CVE-2026-79982 Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

EUVD-2026-97733

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback...

CVE-2026-55888

A flaw was found in xdg-desktop-portal. An attacker operating a sandboxed application can bypass isolation boundaries to gain unauthorized access to host files. This issue occurs because the FileChooser interface fails to properly validate filenames before passing them to backend services...

CVE-2026-115378

A flaw was found in Incus. A privileged attacker within a virtual machine can write arbitrary files to the host system during a recursive file pull operation. By manipulating the guest agent to return duplicate file entries alternating between symbolic links and regular files, the attacker can...

viper

This repository is archived and development of Viper 1.x is discontinued. A full refactor of the project started withViper 2. Viper is a binary analysis and management framework. Its fundamental objective is to provide a solution to easily organize your collection of malware and exploit samples a...

CVE-2026-57209

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly int...

CVE-2026-57209 Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly int...

CVE-2026-57209 Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly int...

EUVD-2026-108749

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly int...

CVE-2026-57209

Heimdall, a cloud-native Identity Aware Proxy, contains a Forwarded Header Injection vulnerability in versions prior to 0.17.17 when operating in proxy mode. The root cause is located in proxy/request_context.go, where the software inserts the incoming request's Host header directly into the Forw...

check-cve-2019-19781

check-cve-2019-19781 🔎🐞 This utility determines if a host appears susceptible to CVE-2019-19781. Requirements Python versions 3.6 and above. Note that Python 2 is not supported. Installation From a release: pip install...

CVE-2026-86055

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who...

AgentSmith-HIDS

AgentSmith-HIDS --The name of this project was inspired by the movie - The Matrix English | 简体中文 THIS REPO IS OLD RELEASE VERSION: https://github.com/bytedance/Elkeid About AgentSmith-HIDS Technically, AgentSmith-HIDS is not a Host-based Intrusion Detection System HIDS due to lack of rule engine...

CVE-2026-86055

The Part-DB open-source inventory management system is vulnerable to Password Reset Link Poisoning via Host Header Injection in versions prior to 2.13.3 . The root cause is the lack of trusted-host validation when building the absolute URL for password-reset emails. An unauthenticated attacker ca...

CVE-2026-86055 Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who...

CVE-2026-86055 Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who...

EUVD-2026-108581

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who...

jfscan

!CAUTION ⚠️ Project Deprecated This project has been rewritten in Go for better performance and features. Please use the new version here: nullt3r/massmap Description Killing features Unleash the power of Nmap with Masscan for large-scale scans Scan targets using domain names and other formats...

Malicious code in @ecg-internal/js-react-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 533583f613bf03556a1660b5bd8eaf4d5899c96dc79f4c42ae6b883aea8fde0e The package is published under an internal-looking scope @ecg-internal and ships a stub main module that returns a Proxy of no-op functions for every...

Malicious code in @ecg-internal/aurora-js-formatters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02325fb617beffd55194047faca7300b33934cd471de94bab66a24954200cba0 The package uses an internal-looking scope @ecg-internal and an implausibly high version 99.0.1 consistent with dependency-confusion targeting. On...