257638 matches found
Security Bulletin: Multiple Security Vulnerabilities in axios affect Content Cortex for Microsoft Office
Summary axios versions before 1.18.0 0.x: before 0.33.0 have multiple vulnerabilities CVSS up to 8.3, High. CVE-2026-67312/67313 are uncontrolled recursion issues in formDataToJSON that exhaust the call stack via deeply nested field names, causing denial of service. CVE-2026-67314/67316/67319 are...
elite-proxy-finder
elite-proxy-finder Questo script non funzionava da alcuni mesi. L'ho appena sistemato il 7/6/15. Ora usa solo gatherproxy.com. Trova proxy HTTP con anonimato elite L1 e poi li testa tutti in parallelo. Testa ogni proxy contro 3 URL di controllo IP, incluso uno HTTPS per assicurarsi che gestisca l...
GHSA-GPWF-4H98-V82Q datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS
Impact Datadog tracing libraries that implement W3C Trace Context tracecontext propagation parse the incoming tracestate header without enforcing a size cap on the Datadog vendor entry dd=.... The dd= value contains semicolon-separated key:value pairs, and the parser allocates a hash-map entry fo...
datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS
Impact Datadog tracing libraries that implement W3C Trace Context tracecontext propagation parse the incoming tracestate header without enforcing a size cap on the Datadog vendor entry dd=.... The dd= value contains semicolon-separated key:value pairs, and the parser allocates a hash-map entry fo...
CVE-2026-54788 dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS
dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap...
EUVD-2026-67829
dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap...
CVE-2026-54788
dd-trace-rs (Datadog APM for Rust), versions 0.1.0 through 0.3.3, is affected by an unbounded W3C tracestate parsing flaw in datadog-opentelemetry/src/propagation/tracecontext.rs. The parser collects every semicolon-separated key:value pair in the Datadog dd=... vendor entry into a HashMap withou...
BurpSuite_403Bypasser
403Bypasser Eine BurpSuite-Erweiterung zur Umgehung von 403-beschränkten Verzeichnissen. Durch die Verwendung des PassiveScan standardmäßig aktiviert wird jede 403-Anfrage automatisch von dieser Erweiterung gescannt, also einfach zu BurpSuite hinzufügen und genießen. Payloads: $1: HOSTNAME $2: PA...
CVE-2026-42533
CVE-2026-42533 — PoC Exploit per l'Heap Buffer Overflow di nginx Esecuzione remota di codice pre-autenticazione tramite sovrascrittura dei gruppi di cattura a due passate PoC pubblico rilasciato il 2026-07-27 — Non aspettare, applica la patch ora. | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2 Criti...
cPanel-WHM-CVE-2026-41940-auth-bypass-exploit
CVE-2026-41940 - cPanel & WHM Authentifizierungs-Bypass-Exploit Kritischer Authentifizierungs-Bypass durch CRLF-Injection im cPanel/WHM-cpsrvd-Daemon 📋 Übersicht Bei CVE-2026-41940 handelt es sich um eine kritische Authentifizierungs-Bypass-Schwachstelle in cPanel & WHM, die nicht authentifiziert...
CVE-2026-43499-root-KernelSU
CVE-2026-43499-root-KernelSU Adattamento per l'escalation locale dei privilegi basato sulla vulnerabilità del kernel CVE-2026-43499, con KernelSU integrato. La compilazione genera preload.so; dopo un exploit riuscito, KernelSU viene avviato in modalità late-load modalità jailbreak. Supporta la...
GHSA-2WVM-8MVP-22QV Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
Summary The OIDC authorization page in the pocket-id frontend redirects the browser to an attacker-controlled URL without consulting the backend redirecturi allow-list when the request uses prompt=none. An attacker who knows a valid clientid can craft an /authorize link that sends a victim or a...
Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
Summary The OIDC authorization page in the pocket-id frontend redirects the browser to an attacker-controlled URL without consulting the backend redirecturi allow-list when the request uses prompt=none. An attacker who knows a valid clientid can craft an /authorize link that sends a victim or a...
CVE-2026-55834
Pocket ID (an OIDC provider for passkey-based authentication), versions 2.6.0 through 2.9.0 , contains an open redirect in its OIDC /authorize page. When a request uses prompt=none and silent authorization cannot complete, the SvelteKit frontend constructs a callback URL directly from the raw red...
CVE-2026-55834 Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirecturi query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when...
EUVD-2026-67828
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirecturi query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when...
CVE-2026-55834 Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirecturi query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when...
siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization
CVE-2026-66012 — SiYuan MCP: acquisizione dei privilegi di amministratore senza autenticazione Proof of Concept per CVE-2026-66012 CVSS 10.0 Critico, una vulnerabilità di autorizzazione mancante nell'endpoint MCP Model Context Protocol di SiYuan che consente a un attaccante non autenticato di...
threatspec
threatspec - modellazione continua delle minacce, attraverso il codice Threatspec è un progetto open source che mira a colmare il divario tra sviluppo e sicurezza, portando il processo di modellazione delle minacce più a fondo nel processo di sviluppo. Ciò si ottiene facendo scrivere agli...
