CVE-2026-98301

A flaw was found in the Linux kernel's network bridge subsystem. A local user with network configuration privileges can trigger a Denial of Service DoS by updating bridge Multiple Spanning Tree MST states. Because a blocking operation is invoked within an atomic execution context that cannot safe...

CVE-2026-98299

A flaw was found in the Linux kernel's TCP networking subsystem. A privileged local user can cause a Denial of Service DoS by configuring TCP receive buffer limits to an abnormally low value. This improper setting causes the kernel to encounter a division-by-zero error during buffer adjustment...

maskprocessor

maskprocessor Generador de palabras de alto rendimiento con un conjunto de caracteres configurable por posición Ataque por máscara Intenta todas las combinaciones de un espacio de claves dado, igual que en el ataque de fuerza bruta, pero más específico. Ventaja sobre la fuerza bruta La razón para...

mfoc

MFOC è un'implementazione open source dell'attacco "offline nested" di Nethemba. Questo programma consente di recuperare le chiavi di autenticazione dalle carte MIFARE Classic. Si prega di notare che MFOC è in grado di recuperare le chiavi dal target solo se dispone di una chiave nota: quella...

CVE-2026-108521

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

htshells

HTSHELLS - Web shell autocontenute e altri attacchi tramite file .htaccess. Gli attacchi sono nominati secondo il seguente schema, module.attack.htaccess e raggruppati per tipo di attacco in directory. Scegli quello che ti serve e copialo in un nuovo file chiamato .htaccess, controlla il file per...

CVE-2026-98297

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when network transmission requests are queued while the Bluetooth device is being shut down and its background workqueue is draining. A local attacker could exploit this vulnerability by sending data through...

CVE-2026-108521 Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

CVE-2026-108521

A server-side request forgery (SSRF) vulnerability exists in Studio-Saelix Sencho up to version 0.97.1 . The flaw is located in the isValidRemoteUrl function within the backend/src/utils/validation.ts file of the Add Remote Node API Endpoint component. An authenticated user with node-management p...

fragattacks

FragAttacks: Fragmentation & Aggregation Attacks 1. Introduzione Questo repository contiene il tool FragAttacks. Può testare client Wi-Fi e punti di accesso per attacchi di fr ammentazione e ag gregazione. Queste vulnerabilità riguardano tutte le reti Wi-Fi protette. Per maggiori informazioni su...

awesome-shodan-queries

Impresionantes Consultas de Búsqueda de Shodan Con el tiempo, he recolectado una variedad de consultas de búsqueda interesantes, divertidas y deprimentes para usar en Shodan, el literal motor de búsqueda de internet. Algunas devuelven resultados que provocan vergüenza ajena, mientras que otras...

PT-2026-110139

Name of the Vulnerable Software and Affected Versions Speedtest Tracker versions prior to 1.15.1 Description An IP allowlist bypass allows unauthenticated remote attackers to evade ALLOWED IPS and Prometheus allowlists. This occurs because the bootstrap/app.php file trusts every peer as a proxy,...

PT-2026-110073

Name of the Vulnerable Software and Affected Versions ag2ai ag2 versions prior to 0.13.5 Description A path traversal issue exists in the UserProxyAgent component. The problem occurs within the os.path.join function when processing the filename argument, allowing a remote attacker to manipulate...

PT-2026-110100

Name of the Vulnerable Software and Affected Versions InstantSoft icms2 versions prior to 2.18.2 Description An issue exists in the Billing Module within the validatePaypalOrder function located in the system/controllers/billing/actions/paypal.php file. A remote attacker can manipulate the bid/si...

CVE-2026-108772: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/downloadcache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched...

CVE-2026-108863: Missing Authentication for Critical Function

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /configdump endpoint to read configured LLM provider API...

CVE-2026-108748: Missing Release of Memory after Effective Lifetime

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108736: Use of Less Trusted Source

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

CVE-2026-108578: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but...

CVE-2026-108568: Insufficient Verification of Data Authenticity

A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient...