147561 matches found
UBUNTU-CVE-2026-82397
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-22017-Firmware-Update-via-BLE-Without-Authentication
CVE-2026-22017 – Firmware Update via BLE Without Authentication Program Code Python bleak peripheral root@kitploit: blefirmwareupdate.py - Simulated BLE peripheral accepting firmware writes from bleak import BleakServer, BleakGATTCharacteristic import asyncio class FirmwareService: def initself:...
CVE-2024-5084-Red-Team
🚀 HashForm Exploit – Lab Demo This repository contains a proof-of-concept exploit for CVE-2024-5084, a vulnerability found in the Hash Form WordPress plugin. It’s meant only for learning, lab testing, and security research. 📌 About the Vulnerability CVE ID: CVE-2024-5084 Issue: Unauthenticated fi...
EUVD-2026-66221
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username...
CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-82397
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-82397
Tornado (Python web framework / async networking library), prior to 6.5.8 , parses application/x-www-form-urlencoded request bodies via urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. Because RequestHandler._execute parses the body before handler dispatch, an unauthenti...
CVE-2026-82852
Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...
CVE-2026-82228
Unauthenticated Bypass Vulnerability in SiteGround Security = 1.6.6 versions...
CVE-2026-82225
Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-82221
Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-82224
Unauthenticated Cross Site Scripting XSS in SliceWP = 1.2.10 versions...
CVE-2026-82226
Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...
CVE-2026-82229
Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...
CVE-2026-81780
Unauthenticated Arbitrary File Upload in Hash Form = 1.4.2 versions...
CVE-2026-81763
Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...
CVE-2026-81765
Unauthenticated Cross Site Scripting XSS in Tailored Tools = 3.0.2 versions...