Important: Red Hat Security Advisory: dovecot security, bug fix, and enhancement update

An update for dovecot is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve

A flaw was found in Dovecot's ManageSieve login process. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted, truncated quoted argument. This action causes the process to enter an infinite loop, consuming excessive CPU resources. Repeated exploitation can lea...

dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters

A flaw was found in Dovecot. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in. This action causes the server to consume excessive memory and CPU resources, leading to the termination of login processes and other active connections...

dovecot: Dovecot: Denial of Service in ManageSieve login process

A flaw was found in Dovecot. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. This can lead to a denial of service for Sieve script management, affecting either the attacker's connection or all connections handled by t...

CVE-2026-105865

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

CVE-2026-105866

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to...

CVE-2026-106104 Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR passed an unbounded User-Agent request header to getMatch in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated...

SirepRAT

SirepRAT - RCE от имени SYSTEM на Windows IoT Core SirepRAT предоставляет полные возможности RAT без необходимости написания реального вредоносного RAT на целевом устройстве. Контекст Метод использует встроенную службу Sirep Test Service, которая предустановлена и работает в официальных образах,...

HTTP3ONSTEROIDS

Содержание Описание уязвимости Обзор исходного кода Настройка лаборатории Выявление проблемы Ссылки Описание уязвимости Реализация HTTP/3 в HAProxy не блокирует некорректное имя поля HTTP-заголовка , и при развёртывании перед сервером, который неправильно обрабатывает такой некорректный заголовок...

CVE-2026-31024

CVE-2026-31024 Rapport de vulnérabilité : Débordement de tampon basé sur la pile et divulgation d'informations dans Steghide Champ| Valeur ---|--- Application ciblée| Steghide binaire Linux Version affectée| 0.5.1 confirmé ; versions antérieures probablement affectées Type de vulnérabilité|...

whatportis

whatportis .. image:: https://github.com/opencve/opencve/workflows/Tests/badge.svg :target: https://github.com/ncrocfer/whatportis/actions/workflows/tests.yml .. image:: https://badge.fury.io/py/whatportis.svg :target: https://pypi.python.org/pypi/whatportis/ .. image::...

CVE-2026-106101 Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components...

ACEshark

ACEshark Что это? ACEshark — это утилита, предназначенная для быстрого извлечения и анализа конфигураций служб Windows и записей управления доступом Access Control Entries, устраняя необходимость в таких инструментах, как accesschk.exe, или других нештатных бинарных файлах. Зачем? Эффективно...

Enumprotections_BOF

Enumprotections BOF Этот BOF может использоваться для перечисления системных процессов и определения уровня защиты каждого из них. Также возвращается дополнительная информация, такая как связь со службой, пользователь, сессия и путь. Эту информацию в совокупности можно использовать для выявления...

OFFPORT_KILLER

.. raw:: html .. raw:: html KILLER PROJECT .. image:: https://img.shields.io/github/last-commit/TH3xACE/OFFPORTKILLER?style=plastic :target: https://github.com/TH3xACE/SUDOKILLER :alt: Last Commit .. raw:: html Analyse manuelle des ports Énumération des services potentiels Si vous aimez l'outil e...

vaas-cve-2015-5477

Уязвимость как услуга — CVE 2015-5477 Система Debian Wheezy Linux с уязвимой версией bind9 для демонстрации CVE-2015-5477. Обзор Этот контейнер Docker основан на Debian Wheezy и был изменён для использования уязвимой версии bind9 и соответствующих дополнительных зависимостей. Использование Получи...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

morty

Morty Proxy de nettoyage de contenu web en tant que service Morty réécrit les pages web pour exclure les balises et attributs HTML malveillants. Il remplace également les références aux ressources externes pour empêcher les fuites d'informations vers des tiers. L'objectif principal de morty est d...

Vulnerability handling in Atlassian Data Center products

The vulnerability exists in several products within the Atlassian Data Center platform, including Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. The vulnerability is an Arbitrary File Access issue, allowing unauthorized attackers to access...

CVE-2026-105866 Payload: Unauthenticated account-lockout denial of service

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to...