CVE-2026-84379 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

EUVD-2026-70246

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

CVE-2026-84379

HTTPX2 , a next-generation HTTP client for Python, is affected by a multipart part header injection vulnerability in FileField.render_headers() within src/httpx2/httpx2/_multipart.py. Prior to 2.11.0 , attacker-controlled content_type values and custom headers from files= tuples are interpolated ...

cpanel-malware-cleaner-cve-2026

🚨 Nettoyeur de Malware cPanel – Outil de Correction CVE-2026-41940 Un outil de sécurité léger et puissant pour détecter, supprimer et prévenir les infections par malware causées par les récentes vulnérabilités cPanel, notamment CVE-2026-41940. 🔥 Fonctionnalités Détecte et supprime les malwares,...

Exploit for OS Command Injection in Vsftpd_Project Vsftpd

vsFTPd 2.3.4 Exploit Python Proof of Concept for the vsFTPd...

EUVD-2026-70241

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...

CVE-2026-82522 libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...

CVE-2026-82522

libjxl before version 0.12.0 contains an integer underflow vulnerability in the container box parser . On 32-bit platforms , 64-bit box sizes are truncated to size_t, allowing a remote attacker to supply a crafted JPEG XL file that causes the decoder to parse attacker-controlled codestream bytes ...

CVE-2026-82522 libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...

CVE-2026-42568

CVE-2026-42568 — حقن LDAP في LdapAuthModule في YAMCS ملخص توجد ثغرة حقن LDAP في org.yamcs.security.LdapAuthModule. يتم إدخال اسم المستخدم مباشرة في مرشحات بحث LDAP دون هروب RFC 4515، مما يسمح بتجاوز المصادقة...

CVE-2026-9082

ماسح Drupal CVE-2026-9082 ماسح شبه سلبي يكتشف تثبيتات Drupal التي قد تكون عرضة لـ CVE-2026-9082 حقن SQL في PostgreSQL. لا يتم إرسال أي حمولات SQL. لا توجد طلبات تغير الحالة. الإصدارات الضعيفة الفرع| المتأثر| المُصحَّح ---|---|--- 10.4.x| 8.9.0 — 10.4.9| 10.4.10 10.5.x| 10.5.0 — 10.5.9| 10.5.10...

CVE-2025-11844-smolagents

🔐 إطار محاكاة حقن XPath Smolagents CVE-2025-11844 صندوق رمل تدقيقي تعليمي وماسح ضوئي ديناميكي لإثبات المفهوم يوضح ثغرة حقن XPath الموجودة في مكتبة smolagents من Hugging Face حتى الإصدار 1.2.0. 🔍 ملف الثغرة...

agentic-ioc-scanner

agentic-ioc-scanner ماسح IOC لأدوات الترميز الذكية AI coding tools — يكتشف Mini Shai-Hulud و Gemini CLI RCE و Cursor CVE-2026-26268 و DPRK PromptMink. مجموعة كشف لاختراق المساعدين البرمجيين الذكيين Claude Code، Gemini CLI، Cursor والتبعيات التي يسحبونها إلى مستودعاتك. إحدى عشرة فحصًا تشمل حقن...

Orbit-Fox_SSRF_CVE-2025-10874

CVE-2025-10874 - Preuve de concept SSRF Orbit Fox Preuve de concept d'exploitation démontrant une vulnérabilité de type Server-Side Request Forgery SSRF dans le plugin WordPress Orbit Fox avec contournement par injection d'octet nul. Article de blog détaillé :...

CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

CVE-2026-79754

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a...

CVE-2026-79755

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command that is executed via the host...

CVE-2026-52833

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which...

CVE-2026-52831

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...