DEBIAN-CVE-2026-115927

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

CVE-2026-115927

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

CVE-2026-115927

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

UBUNTU-CVE-2026-115927

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

CVE-2026-115927

The Python web framework and asynchronous networking library Tornado is vulnerable to event loop blocking and excessive memory consumption in versions prior to 6.6.0 . The root cause lies in how Tornado decodes HTTP/1.1 chunked transfer encoding , where it processes already-arrived body data with...

CVE-2026-115927 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

CVE-2026-115927 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

CVE-2026-115927

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

CVE-2026-115927 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

ZoneMinder CVE-2024-51482 SQLi Detect

Fingerprints ZoneMinder and probes ajax/event removetag tid parameter boolean SQLi requires a valid ZMSESSID. !/usr/bin/env python3 -- coding: utf-8 -- """ZoneMinder CVE-2024-51482 removetag SQLi surface authenticated oracle.""" from kittysploit import from lib.protocols.http.httpclient import...

Cross-site Scripting (XSS)

Overview HtmlSanitizer is a Cleans HTML from constructs that can be used for cross site scripting XSS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the SanitizeDom process. An attacker can execute arbitrary scripts in the context of the application by supplying...

CVE-2026-116538

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

CVE-2026-116538 HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

CVE-2026-116538

The HtmlSanitizer library (versions before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta ) is vulnerable to Cross-Site Scripting (XSS) . The root cause is that the SanitizeDom(string) function fails to sanitize attributes on the and wrapper elements. An attacker can provide input containi...

EUVD-2026-109908

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

CVE-2026-116538

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

CVE-2026-116538 HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

CVE-2026-116538 HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses

A flaw was found in FreeIPMI. This vulnerability, a stack-based buffer overflow, occurs when the software processes malformed Fujitsu System Event Log SEL responses. An attacker could exploit this by providing specially crafted SEL data, potentially requiring user interaction, to achieve arbitrar...

FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses

A flaw was found in FreeIPMI. This vulnerability, a stack-based buffer overflow, occurs when the software processes malformed Fujitsu System Event Log SEL responses. An attacker could exploit this by providing specially crafted SEL data, potentially requiring user interaction, to achieve arbitrar...