halo-cve-2026-67919

halo plugin rce da un URL La console di halo consente agli amministratori di installare e aggiornare plugin incollando un URL. Recupera qualsiasi URL, installa il jar e il codice del jar viene eseguito sul server. Nessun controllo sullo schema, nessun controllo sull'host, i redirect vengono...

CVE-2026-5061

CVE-2026-5061 Consul Template hat validiert, wohin ein Symlink während der Template-Auswertung zeigte, aber der spätere Abruf der Abhängigkeit las den ursprünglichen Pfad. Wenn der Link zwischen diesen Vorgängen umgebogen wurde, wurde aus einem Dateiverweis innerhalb der Sandbox eine...

CVE-2026-107581

Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY...

Triple_fetch

triplefetch - ianbeer https://bugs.chromium.org/p/project-zero/issues/detail?id=1247 Questa è un exploit per CVE-2017-7047, un errore logico in libxpc che consentiva a mittenti di messaggi malintenzionati di inviare oggetti xpcdata supportati da memoria condivisa. I consumatori di messaggi xpc no...

EUVD-2026-94863

Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY...

CVE-2026-107581 Inefficient Algorithmic Complexity in hMailServer

Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY...

CVE-2026-107581 Inefficient Algorithmic Complexity in hMailServer

Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY...

CVE-2026-107581

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 are vulnerable to Inefficient Algorithmic Complexity (CWE-407) and Excessive Memory Consumption (CWE-400) via IMAP commands. The vulnerability stems from several issues: the FETCH data-item parser uses a case-insensitive string replacemen...

CVE-2026-103649

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

EUVD-2026-94835

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

CVE-2026-103649 Synchronous Access of Remote Resource without Timeout in hMailServer

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

CVE-2026-103649 Synchronous Access of Remote Resource without Timeout in hMailServer

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

CVE-2026-103649

Linux builds of Progressive Robot hMailServer versions 6.3.0 through 6.3.5 are vulnerable to a denial of service (DoS) due to missing network timeouts. The root cause is that the server sets socket timeouts in a Windows-specific format which Linux rejects, causing HTTPS clients to read without a ...

Malicious Package

Overview node-fetch-lite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview cdn-img-fetch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-108032

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web fetch tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML...

PT-2026-108054

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web fetch tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. ...

GHSA-P3FW-7699-7926 Docling: Configured HTTP headers sent to every remote image host named by a document

Summary HTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled...

Docling: Configured HTTP headers sent to every remote image host named by a document

Summary HTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled...

CVE-2025-8110-PoC

CVE-2025-8110 PoC Script proof-of-concept in Python per CVE-2025-8110 — Gogs v0.13.3 UpdateRepoFile symlink RCE. Colpo singolo: la stessa PUT malevola attiva git fetch → sshCommand → reverse shell. ⚠️ Solo per scopi educativi e ricerca di sicurezza autorizzata. Eseguire questo strumento contro...