6658 matches found
NextJS-CVE-2025-29927
🔓 NextJS-CVE-2025-29927 - Aplicación Demo Vulnerable Esta es una aplicación vulnerable de Next.js que demuestra CVE-2025-29927 , una falla de seguridad identificada en aplicaciones web que utilizan Next.js con manejo inadecuado de entradas o fallas en el control de acceso. El proyecto utiliza un...
CVE-2026-89538
A flaw was found in the Linux kernel's Server Unix Remote Procedure Call SUNRPC component. A remote attacker, with a valid Generic Security Service GSS context, could send a specially crafted Kerberos v2 wrap token with an oversized "extra count" ec field. This improper handling of malformed toke...
Alfred
WIP - Alfred Renovado 2.0 Alfred - Un Framework Modular de Reconocimiento y Explotación FASE EXPERIMENTAL Alfred es un framework basado en Python diseñado para ayudar en diversas tareas de reconocimiento, explotación y post-explotación. Es altamente modular, permitiendo a los usuarios añadir...
PYSEC-2026-3971 PyTorch Lightning denial of service vulnerability
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...
CVE-2026-87542
A flaw was found in chromium-browser. This vulnerability, a 'use after free' error in the input handling, allows a remote attacker to execute arbitrary code. By enticing a user to visit a specially crafted HTML page, an attacker could bypass security measures and run malicious code within the...
CVE-2024-23113
CVE-2024-23113 该脚本用于检测 CVE-2024-23113，这是一个 FortiGate FGFM 服务（FortiGate 到 FortiManager 协议）中的格式字符串漏洞，该服务运行在 TCP 端口 541 上。漏洞产生的原因在于攻击者可以控制一个格式字符串，这可能导致远程代码执行（RCE）或其他非预期行为。FGFM 服务允许 FortiGate 设备与 FortiManager 之间进行配置管理通信，未修补版本对输入处理不当，从而易受格式字符串攻击。 脚本工作原理 1. 网络连接建立 ： 脚本首先与目标主机的 541 端口建立 SSL/TLS 连接。 它使用...
CVE-2026-78550
The Okta Access Gateway management console is vulnerable to improper input handling in its exception handler . During an authenticated administrator SSH session, user-supplied input is passed to eval() without sanitization, resulting in arbitrary code execution with the privileges of the manageme...
-CVE-2024-45352
🚨 CVE-2024-45352 – Ejecución Remota de Código RCE en Xiaomi Smarthome 📌 Resumen Se descubrió una vulnerabilidad crítica CVE-2024-45352 en la aplicación Xiaomi Smarthome, que permite la ejecución remota de código RCE sin autenticación mediante un manejo inadecuado de la entrada en el analizador de...
CVE-2026-85303
CVE-2026-85303 affects the Booking and Rental Manager WordPress plugin by Magepeople inc. , with a Stored XSS vulnerability present in versions from unspecified through 2.7.7 . The flaw stems from improper neutralization of input during web page generation, allowing an attacker with low privilege...
CVE-2025-15489 Passster < 4.2.24 - Password Protection Bypass
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...
CVE-2026-84357
An improper input validation flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523208474 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produc...
CVE-2026-19472
A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability...
CVE-2026-15917
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2...
CVE-2026-79248
Incorrect authorization in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
The vulnerability of the Audio/Video component in Firefox ESR, Firefox, and the Thunderbird email client allows a hacker to trigger a service failure.
The vulnerability of the Audio/Video component in Firefox ESR, Firefox, and the Thunderbird email client is related to improper handling of certain physical or natural conditions. Exploiting this vulnerability can allow an attacker to cause service failures...
MINI-WWXC-G58X-C8RQ
Bulletin has no description...
USN-8652-1 libvirt vulnerabilities
It was discovered that libvirt incorrectly handled guest reboots in the libxl driver. An attacker in a guest could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. CVE-2021-4147 Alexander Kuznetsov discovere...
MINI-GPFQ-6JX6-7R2W
Bulletin has no description...
