Understanding the Privacy-Preserving Potential of HTTP/2 against Webpage Fingerprinting

Website fingerprinting WF attacks can infer which webpage a user visits from encrypted HTTPS traffic alone, compromising privacy even without decryption. WF defenses commonly shape traffic through noise, padding, delays, or flow splitting, yet they are most often studied from the perspective of...

CVE-2026-57166: Stack-based Buffer Overflow

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. Several command-line handling paths write an attacker-influenced amoun...

PT-2026-85532

Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026...

07-Web-Application-Security

Cybersecurity Home Lab - Lab 7: Web Application Security O...

Security Bulletin: Multiple Vulnerabilities in Java affecting Rational Application Developer for Websphere Software

Summary There are multiple vulnerabilities in the Java SDK that is used by Rational Application Developer for Websphere Software. July Security Update. CVE-2026-47057, CVE-2026-47063, CVE-2026-60147, CVE-2026-47027, CVE-2026-47021, CVE-2026-16439, CVE-2026-16441, CVE-2026-16243 Vulnerability...

GHSA-3F6P-5WW8-9RCR vulnerabilities

Vulnerabilities for packages: sqlpad...

Exploit for CVE-2026-8181

CVE-2026-8181 — Burst Statistics Authentication Bypass to Admin...

grafana: Grafana: Privilege escalation via broken access control

A flaw was found in Grafana. This vulnerability, categorized as broken access control, allows an attacker to bypass security mechanisms in a web application. This can lead to unauthorized access to sensitive data, enable operations on behalf of other users, and potentially result in privilege...

resteasy-core: RESTeasy SourceProvider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

MSAK_Task6_Exploit_Development_Sandbox

MSAK Task 6 — Exploit Development Sandbox An isolated educati...

Sensitive Information Exposure

io.netty.incubator is vulnerable to sensitive information exposure. The vulnerability is due to private key bytes being included in string representations and exception messages, which allows an attacker with access to application logs to obtain exposed private key material and potentially use it...

CVE-2026-9853

A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...

CLEANSTART-2026-JY55743 Netty is an asynchronous, event-driven network application framework

Multiple security vulnerabilities affect the apache-zookeeper package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

Risk-Analysis-Editor v3.0.0

Risk Analysis Editor RAE English · Français Standalone tool for building and visualizing risk matrices — inherent gross risk and residual net risk — with an open, documented file format, .rae.json. ▶️ Open the app · 📖 User guide · 🎬 Video tutorials · ⬇️ Download No installation: the tool runs...

CVE-2026-85150: NULL Pointer Dereference

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...

CVE-2026-85150: NULL Pointer Dereference

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...

UltimateWDACBypassList — Updated!

Ultimate WDAC Bypass List A centralized resource for previously documented WDAC/Device Guard/UMCI bypass techniques as well for building/managing/testing WDAC policies Note: WDAC Windows Defender Application Control has been rebranded by Microsoft as "Application Control" or "Application Control...

jdvrif — Updated!

jdvrif jdvrif JPG Data Vehicle , v9.0 is a fast, easy-to-use steganography command-line tool for concealing and extracting any file type via a JPG image. Linux only. Your data file is compressed with libdeflate/zlib , then encrypted with XChaCha20-Poly1305 libsodium secretstream under a key deriv...

CVE-2026-84856

rowboatlabs rowboat versions up to 0.9.1 are affected by a denial of service vulnerability in the Composio Webhook Endpoint (apps/rowboat/app/api/composio/webhook/route.ts), specifically in the request.text/req.json function. The attack is remotely exploitable with no authentication required. A p...

Security update for texlive

This update for texlive fixes the following issue: CVE-2026-63729: heap use-after-free in the SyncTeX parser can lead to application crash or arbitrary code execution when malformed .synctex or .synctex.gz files are processedbsc1272432. Patch Instructions: To install this SUSE update use the SUSE...