CVE-2026-23416-POC

CVE-2026-23416 — PoC mm/mseal: update VMA end correctly on merge Vulnerability discovered by Antonius / Blue Dragon Security Overview...

revng-c

This repository has been merged into rev.ng's main repository...

anteater

Anteater - CI/CD 门禁检查框架 描述 Anteater 是一个开放框架，用于防止将指定的字符串、文件名、二进制文件、已弃用的函数、staging 环境代码/凭证等不合意的内容合并。任何可以用正则表达式语法指定的内容，都可以被 Anteater 嗅探出来。 你告诉 Anteater 你确切不想合并什么，剩下的由 Anteater 处理。 如果 Anteater 发现了什么，它会以非零码退出，从而使你的 CI 工具构建失败，从而防止拉取请求合并。任何误报都可以通过使用相同的 RegExp 框架来取消错误匹配，从而轻松解决。 整个项目也可以通过递归目录遍历进行扫描。...

golismero

What's GoLismero? GoLismero is an open source framework for security testing. It's currently geared towards web security, but it can easily be expanded to other kinds of scans. The most interesting features of the framework are: Real platform independence. Tested on Windows, Linux, BSD and OS X. ...

CVE-2026-92680

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...

CVE-2026-60004-gitea-0day

CVE-2026-60004 - Gitea = 1.27.0 Pre-Auth RCE This is a proof-of-concept exploit for CVE-2026-60004, a critical remote code execution vulnerability in Gitea versions 1.17 through 1.27.0. The script automates the full exploitation chain, from user registration to establishing a stable, interactive...

CVE-2026-60004

CVE-2026-60004 — Gitea diffpatch RCE Remote code execution PoC for the Gitea diffpatch endpoint. An account with write access to a repository on instances with open registration, simply registering an account suffices can execute arbitrary shell commands on the server as the Gitea service account...

CVE-2026-3030-Prototype-Pollution-in-JSON-Merge-Patch

CVE-2026-3030 – Prototype Pollution in JSON Merge Patch Program Code Node.js root@kitploit: // server.js - Vulnerable REST API with deep merge const express = require'express'; const app = express; app.useexpress.json; let config = role: 'user', settings: ; // Insecure deep merge function...

CVE-2026-92680

CVE-2026-92680 Araxis Merge para Windows almacena las credenciales del servidor con DPAPI con pOptionalEntropy establecido en NULL. Esto permite que cualquier código que se ejecute en el mismo contexto de usuario las descifre. Análisis completo: https://grepstrength.com/research/araxis-merge |...

EUVD-2026-85933

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...

CVE-2026-92680

Araxis Merge for Windows versions 2011.4074 through 2026.0 are vulnerable to insufficient protection of user-configured credentials for remote servers. The software stores these credentials in the Windows registry without applying adequate cryptographic protection. An authenticated, non-administr...

CVE-2026-92530

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on t...

CVE-2026-92530 Use of Less Trusted Source in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on t...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

GitLab 19.1 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-92530)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpq (UTSA-2023-002897)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002897 advisory. A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. ...

merge-authz-test

merge-authz-test authz test CVE-2026-1999 siblings...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in js-yaml (CVE-2026-59869)

Summary A Prototype Pollution vulnerability in the js-yaml document parsing library CVE-2026-59869 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 4.3.1. Vulnerability Details CVEID:CVE-2026-59869 DESCRIPTION: js-yaml is a JavaScript YAML parse...