CVE-2024-29050

CVE-2024-29050 CVE-2024-29050 is a security vulnerability in Windows' cryptographic services, particularly in how certificates are processed during cryptographic operations. The issue stems from an integer overflow, which occurs when calculations on data like file sizes or buffer lengths exceed t...

Blackash-CVE-2025-54574

🛑 CVE-2025-54574 — Heap Buffer Overflow in Squid ≤ 6.3 🛑 Severity: Critical CVSS 9.3 Affected Software: Squid Proxy versions 6.3 and earlier Vulnerability Type: Heap-based buffer overflow Discovered in: URN Uniform Resource Name processing Impact: Possible remote code execution or denial-of-servi...

[SECURITY] [DSA 6552-1] vips security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6552-1 [email protected] https://www.debian.org/security/ Tianyu Chen October 11, 2026 https://www.debian.org/security/faq -...

CVE-2021-29440

CVE-2021-29440 Unsafe Twig processing of static pages leading to RCE in Grav CMS 1.7.10 Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this...

CVE-2025-50420

Poppler before version 25.07.0 contains a vulnerability in its pdfseparate utility's PDFDoc processing logic: crafted "/Annots" dictionaries that reference themselves or each other lead to infinite recursion in "PDFDoc::markAnnotations -- PDFDoc::markPageObjects -- PDFDoc::markObject --...

cve-2025-61882-oracle_ebs_rce_reproduction

CVE-2025-61882 — Oracle E-Business Suite Unauthenticated Remote Code Execution CVSS 9.8 CRITICAL Overview CVE-2025-61882 is an unauthenticated remote code execution vulnerability in Oracle E-Business Suite EBS, affecting the Concurrent Processing and BI Publisher components. The flaw allows an...

TYPO3-HTML-Sanitizer-XSS-CVE-2023-47125

Stored XSS exploit in TYPO3 HTML Sanitizer CVE-2023-47125 Description DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. Vuln versions = 1.0.0, = 2.0.0,...

CVE-2026-98255

A flaw was found in the Linux kernel. Its TCP Transmission Control Protocol fast-path processing logic fails to properly filter out-of-bounds acknowledgment ACK packets before validating them. A remote attacker could exploit this vulnerability by sending network packets with outdated ACK numbers,...

Exploit for Improper Privilege Management in Microsoft

CVE-2026-69414 — Microsoft Malware Protection Engine EoP Explo...

CVE-2021-21239-Exploit

Detail report below https://docs.google.com/document/d/157fGn7lLP1uBuRz8zUgRDWTDklKznljeOWwRQ-C6uFg/edit?usp=sharing Usage python main.py...

xlsx

SheetJS The SheetJS Community Edition offers battle-tested open-source solutions for extracting useful data from almost any complex spreadsheet and generating new spreadsheets that will work with legacy and modern software alike. SheetJS Pro offers solutions beyond data processing: Edit complex...

AutoHoneyPoC

AutoHoneyPoC AutoPoC Generator HoneyPoC ultimate edition. If this is the first time you've heard of or seen the project, you'll want to read the blog post. https://blog.zsec.uk/honeypoc-ultimate/ While I'm releasing AutoPoC, the framework on its own is harmless as it requires some pre-requisites ...

CVE-2025-54574-Squid-Heap-Buffer-Overflow

CVE-2025-54574-Squid-Heap-Buffer-Overflow Vulnerability Found on Squid Proxy. CVE-2025-54574 — Critical Heap Buffer Overflow in Squid Proxy This repository documents the discovery, analysis, and responsible disclosure process of CVE-2025-54574, a critical heap-based buffer overflow in Squid 6.4...

Linux Distros Unpatched Vulnerability : CVE-2026-106434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An...

KeyDecoder

KeyDecoder KeyDecoder is a mobile app created for pentesters and security enthusiasts. From the picture of a key, one can measure its bitting easily. Developped by Maxime BEASSE and Quentin CLEMENT. In partnership with FrenchKey and CNS from ESIEA. Powered by Flutter 3.13.6 and OpenCV 4.3.0 Summa...

gha-lab-61c59f4acb

FastGPT English | 简体中文 | Bahasa Indonesia | ไทย | Tiếng Việt | 日本語 FastGPT is an AI Agent building platform that provides out-of-the-box capabilities for data processing and model invocation. It also enables workflow orchestration through Flow visualization, allowing you to achieve complex...

ffufPostprocessing

Ffuf: Post processing Unfortunately - despite its "-ac" flag, ffuf tends to produce a lot of irrelevant entries. This is why I've created a post-processing tool to filter out those entries. Additionally, I saw a lot of relevant entries removed when "-ac" was used - especially when ffuf encounters...

CVE-2026-107852

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

EUVD-2026-95926

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...