EUVD-2026-111389

russh: peer-declared zero maximum packet size permanently stalls channel writes silent AsyncWrite hang...

GHSA-C6Q7-WQW2-H65W NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

Summary The URL validation regex ^https?:/?/. added to emissary's NavAction.java allows protocol-relative URLs //evil.com/... and single-slash scheme variants http:/evil.com to bypass validation, enabling SSRF and open redirect attacks. Affected Package - Ecosystem: Maven - Package:...

NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

Summary The URL validation regex ^https?:/?/. added to emissary's NavAction.java allows protocol-relative URLs //evil.com/... and single-slash scheme variants http:/evil.com to bypass validation, enabling SSRF and open redirect attacks. Affected Package - Ecosystem: Maven - Package:...

pfsense-https-host-redirect

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-https-host-redirect pfsense-https-host-redirect Class: Open redirect Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org system.inc emits a port-80 server with return 301...

OpenSSL_1.0.1g_After

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...

oss-bounty-program

ProjectDiscovery OSS Bounty Program Update: OSS Bounty Program Closed The ProjectDiscovery OSS Bounty Program is currently closed. We launched the program to reward meaningful open-source contributions, but over time we saw a growing volume of low-quality and heavily AI-generated submissions that...

CVE-2026-86259

CVE-2026-86259 - OpenMAIC 1.0.0: Unauthenticated Outbound SSRF to Cloud Metadata Service via Fail-Open Middleware and Environment-Gated Validation Bypass Overview Verified. A two-leg exploit chain exists in OpenMAIC's authentication middleware and outbound provider request layer that allows an...

CVE-2026-84178

CVE-2026-84178 — camel-oauth: authorization-code callback login CSRF missing state Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the OAuth authorization-code callback did not carry a state parameter binding it to the authorization request that started the flow, and...

CVE-Disclosures

Security Research & CVE Disclosures🔥 A repository documenting security vulnerabilities discovered in Free and Open Source Software FOSS by VETTRIVEL U There are only two types of companies: those that have been breached and know it, and those that have been breached and don’t know it yet. – ed...

stylesmuggler-ioc-toolkit

StyleSmuggler IOC Toolkit — CVE-2026-75650 Magento zero-day · Adobe Commerce zero-day · CVE-2026-75650 · APSB26-146 · VULN-39341 · unauthenticated RCE · Magento malware · Magento backdoor removal · Magento 2.4.9 vulnerability · Rust implant · GraphQL styles injection · PHP web shell Community...

gatekeeper-cve-2020-8554

Gatekeeper constraint for CVE-2020-8554 Install OPA client Follow the instructions. Run unit tests $ opa test --ignore=.yaml ./policies verbose output $ opa test -v --explain=full --format=pretty --ignore=.yaml ./policies...

DSpace__DSpace_CVE-2022-31192_5-100

DSpace DSpace Documentation | DSpace Releases | DSpace Wiki | Support Overview DSpace open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. For more information, visit...

ES-File-Explorer-Open-Port-Vulnerability---CVE-2019-6447

This repository does not have a README...

CVE-2026-73314

CVE-2026-73314: Unsupported PayPal signature algorithm accepted XenForo before 2.3.13 fails open when a PayPal REST webhook names an unsupported signature algorithm. What happens The webhook handler maps PAYPAL-AUTH-ALGO through a small allowlist. If the value is unknown, the mapped algorithm...

CVE-2026-64531

🔥 CVE-2026-64531 — OVSwrap Linux Kernel Open vSwitch Memory Corruption 🩸 Vulnerability Overview CVE-2026-64531 is a security vulnerability affecting the Linux Kernel Open vSwitch OVS networking subsystem. The flaw exists in the handling of Netlink nested attributes , where oversized action...

CVE-2026-70481

CVE-2026-70481 Open WebUI, affected 0.5.0 through 0.10.2, patched in 0.11.0. Moderate, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 and CWE-862. In backend/openwebui/routers/channels.py the message update and delete handlers branch on the channel type, and the two branches ask...

CVE-2022-24181

CVE-2022-24181 and CVE-2022-26616. both are probably same Open-journal-system-Vulnerability XSS via Host Header injection and Steal Password Reset Token of another user Step to reproduce: 1. Go to this site: https://who's-using-ojs-software.com 2. And capture this request in burp , and send to...

NINJA-PingU

NINJA PingU NINJA-PingU Is Not Just a Ping Utility is a free open-source high performance network scanner tool for large scale analyses. It has been designed with performance as its primary goal and developed as a framework to allow easy plugin creation. NINJA PingU comes out of the box with a se...

CVE-2026-62298

mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, OPEN TYPE decoding can dereference an unallocated member pointer and crash the consuming program. OPENTYPEaperget in OPENTYPEaper.c, OPENTYPEberget in OPENTYPEber.c, OPENTYPEoerget in OPENTYPEoer.c, and OPENTYPEuperget in OPENTYPEuper.c share...

CVE-2026-46560

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the RADIUS authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response...