CVE-2026-33382

A flaw in Grafana's API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service DoS. Mitigation Deploy a reverse proxy or API gateway e.g., Nginx in front of Grafana configured to...

CVE-2026-59884

A flaw was found in pyasn1, a generic ASN.1 library for Python. The Basic Encoding Rules BER decoder, used by CER and DER codecs, processes long-form tags by accumulating continuation octets without an upper bound. A remote attacker can exploit this by providing a specially crafted input, leading...

EUVD-2024-55652

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers can create unlimited accounts with unverified email addresses, increasing denial-of-service risk and compromising service...

PT-2026-60686

Name of the Vulnerable Software and Affected Versions Envoy Gateway affected versions not specified Description When operating in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server lacks a UnaryInterceptor, leaving Fetch endpoints unauthenticated...

CVE-2026-44982: Protection Mechanism Failure

CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from maxr.ContentLength, 0, so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length...

opencryptoki security update

3.26.0-3.1 - Resolves: RHEL-171556, Fix possible out-of-bounds access in BER decode functions 3.26.0-3 - Resolves: RHEL-169565, Fix syslog message printing about different CPs...

CVE-2026-62314 Anubis: Policy bypass via client controlled X-Original-URI header

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP...

CVE-2026-55234 Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)

Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize against the stored source boardId and do not validate a new boardId in the update modifier. Any...

SUSE CVE-2024-10005

A vulnerability was identified in Consul and Consul Enterprise “Consul” such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules...

CVE-2026-56743 Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom...

CVE-2026-56743

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom...

python-pyasn1: pyasn1: Denial of Service via crafted BER input

A flaw was found in pyasn1, a generic ASN.1 library for Python. The Basic Encoding Rules BER decoder, used by CER and DER codecs, processes long-form tags by accumulating continuation octets without an upper bound. A remote attacker can exploit this by providing a specially crafted input, leading...

afrog v3.5.5

A Security Tool for Bug Bounty, Pentest and Red Teaming English • 中文 Download • Wiki • Afrog PoC 规则编写权威指南 PoC Contributors 不动明王 | 雪山 | White-hua | 123456 | ifofor | Air | !Typora-Logoh...

SUSE CVE-2026-58251

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny...

CVE-2026-56743: Incorrect Authorization

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom...

Semgrep Rules 2.0.0 Static Analysis Rule Collection

A collection of Semgrep rules for identifying potentially vulnerable code patterns during static source code analysis. The rule set focuses on vulnerability research across multiple languages and includes checks for common security issues to assist developers, auditors, and security researchers...

Excessive Iteration

Overview Affected versions of this package are vulnerable to Excessive Iteration via the BER decoder, which is also used by the CER and DER codecs, when parsing long-form tag IDs without an upper bound. An attacker can exhaust system resources and potentially trigger unhandled exceptions by...

UBUNTU-CVE-2026-59884

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with C...

CVE-2026-59884

pyasn1 prior to 0.6.4 contains a denial-of-service risk in its BER decoder used by CER/DER codecs: long-form tag IDs can be accumulated without an upper bound, enabling a crafted input to drive CPU usage quadratically and trigger unhandled ValueError paths in Python 3.11+ error formatting. Affect...

389-ds-base security update

1.3.11.1-5.0.9 - Security fix for CVE-2026-9064 Orabug: 39570202 1.3.11.1-5.0.7 - Security fix for CVE-2025-14905 Orabug: 39146844 1.3.11.1-5.0.5 - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules Orabug: 38388205...