULL ptr. This issue was found by syzkaller. Race...

CVE-2025-66373

Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body that includes a chunk size different from the actual size of the following chunk data, under certain...

CVE-2025-9127: Improper Encoding or Escaping of Output

A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions...

PT-2026-7416

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description The internal locking mechanism within the MongoDB server utilizes an internal encoding of resources to determine which lock to acquire. A collision can occur where collections inadvertently...

CVE-2025-66373

Akamai Ghost, an HTTP service program from Akamai Corporation , is vulnerable to HTTP request smuggling due to a chunked request body processing error in versions prior to 2025-11-17 . When the system receives an invalid chunked body where the specified chunk size differs from the actual data siz...

RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.0.11 (RHSA-2025:22775)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22775 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release ...

Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows...

DEBIAN-CVE-2024-3884

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows...

CVE-2024-3884 Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows...

CVE-2024-3884 Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows...

CVE-2024-3884

A flaw in the Undertow web server component allows for a remote denial of service (DoS) attack. When the server utilizes the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to process large form data with application/x-www-form-urlencoded encoding, it triggers an OutOfMemory issue. ...

CVE-2024-3884

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows...

PT-2025-48972

Name of the Vulnerable Software and Affected Versions Undertow affected versions not specified Description A flaw exists in Undertow that may lead to remote denial of service attacks. Specifically, when the server utilizes the FormEncodedDataDefinition.doParseStreamSourceChannel method to process...

CVE-2025-66373: HTTP Request Smuggling Due to Invalid Chunked Body Size

...

Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes

In Eclipse Paho Go MQTT v3.1 library paho.mqtt.golang versions =1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server for example, part of an MQTT topic may leak into...

CVE-2025-55129: Improper Handling of Unicode Encoding

HackerOne community member Kassem S.kassems94 has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for CVE-2025-52672, via several alternate techniques. Homoglyphs based impersonation has been independently reported by other HackerOne...

JavaScript Base64 Encoder

Encodes JavaScript code in base64 with atob decoder from kittysploit import import base64 class ModuleEncoder: info = "name": "JavaScript Base64 Encoder", "description": "Encodes JavaScript code in base64 with atob decoder", "author": "KittySploit Team", "platform": Platform.JAVASCRIPT, Options...

JavaScript CharCode Encoder

Encodes JavaScript using String.fromCharCode with numeric ASCII values from kittysploit import class ModuleEncoder: info = "name": "JavaScript CharCode Encoder", "description": "Encodes JavaScript using String.fromCharCode with numeric ASCII values", "author": "KittySploit Team", "platform":...

Exploit for OS Command Injection in Xstream

CVE-2020-26217 XStream RCE Exploit XStream remote code execut...

EUVD-2025-199999

A cross-site scripting XSS vulnerability exists in the Blood Bank Management System within the abs.php component. The application fails to properly sanitize or encode user-supplied input before rendering it in response. An attacker can inject malicious JavaScript payloads into the msg parameter,...