1095 matches found
EUVD-2026-95254
MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element...
cyph
Cyph Cyph is a cryptographically secure messaging and social networking service, providing an extreme level of privacy combined with best-in-class ease of use. Cyph’s patented technology — built by former SpaceX engineers, audited by Cure53, and the basis of research presentations at Black Hat an...
hget
hget This project is my personal project to learn golang to build something useful. Build Status : Install $ go get -d github.com/huydx/hget $ cd $GOPATH/src/github.com/huydx/hget $ make clean install Binary file will be built at ./bin/hget, you can copy to /usr/bin or /usr/local/bin and even ali...
CVE-2026-17532
Seraphinite Accelerator . One URL, no authentication: http://TARGET/?seraphaccelprep=alertdocument.domain" Usage Python needs pip install requests: usage: seraphaccelxss.py -h --url URL --payload PAYLOAD --timeout TIMEOUT Seraphinite Accelerator WordPress alertdocument.domain --timeout TIMEOUT...
Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting
The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraphaccelprep parameter. CacheExtractPreparePageParams compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON...
CVE-2026-17532-lab
CVE-2026-17532 Lab - Seraphinite Accelerator: unauth XSS → 1-click RCE A Docker lab for CVE-2026-17532 , an unauthenticated reflected XSS in the WordPress plugin Seraphinite Accelerator that chains into remote code execution the moment a logged-in administrator opens one crafted link. Full writeu...
Security Bulletin: IBM Test Accelerator for Z uses jackson-core-2.22.2.jar which is vulnerable to CVE-2026-89407, CVE-2026-89425
Summary IBM Test Accelerator for Z uses jackson-core-2.22.2.jar which is vulnerable to CVE-2026-89407, CVE-2026-89425. This security bulletin provides details about the vulnerability and the corresponding remediation. Vulnerability Details CVEID:CVE-2026-89407 DESCRIPTION:...
Security Bulletin: IBM Test Accelerator for Z uses jackson-databind-2.22.2.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777
Summary IBM Test Accelerator for Z uses jackson-databind-2.22.2.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777. This security bulletin provides details about the vulnerability and the corresponding remediation. Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION:...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
PHP2Shell Exposure Accelerator A deploy-your-own Azure soluti...
Malicious code in @apexacc/cli (npm)
@apexacc/cli is distributed by "Apex Accelerator" Apex Arena, a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs REF8801, published 2026-10-12 found it is a repackaged Oh My Pi coding agent 1,351 of 1,363 files identical with malicious...
Linux Distros Unpatched Vulnerability : CVE-2026-106435
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression...
Security Bulletin: IBM Application Modernization Accelerator is affected by vulnerability found in JavaScript
Summary There is a vulnerability in the JavaScript used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-17495 DESCRIPTION: moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a...
BIT-THRIFT-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)
The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...
ROS-20261009-73-0036
The vulnerability of the idxdconfdevicerelease function in the drivers/dma/idxd/sysfs.c module of the Intel Data Accelerator driver for the Linux operating system is related to an unvalidated error condition. Exploiting this vulnerability could allow a attacker to cause a service failure...
CVE-2026-106435
A flaw was found in pymongo. An attacker who can supply crafted BSON Binary JSON data to the application's decoding functions can trigger an out-of-bounds read when parsing a truncated regular expression missing a terminating null byte. This flaw can cause the application process to terminate...
GHSA-86GH-39M5-HHG6 Duplicate Advisory: PYTHON-6110 Out-of-bounds read in BSON decoding via a malformed Regex element
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-98qm-wvgf-w4cf. This link is maintained to preserve external references. Original Description The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON...
CVE-2026-106435
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
AZL-107129 CVE-2026-106435 affecting package python-pymongo 4.2.0-9
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
DEBIAN-CVE-2026-106435
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
UBUNTU-CVE-2026-106435
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...