socialscan

socialscan socialscan offers accurate and fast checks for email address and username usage on online platforms. Given an email address or username, socialscan returns whether it is available, taken or invalid on online platforms. Features that differentiate socialscan from similar tools e.g...

CVE-2025-27210_NodeJS_Path_Traversal_Exploit

CVE-2025-27210NodeJSPathTraversalExploiter Proof of Concept CVE-2025-27210，一种精确的路径遍历漏洞，影响在 Microsoft Windows 上运行的 Node.js 应用程序。该漏洞利用了 Windows 处理保留设备文件名（例如 AUX、CON、NUL）时的特定方式，结合路径中的目录遍历序列（../），这些路径由 path.join 或 path.normalize 等函数处理。 python CVE-2025-27210NodeJSPathTraversalExploiter.py -t...

NPM: msgpack5: Reserved byte can cause unbounded stream buffering

NPM: msgpack5: Reserved byte can cause unbounded stream buffering vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...

CVE-2022-39197

CVE-2022-39197 CVE-2022-39197 "ID": "CVE-2022-39197", "STATE": "RESERVED"...

CVE-2023-5648

In Brocade ASCG versions prior to v3.0 , several security-related HTTP Headers are missing across various URL paths. This oversight allows unauthenticated attackers to perform various attacks, including Cross-Site Scripting (XSS) , Clickjacking , and Information disclosure . The vulnerability is ...

CVE-2026-96400

With migrations ALLOWEDDOMAINS set to a matching entry such as or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as 169.254.169.254, even when ALLOWLOCALNETWORKS = false. The local-network block list did not cover these ranges, and a...

CVE-2026-96400 Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS

With migrations ALLOWEDDOMAINS set to a matching entry such as or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as 169.254.169.254, even when ALLOWLOCALNETWORKS = false. The local-network block list did not cover these ranges, and a...

CVE-2026-96400

The Gitea migration functionality is vulnerable to a Server-Side Request Forgery (SSRF) when the [migrations] ALLOWED_DOMAINS configuration is set to a wildcard (e.g., *) or a hostname wildcard. The underlying cause is that the local-network block list fails to cover reserved and link-local addre...

CVE-2026-96400 Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS

With migrations ALLOWEDDOMAINS set to a matching entry such as or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as 169.254.169.254, even when ALLOWLOCALNETWORKS = false. The local-network block list did not cover these ranges, and a...

CVE-2026-96400 Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS

With migrations ALLOWEDDOMAINS set to a matching entry such as or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as 169.254.169.254, even when ALLOWLOCALNETWORKS = false. The local-network block list did not cover these ranges, and a...

Astra Linux – Vulnerability in p7zip

7-Zip 22.01 does not report an error for certain invalid xz files that involve stream flags and reserved bits. Some later versions are unaffected...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: EFI: In runtime mode, a potential overflow of the size of the soft-reserved region has been fixed. If there are pages worth ≥ 4GB in a soft-reserved region, the value of mdsize will be reduced...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: nexthop: All fields within the struct nexthopgrp structure must be initialized. The struct nexthopgrp contains two reserved fields that are not initialized by nlaputnhgroup, and these fields contain garbage values. This can ...

BIT-PHP-MIN-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

BIT-PHP-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

PT-2026-105143

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

SUSE CVE-2026-17545

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection

Prompt injection against LLM agents becomes much stronger when the injected instruction is wrapped in the model's own chat template. A forged template marker such as can reach the model either as a single reserved control token or as a sequence of ordinary subword tokens. The two decode to exactl...

CVE-2026-100674

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...

EUVD-2026-87768

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...