CVE-2026-102161

An unauthenticated attacker located on an adjacent private network or any attacker routed through a reverse proxy/load balancer that forwards client headers can forge their source IP address and gain administrative session privileges on the CV-CUE backend...

nginx-cve-fix

Nginx CVE Fix - Source-Built Drop-in for nginx:1.25-bookworm A source-built nginx 1.25.5 container image that remediates two CVEs present in the official nginx:1.25-bookworm image while preserving upstream runtime behavior. CVE| Component| Severity| Technique| Verification model ---|---|---|---|-...

violent-python3

Python 3 "Violent Python" Source Code Source code for the book "Violent Python" by TJ O'Connor. The code has been fully converted to Python 3, reformatted to comply with PEP8 standards and refactored to eliminate dependency issues involving the implementation of deprecated libraries. A conversion...

CVE-2019-13288

Xpdf version 4.02 2019-sep-25 The Xpdf software and documentation are copyright 1996-2019 Glyph & Cog, LLC. Email: [email protected] WWW: http://www.xpdfreader.com/ The PDF data structures, operators, and specification are documented in ISO 32000-2:2017. What is Xpdf? Xpdf is an open source...

CVE-2024-6387fixshell

CVE-2024-6387fixshell Solo afecta a 8.5p1 = OpenSSH 9.8p1 Instalar dependencias de compilación sudo apt-get update sudo apt-get install -y build-essential zlib1g-dev libssl-dev Descargar el código fuente de la versión especificada wget...

flareon2024

Soluciones de Flare-On 11 Códigos fuente de mis soluciones para las tareas del desafío Flare-On11. Mis writeups de tareas seleccionadas disponibles aquí...

cacti-rce-cve-2022-46169-vulnerable-application

Aplicación vulnerable de inyección de comandos en Cacti v1.2.22 CVE-2022-46169 Esta es una aplicación vulnerable para probar el exploit de la vulnerabilidad Cacti CVE-2022-46169. ¡ADVERTENCIA! Esta aplicación contiene vulnerabilidades de seguridad graves. ¡Úsela bajo su propio riesgo! Se recomien...

cve-2026-75650-magento-validation-lab

CVE-2026-75650 / VULN-39341 Docker validation lab This standalone lab reproduces the complete unauthenticated StyleSmuggler HTTP chain on a revision-pinned Magento Open Source 2.4.9 checkout. It then applies Adobe's VULN-39341 patch and proves that the identical request sequence no longer reaches...

Vulnerability-Assessment-and-OSINT-CVE-2012-1823

Evaluación de Vulnerabilidades y OSINT: CVE-2012-1823 Mi repositorio documenta el proceso de identificación, análisis y recopilación de Inteligencia de Fuentes Abiertas OSINT sobre una vulnerabilidad de seguridad específica detectada durante un escaneo de red objetivo. Resumen del Proceso El fluj...

EUVD-2026-38245

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation...

CVE-2026-87890

Django versions 6.1 before 6.1.2 , 6.0 before 6.0.9 , and 5.2 before 5.2.18 are vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is an incomplete fix for CVE-2026-15307 in spatial lookups , where providing bytes values can trigger the Django process to make network requests via...

BIT-GRAFANA-2026-81841 Paused shared dashboard access tokens still expose data source configuration

Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...

nextjs-security-update

nextjs-security-update Hay personas que están creando herramientas OSS para explotar las nuevas vulnerabilidades de Next.js. Esta es una herramienta para contraatacar: hace que sea extremadamente fácil actualizar todas tus aplicaciones Next.js en todas tus cuentas de GitHub. Utiliza la herramient...

Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports

Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect since October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward...

stylesmuggler-adobe-patches

disrex/stylesmuggler-adobe-patches Un plugin de Composer que aplica el parche oficial APSB26-146 de Adobe CVE-2026-75650, referencia interna VULN-39341 para el zero-day StyleSmuggler en Magento Open Source y Mage-OS , automáticamente, detectando tu versión instalada. Parchea los paquetes instalad...

CVE-2021-41773h

CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 CVE-2021-41773 Info A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document...

rats-re

Reconstrucción del código fuente de Rats! con LLM locales Este repositorio es una reconstrucción en curso del código fuente de RATS.EXE, la versión original para Windows de Rats! 1994 de Sean O'Connor. Compila un ejecutable Win32 con Microsoft Visual C++ 4.1 bajo wibo y puede probarse en DREAMM. ...

CVE-2025-70829

CVE-2025-70829: Exposición de información en Datart 中文文档 1. Descripción general de la vulnerabilidad CVE ID : CVE-2025-70829 Producto : Datart Versión : v1.0.0-rc.3 Tipo de vulnerabilidad : Exposición de información Una vulnerabilidad de exposición de información en Datart v1.0.0-rc.3 permite a...

CVE-2015-7214

CVE-2015-7214 What is CVE-2015-7214? Please see the following link. Cross-site reading attack through data and view-source URIs Contents www/index.html SOP bypass PoC for Web local/index.html SOP bypass PoC for local Requirements Firefox version 42.0 or earlier The following is the download link ...

CLEANSTART-2026-EX19348 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...