UBUNTU-CVE-2026-49844

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

CVE-2026-49844

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

CVE-2026-49844 Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

CVE-2026-49844 Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

Modbus map registers

Maps Modbus holding/input registers or coils/discrete inputs via an active session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.icssessionmixin import ModbusSessionMixin class ModulePost, ModbusSessionMixin: info = "name": "Modbus map registers",...

JS Source Map Analyzer

Download client JS bundles, follow sourceMappingURL references, parse .map files, and extract decompiled sources, API routes, and secret literals. !/usr/bin/env python3 -- coding: utf-8 -- """ JavaScript source map analyzer — recover decompiled/original sources from .map files. Fetches bundled .j...

GPO Inheritance Map

Enumerate GPO links on domains and OUs, compute inheritance order, and map which computers are affected by each GPO. !/usr/bin/env python3 -- coding: utf-8 -- """Map Active Directory GPO inheritance and affected computers.""" from future import annotations import json from typing import Dict, Lis...

CVE-2026-59876

A flaw was found in protobufjs. The Text Format extension, responsible for compiling protobuf definitions into JavaScript functions, improperly parsed string-keyed map entries. This allowed a specially crafted map entry with the key proto to modify the prototype of the returned map object. An...

CVE-2026-15299

The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weatherstyle' and 'movedirection' parameters of the Weather widget in all versions up to, and including, 2.6.3. This is due to insufficient output escaping in the Weather widget's render...

Linux EROFS Heap Buffer Overflow DoS

The vulnerability of the zerofsdomapblocks function in the fs/erofs/zmap.c file of the EROFS Enhanced ReadOnly File System file system in the Linux operating system is related to copying buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this...

EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-2591)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv...

EulerOS 2.0 SP12 : xorg-x11-server (EulerOS-SA-2026-2577)

According to the versions of the xorg-x11-server packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the...

GHSA-G586-CCQF-7X4R mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

Summary Mint's HTTP/2 client accepts PUSHPROMISE frames from any server it connects to and inserts every promised stream into a per-connection map without consulting maxconcurrentstreams. A malicious or compromised HTTP/2 server can flood the client with PUSHPROMISE frames and withhold the matchi...

CVE-2026-57019

An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine pfe of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service DoS. When a specific packet is received from device in the same broadcast...

CVE-2026-57019

CVE-2026-57019 affects Junos OS on MX Series. An issue in the Packet Forwarding Engine (pfe) due to improper validation of a specified quantity in input can allow an unauthenticated adjacent attacker to cause a Denial-of-Service by triggering an FPC major error and a reset, impacting traffic unti...

CVE-2026-57019 Junos OS: MX Series: Specific traffic causes an FPC to reset

An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine pfe of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service DoS. When a specific packet is received from device in the same broadcast...

PYSEC-2026-3135 Null-dereference in Tensorflow

Impact The implementation of GetInitOp is vulnerable to a crash caused by dereferencing a null pointer: cc const auto& initopsigit = metagraphdef.signaturedef.findkSavedModelInitOpSignatureKey; if initopsigit != sigdefmap.end initopname = initopsigit-second.outputs...

Integer overflows in Tensorflow

Impact The implementation of AddManySparseToTensorsMap is vulnerable to an integer overflow which results in a CHECK-fail when building new TensorShape objects so, an assert failure based denial of service:pythonimport tensorflow as tfimport numpy as nptf.rawops.AddManySparseToTensorsMap...

ALPINE-CVE-2025-58146

There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This causes the database's event thread to terminate and cease further processing. 2. XAPI's UTF-8 encoder implements v3.0 of the Unicode spec, but...

CVE-2025-58146

There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This causes the database's event thread to terminate and cease further processing. 2. XAPI's UTF-8 encoder implements v3.0 of the Unicode spec, but...