PT-2026-90489

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not have a valid dm stream ctx that should skip configuring HDCP routine. The routine is valid to go through only when a valid stream is created...

PT-2026-90166

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SID MATCH field tegra241 vintf init vsid programs the guest-provided vSID into SID MATCH, whose VIRT SID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefo...

MiracleLinux 9 : valkey-8.0.10-1.el9_8 (AXSA:2026-1809:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1809:04 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 valkey: Valkey: Remote code execution via use-after-free in...

PT-2026-90006

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range...

PT-2026-90193

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp process strreset outreq, sctp process strreset addstrm out and sctp process strreset resp complete a pending stream reconfiguration request by stopping the reconf timer...

Fedora 44 : curl (2026-f26b509a1a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f26b509a1a advisory. - Fix HTTP/2 stream-dependency tree UAF CVE-2026-10536 - Fix Native CA trust persist CVE-2026-11564 - Fix stale proxy password leak CVE-2026-9079 -...

PT-2026-89865

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

Detections-CVE-2026-23918

移動先: https://github.com/insomnisec/publiccvedetections 長期的な検出公開管理の改善のため このリポジトリは2026年6月に削除されます 今後は別のリポジトリを使用してください CVE-2026-23918 "Apache HTTP/2 Double-Free" — 検出・対応パッケージ 公開日: 2026-05-04 CVSSv3: 8.8 高 タイプ: リモートコード実行 / サービス拒否（Double-Free メモリ破損） コンポーネント: Apache HTTP Server modhttp2（h2mplx.c...

CVE-2026-45765 Suricata dnp3: unbounded reassembly can lead to resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory,...

CVE-2025-8671-vulnerability-POC-

CVE-2025-8671-vulnerability-POC- CVE-2025-8671 脆弱性のPOC CVE-2025-8671 脆弱性スキャナー MadeYouReset 脆弱性（CVE-2025-8671）をHTTP/2サーバーで検出するためのプロフェッショナルなセキュリティ研究ツールです。このスキャナーは複数の検出ヒューリスティックを用いて、ストリームアカウンティング操作攻撃に対して脆弱なサーバーを特定します。 🔍 CVE-2025-8671 について MadeYouReset 脆弱性は、不正なプロトコル違反によってサーバーに RSTSTREAM...

xtor

xtor 用于以编程方式管理 Tor 实例的 Python 库。 特性 启动新的 Tor 进程或连接到现有进程 预配置的 httpx 客户端（同步 + 异步），使用 SOCKS5 代理 身份轮换，可选等待新 IP 流隔离，用于流量分离 电路和流管理 出口节点信息（国家、带宽、标志） 临时隐藏服务（.onion） 事件监听器（电路、流、带宽事件） TorPool，用于管理多个实例，支持轮询和随机选择 命名实例，可通过 CLI 管理 自定义异常层次结构，实现精确的错误处理 安装 先决条件 Linux（Debian/Ubuntu）： root@kitploit: sudo apt-get...

CVE-2025-9784

CVE-2025-9784 MadeYouReset HTTP/2 Prueba de Vulnerabilidad Descripción general Este repositorio contiene un script bash simple y efectivo para probar la vulnerabilidad CVE-2025-9784 conocida como el ataque de Denegación de Servicio DoS HTTP/2 "MadeYouReset" en implementaciones de servidores...

netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec

A flaw was found in Netty. A remote attacker can exploit a vulnerability in the SpdyHttpDecoder handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated SYNSTREAM frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This...

CVE-2026-88874

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...

CVE-2026-88865

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from...

EUVD-2026-75428

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

CVE-2026-88878

Traefik (HTTP reverse proxy and load balancer) versions v2.8.2 through v2.11.55 and v3.0.0 through v3.7.11 are affected by an HTTP/3 timeout bypass. The respondingTimeouts settings (notably readTimeout, default 60s) are not applied to the HTTP/3 request path because readTimeout is enforced as a d...

CVE-2026-88878 Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

CVE-2026-88878 Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

CVE-2026-88874

AVideo (through revision c3edcc274c389816d434acadac07ee78eaf330c1, 2026-08-23) suffers from an authentication bypass in its live streaming feature. The Live::_getStats() method (plugin/Live/Live.php) exposes the RTMP stream key, isPasswordProtected flag, and HLS (m3u8) URL to unauthenticated call...