13312 matches found
CVE-2025-8590
creationtimestamp| type| source ---|---|--- 2026-02-03 08:18:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdwwdz4vlp23 2026-02-03 08:18:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdwwep6anm2m...
urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
A flaw was found in urllib3. When processing HTTP redirect responses during data streaming, the library automatically reads and decompresses the full response body without enforcing configured size limits. A malicious server can exploit this by serving an excessively compressed response, bypassin...
openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand
A flaw was found in OpenSSH where control characters in usernames were not properly validated when sourced from untrusted inputs like the command line or configuration expansion. If a ProxyCommand is used, these control characters could modify command behavior, potentially leading to code executi...
PT-2026-6424
A Path Traversal vulnerability in the partition msg function allows an attacker to write or overwrite arbitrary files on the filesystem when processing malicious MSG files with attachments. Impact An attacker can craft a malicious .msg file with attachment filenames containing path traversal...
GHSA-9M3X-QQW2-H32H picklescan missing detection by simple obfuscation of a `builtins.eval` call
Summary An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the host loading a pickle payload from an untrusted source. Details It's possible to hide the eval call nested under another callable via getattr. PoC python import builtins class EvilClas...
urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
A flaw was found in urllib3. When processing HTTP redirect responses during data streaming, the library automatically reads and decompresses the full response body without enforcing configured size limits. A malicious server can exploit this by serving an excessively compressed response, bypassin...
urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
A flaw was found in urllib3. When processing HTTP redirect responses during data streaming, the library automatically reads and decompresses the full response body without enforcing configured size limits. A malicious server can exploit this by serving an excessively compressed response, bypassin...
urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
A flaw was found in urllib3. When processing HTTP redirect responses during data streaming, the library automatically reads and decompresses the full response body without enforcing configured size limits. A malicious server can exploit this by serving an excessively compressed response, bypassin...
urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
A flaw was found in urllib3. When processing HTTP redirect responses during data streaming, the library automatically reads and decompresses the full response body without enforcing configured size limits. A malicious server can exploit this by serving an excessively compressed response, bypassin...
urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
A flaw was found in urllib3. When processing HTTP redirect responses during data streaming, the library automatically reads and decompresses the full response body without enforcing configured size limits. A malicious server can exploit this by serving an excessively compressed response, bypassin...
openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand
A flaw was found in OpenSSH where control characters in usernames were not properly validated when sourced from untrusted inputs like the command line or configuration expansion. If a ProxyCommand is used, these control characters could modify command behavior, potentially leading to code executi...
urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
A flaw was found in urllib3. When processing HTTP redirect responses during data streaming, the library automatically reads and decompresses the full response body without enforcing configured size limits. A malicious server can exploit this by serving an excessively compressed response, bypassin...
CVE-2026-25201
creationtimestamp| type| source ---|---|--- 2026-02-02 05:24:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdu45yaayh2o 2026-02-02 05:24:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdu4772n7d2h 2026-02-02 09:39:58+00:00| seen|...
Directory Traversal
Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Directory Traversal via the TechdocsGenerator function when processing documentation from...
CVE-2026-1699
creationtimestamp| type| source ---|---|--- 2026-01-30 10:35:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdn46m5yul23 2026-01-30 11:54:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdnalys3sa2i...
CVE-2026-22277
creationtimestamp| type| source ---|---|--- 2026-01-30 09:10:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115983268882462022 2026-01-30 09:24:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdmy7l4uug2c 2026-01-30 10:00:32+00:00| seen|...
ICA Foreign Threats to the 2020 US Federal Elections
This is the originally publicly disclosed government document titled Foreign Threats to the 2020 US Federal Elections. This document is a declassified version of a classified report. The analytic judgments outlined here are identical to those in the classified version, but this declassified...
CVE-2025-7713
creationtimestamp| type| source ---|---|--- 2026-01-29 16:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdl5uf2wi72x 2026-01-29 17:29:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdlcu7xdtu2n...
GHSA-2CP6-34R9-54XX Maker.js has Unsafe Property Copying in makerjs.extendObject
Summary The makerjs.extendObject function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks hasOwnProperty checks and does not filter dangerous keys, allowing inherited properties and potentially malicious...
CVE-2025-7016
creationtimestamp| type| source ---|---|--- 2026-01-29 12:23:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdkrpj5dd52m 2026-01-29 13:34:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdkvptnrs72g 2026-08-29 20:00:22+00:00| seen|...