CVE-2026-107381

The svg-sanitizer PHP library is vulnerable to a Denial of Service (DoS) attack due to a case-sensitivity mismatch in how it processes SVG elements. Prior to version 1.0.0 , the Resolver::processReferences() function uses a case-sensitive XPath predicate to build the reference graph. An attacker...

CVE-2026-107381

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences in src/ElementReference/Resolver.php builds the SVG reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes normalizes mixed-case names. An attacker can provide xlink:HrEf on...

CVE-2026-107381 svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences in src/ElementReference/Resolver.php builds the SVG reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes normalizes mixed-case names. An attacker can provide xlink:HrEf on...

SUSE-SU-2026:4657-1 Security update for bind

This update for bind fixes the following issues: - CVE-2026-19666: Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path bsc1280433. - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dnsncacheadd bsc1280435. - CVE-2026-80274: Validating resolver can abort whi...

CVE-2021-23017

CVE-2021-23017 PoC Scanner NGINX DNS Overflow Vulnerability Check - CVE-2021-23017 PoC This Python script checks if an nginx server is potentially vulnerable to the critical CVE-2021-23017 vulnerability, which affects the integrated DNS resolver in nginx and can cause a buffer overflow. 🔍 What do...

DNS-Poisoning-Triage-Lab

DNS and ARP Traffic Triage Lab An educational packet-analysis and resolver-hardening exercise completed on an Arch Linux workstation. Scope: This repository is a learning project. The included capture is useful for practicing DNS and ARP inspection, but it does not by itself prove a live...

rsync: Fix of 6 CVEs

CVE-2026-53784: confine the daemon's absolute chdir target with a new ownership-walk resolver so a planted parent symlink cannot steer a "use chroot = no" module root outside the module - CVE-2026-53786: strip a real moduledir prefix before the daemon-filter check on a merge-file path -- leaving...

Security update for bind

This update for bind fixes the following issues: CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification bsc1280430. CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver bsc1280432. CVE-2026-19666: Use-after-free in...

SUSE-SU-2026:4635-1 Security update for bind

This update for bind fixes the following issues: - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification bsc1280430. - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver bsc1280432. - CVE-2026-19666: Use-after-free in...

CVE-2026-5432-GraphQL-Batching-Alias-Confusion-SQL-Injection

7. CVE-2026-5432 – GraphQL Batching Alias Confusion SQL Injection Overview A GraphQL resolver constructs SQL queries dynamically from field aliases. By using batching and aliases, an attacker bypasses an allow‑list and injects SQL. Severity: Critical Database Takeover Node.js Server & Exploit //...

EUVD-2026-98158

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

kresd DNS Resolver Code Execution

The vulnerability of the kresd DNS resolver’s knot resolver component is related to incorrect configuration data input. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

apache__sling-org-apache-sling-servlets-resolver_CVE-2024-23673_2-10-0

Apache Sling Servlet Resolver This module is part of the Apache Sling project. Bundle implementing the Sling API ServletResolver. See the servlets and scripts documentation for how this works...

DEBIAN-CVE-2026-109595

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

CVE-2026-109595 Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

CVE-2026-109595 Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

CVE-2026-109595

Hugo versions v0.84.0 before v0.167.0 are vulnerable to a path traversal vulnerability. The issue resides in the ESBuild fallback resolver used by the js.Build , js.Batch , and css.Build functions. This allows malicious themes or modules to use relative imports or symlinks to read files outside t...

CVE-2015-7547

CVE-2015-7547 https://github.com/fjserna/CVE-2015-7547 So I tried to see if many things crash on CentOS6. ./CVE-2015-7547-poc.py & vi /etc/resolve.conf --------------------------------------------------------------- options single-request-reopen nameserver 8.8.8.8 nameserver 127.0.0.1...

CrystalPotato

CrystalPotato Crystal port of GodPotato, a local privilege escalation from accounts with SeImpersonatePrivilege to SYSTEM. It works by abusing the DCOM OXID Resolver and named pipe impersonation. Windows APIs are resolved dynamically and invoked through indirect syscall stubs, all strings are...

reSolver

reSolver - CAPTCHA solver for Burp Suite Automatically solve CAPTCHAs during web application security testing. Intercepts HTTP requests containing CAPTCHA placeholders, solves them via external providers, and injects the tokens — seamlessly integrating with Repeater, Intruder, and other Burp tool...