CVE-2026-59295

CVE-2026-59295 affects applications using MicrometerHttpClientInterceptor to instrument Apache HttpAsyncClient (4.x or 5.x). When asynchronous requests fail before receiving a response—such as connection resets or timeouts—the per-request tracking state is never released, causing an unbounded mem...

tgt-monitor-bof

Kerberos TGT 监控与自动续期 本仓库包含两个异步 Beacon 对象文件 BOF。第一个 tgt-monitor 监控系统的 Kerberos 登录事件，并在捕获到新 Kerberos TGT 时唤醒代理。类似于 Rubeus 的 monitor 命令，该 BOF 会持续运行并定期检查 LSA 票据缓存。一旦检测到新的 TGT，它将打印票据元数据并输出 base64 编码的 kirbi 数据块，可用于通过传递票据攻击进行横向移动。第二个 tgt-renew 自动续期系统中剩余生命周期低于指定阈值（例如 15 分钟）的 TGT。 !Important 本仓库中的 BOF...

CVE-2026-59324

CVE-2026-59324...

raptor

Raptor 是一个基于网页（Web服务+UI）的、以 GitHub 为中心的源码漏洞扫描器——它只需提供 GitHub 仓库 URL 即可扫描仓库。你可以设置 Webhook，以确保每次提交或合并 Pull Request 时自动扫描。扫描是异步进行的，结果仅对启动扫描的用户可见。 Raptor 的部分特性： 插件架构（即插即用外部工具，生成统一报告） Web 服务可用于自定义自动化（无需 UI） 轻松创建/编辑/删除新漏洞和/或编程语言的签名...

celerystalk

celerystalk celerystalk 通过异步任务（即 tasks ）帮助你自动化网络扫描/枚举过程，同时让你完全控制要运行哪些工具。 交互演示：漏洞赏金模式 HackerOne 交互演示：漏洞评估/渗透测试模式 已退役的 HackTheBox.eu 机器 celerystalk 可以为你自动化什么 阶段| 命令| 使用的工具示例 ---|---|--- DNS 侦察/枚举| ./celerystalk subdomains -d domain1,domain2| Amass, sublist3r 定义范围，导入 nmap/nessus| ./celerystalk impor...

sub404

Sub404: A Fast Tool To Check Subdomain Takeover Vulnerability What is Sub 404 Sub 404 is a tool written in python which is used to check possibility of subdomain takeover vulnerability and it is fast as it is asynchronous. Why During recon process you might get a lot of subdomainse.g more than 10...

xssless

xssless An automated XSS payload generator written in python. Usage 1. Record requests with Burp proxy 2. Select requests you want to generate, then right click and select "Save items" 3. Use xssless to generate your payload: ./xssless.py burpexportfile 4. Pwn! A more detailed tutorial can be fou...

EUVD-2026-62700

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...

CVE-2026-75143

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

CVE-2026-75143 FFmpeg Heap Buffer Overflow via RIST Protocol Reader

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

UBUNTU-CVE-2026-53533

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior...

CVE-2026-75851

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-75851 ArcadeDB before 26.8.1 Authentication Bypass via Async Command

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-75851

ArcadeDB server versions 26.7.3 and earlier fail to propagate the authenticated principal to async worker threads, making the scripting authorization gate a no-op. A read-only user can submit a JavaScript command via /api/v1/command with awaitResponse:false to execute arbitrary code and create a ...

CVE-2026-75851 ArcadeDB before 26.8.1 Authentication Bypass via Async Command

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

Linux Distros Unpatched Vulnerability : CVE-2026-74578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: algifskcipher - force synchronous processing on trees without ctx-state The AIO/async path in skcipherrecvmsg passes the socket-wide ctx-iv directly int...

PT-2026-76948

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

Linux Distros Unpatched Vulnerability : CVE-2026-74437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: uvcvideo: Fix deadlock if uvcstatusstop is called from asyncctrl.work If a UVC camera has an asynchronous control, uvcstatusstop may be called from...

Linux Distros Unpatched Vulnerability : CVE-2026-72151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tpm: tpm2-sessions: wait for async KPP completion in tpmbufappendsalt tpmbufappendsalt in drivers/char/tpm/tpm2-sessions.c calls cryptokppgeneratepublickey and...

Important: jackson-core

Issue Overview: The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of...