CVE-2026-22019-libcurl-HTTP-2-CONNECT-Tunnel-Mixup

CVE-2026-22019 – libcurl HTTP/2 CONNECT : mélange de tunnel Code du programme simulation en C root@kitploit: // curlhttp2tunnelmixup.c - Simulated libcurl handling CONNECT over HTTP/2 include void handlehttp2streamint streamid // Vulnerability: after CONNECT, the proxy mixes streams with the...

CVE-2026-80184

OpenStack Keystone versions before 29.0.3 are affected by a project-scope escape vulnerability in the token-method authentication path. Tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, or trusts) can be submitted for reauthentication and, whe...

CVE-2026-79270

An uninitialized resource in ANGLE within Google Chrome prior to 152.0.7977.65 allows a remote attacker to read memory outside the sandbox via a crafted HTML page. The vulnerability was assigned a Medium severity by the Chromium security team. The fix is included in Chrome 152.0.7977.65, so updat...

boundary

Boundary Qu'est-ce que Boundary : https://developer.hashicorp.com/boundary/docs/what-is-boundary Site web : https://www.developer.hashicorp.com/boundary/ Forums : HashiCorp Discuss Documentation : https://developer.hashicorp.com/boundary/docs Tutoriels : HashiCorp's Learn Platform Boundary est un...

CTF-Web-Exploitation

Десинхронизация Незер-портала HUUP "Я путешествую не по проложенным дорогам, а свободно прыгаю через пустоту. Упакуй меня неправильно, и я доставлю секрет не на тот порог." Описание Задача представляет собой приложение HTTP/3 QUIC, работающее поверх UDP. Поскольку UDP не сохраняет состояние, а...

sgxray

SGXRay: أتمتة كشف الثغرات لتطبيقات SGX تقوم Intel SGX بحماية منطق التطبيق المعزول والبيانات الحساسة داخل بيئة موثوقة enclave باستخدام تشفير الذاكرة القائم على العتاد. لاستخدام آلية الأمان القائمة على العتاد هذه، يلزم نموذج برمجة صارم لاستخدام الذاكرة，مع واجهات برمجة تطبيقات معقدة داخل وخارج حدود...

CVE-2026-55540

CVE-2026-55540 is a path traversal vulnerability in PraisonAI , a multi-agent teams system. The function is_path_within_directory() relies on os.path.abspath() instead of os.path.realpath() to enforce the workspace boundary, so a symlink placed inside the workspace can resolve to a path outside i...

llm-differential-privacy-gateway

Noisegate: a differential-privacy gateway for untrusted AI agents An AI agent that can study sensitive data without being able to single anyone out. The limit is mathematical, it's enforced in code the agent can't reach, and the repo ships the attacks that try to break it. A recorded Claude Deskt...

CVE-2026-66730-Infinite-Loop-DoS-in-facil.io-MIME-Parser

Уведомление о безопасности: Бесконечный цикл DoS в MIME-парсере facil.io Частичная граница Назначенный CVE ID : CVE-2026-66730 Продукт: facil.io Затронутые версии: facil.io = 0.6.0 все 0.6.x, все 0.7.x, master; появился вместе с MIME-парсером в 0.6.0 Компонент: lib/facil/http/http.c,...

CVE-2026-38426

CVE-2026-38426: Débordement de tampon de pile strcpy dans Tasmota fetchjpg boundary40 CVE: CVE-2026-38426 Sévérité : Critique CVSS 9.8 Produit : Arendst Tasmota Version affectée : = 15.3.0.3 Fichier : tasmota/tasmotaxdrvdriver/xdrv10scripter.ino Fonction : fetchjpg — cas 0 connexion initiale Aute...

CVE-2025-7783-poc

ثغرة عشوائية في حدود بيانات النموذج CVE-2025-7783 مبنية بشكل كبير على https://hackerone.com/reports/2913312 بواسطة https://hackerone.com/parrot409?type=user التثبيت: npm install تأكد من تثبيت python3 مع الوحدة z3 pip3 install -r requirements.txt -- كود الاستغلال يستدعي python3 لتوقع القيمة...

Quantum-Silicon-Core-Loader

Quantum Silicon Core Loader Primary Core: qslcl.asm v0.0.2 under development Assistant Module: qslcl.bin v0.7.4 Universal Controller: qslcl.py v2.2.2 Legally Protected Research - This project operates under established legal frameworks for security research, right to repair, and academic freedom...

mkdev

mkdev Настоящий HTTPS для локальной разработки — с TUI и расшариванием в LAN. mkdev запускает доверенный HTTPS на .local. Один Go-бинарник: центр сертификации CA + обратный прокси + /etc/hosts + mDNS-вещание + полноценный TUI. Что отличает его от других: Расшаривание в LAN. Пометьте маршрут как...

K000163062: Node.js vulnerability CVE-2026-56847

Security Advisory Description A flaw in Node.js Permission Model enforcement allows traceevents.createTracing.enable Writes Trace Logs Outside --allow-fs-write. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability...

firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component...

firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component...

firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

POC-GeoLeak-CVE-2026-52715

GeoLeak — PoC de la CVE-2026-52715 Preuve de concept éducative de GeoLeak CVE-2026-52715, injection SQL non authentifiée CVSS 9.3 dans le plugin GEO my WordPress = 4.5.5 pour WordPress. Les paramètres swlatlng et nelatlng des limites de la carte sont interpolés sans assainissement dans la clause...

CVE-2026-53530 ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint ratexparser::parse&str panics on the 9-byte input \verbéxé i.e. \verb followed by the non-ASCII delimiter é. When handling a \verb command, the parser slices the verbatim...