696751 matches found
GHSA-JJ7H-C3HG-M23X Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Summary authlib.common.security.issecuretransport is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback http:// URIs. The check is implemented as a textual str.startswith prefix match, so a URL...
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Summary authlib.common.security.issecuretransport is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback http:// URIs. The check is implemented as a textual str.startswith prefix match, so a URL...
Regular Expression Denial of Service (ReDoS)
Overview ddtrace is a Datadog APM client library Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the redactquerystring function in ddtrace/internal/utils/http.py, which applies a query string obfuscation regex without guarding against quadratic...
Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content
Description def escapev: str - str: return strv.replace"'", "\'".replace"\", "\\" The escaping order is backwards, exactly like the classic HTML double-escape bug: step 1 inserts a literal backslash in front of every ', then step 2 re-matches that just-inserted backslash and doubles it. For an...
GHSA-VQRG-773H-4WXC Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content
Description def escapev: str - str: return strv.replace"'", "\'".replace"\", "\\" The escaping order is backwards, exactly like the classic HTML double-escape bug: step 1 inserts a literal backslash in front of every ', then step 2 re-matches that just-inserted backslash and doubles it. For an...
CS_Lab4_Stored-XSS
Campus Notice Board — Stored XSS Lab Course: Cyber Securi...
CVE-2026-117509
The software crownpku Rasa_NLU_Chi versions up to 0.12.2 is vulnerable to a path traversal vulnerability in the Model Persistor component. Specifically, the Persistor._decompress function within the rasa_nlu/persistor.py file allows for such manipulation. This vulnerability can be exploited remot...
CVE-2026-117509 crownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal
A vulnerability was detected in crownpku RasaNLUChi up to 0.12.2. Affected is the function Persistor.decompress of the file rasanlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be...
EUVD-2026-111083
A vulnerability was detected in crownpku RasaNLUChi up to 0.12.2. Affected is the function Persistor.decompress of the file rasanlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be...
CVE-2026-117509 crownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal
A vulnerability was detected in crownpku RasaNLUChi up to 0.12.2. Affected is the function Persistor.decompress of the file rasanlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be...
GHSA-F9J4-QGGQ-H239 GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
Summary Remote.pull in GitPython forwards its positional refspec argument directly to the git pull child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the refspec for example a user-supplied branch or refspec paramete...
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
Summary Remote.pull in GitPython forwards its positional refspec argument directly to the git pull child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the refspec for example a user-supplied branch or refspec paramete...
GHSA-FX3J-RWGX-FR94 GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
Summary Repo.clone's handling of separategitdir never disables Git.polishurl's environment-variable expansion, unlike every other caller of that helper that handles attacker-influenced data. Since separategitdir can be derived from an attacker-controlled .gitmodules submodule name, a completely...
GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
Summary Repo.clone's handling of separategitdir never disables Git.polishurl's environment-variable expansion, unlike every other caller of that helper that handles attacker-influenced data. Since separategitdir can be derived from an attacker-controlled .gitmodules submodule name, a completely...
gladius
Gladius Easy mode from Responder to Credentials Author: Cory Duplantis @ctfhacker / blog Blog post on Gladius asciicast Gladius provides an automated method for cracking credentials from various sources during an engagement. We currently crack hashes from Responder, secretsdump.py, and...
Exploit for Path Traversal in Gradio_Project Gradio
Information Security Lab 1 This project implements an authent...
CVE-2026-117505
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. The attack can be initiated remotely. Upgrading to version 1.3.0.Final is sufficie...
CVE-2026-117507
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the pat...
CVE-2026-117506
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file...
GHSA-4FFR-JQ9G-5FFX Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
Summary Nodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect the supported SASL mechanisms. Each pattern uses an alternation with two overlapping whitespace-matching sub-patterns, which produces quadratic On^2 backtracking whenever the mechanism name is...