923 matches found
wotop
Web-On-Top-Of-Protocol WOTOP ██╗ ██╗ ██████╗ ████████╗ ██████╗ ██████╗ ██║ ██║██╔═══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ██║ █╗ ██║██║ ██║ ██║ ██║ ██║██████╔╝ ██║███╗██║██║ ██║ ██║ ██║ ██║██╔═══╝ ╚███╔███╔╝╚██████╔╝ ██║ ╚██████╔╝██║ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ Introduction WOTOP is a tool meant to...
gitea-artifact-v4-readall
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitea-artifact-v4-readall gitea-artifact-v4-readall Gitea 1.27.3 - Gitea jobsummary.go already caps at MaxJobSummarySize 1 MiB with io.LimitReader. parseProtobufBody in artifact v4 does io.ReadAllctx.Req.Body with no...
W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure
The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string "W3 Total Cache", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, t...
EUVD-2026-104559
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...
CVE-2026-95101
A flaw was found in NGINX. When HTTP/3 is used with proxy request buffering enabled, an unauthenticated remote attacker can inject arbitrary data into proxied requests. This vulnerability allows an attacker to manipulate traffic forwarded to backend servers, compromising data integrity...
undici: undici: Denial of Service via unbounded WebSocket PONG buffering
A flaw was found in undici. A malicious or compromised WebSocket server can trigger a Denial of Service DoS by repeatedly sending small PING messages while refusing to read the client's automated replies. Because the client ignores flow-control signals when writing responses to the network socket...
undici: undici: Denial of Service via unbounded WebSocket PONG buffering
A flaw was found in undici. A malicious or compromised WebSocket server can trigger a Denial of Service DoS by repeatedly sending small PING messages while refusing to read the client's automated replies. Because the client ignores flow-control signals when writing responses to the network socket...
Security update for glib2
This update for glib2 fixes the following issue: CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively y...
CVE-2026-16251 Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized ima...
CVE-2026-16251
Mattermost versions 11.10.x <= 11.10.0 , 11.7.x <= 11.7.9 , 11.9.x <= 11.9.1 , and 11.8.x
CVE-2026-109932 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For...
CVE-2026-109932 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For...
CVE-2026-109932
The undici HTTP client library for Node.js is vulnerable to a Denial of Service (DoS) attack due to unbounded automatic PONG write queuing in the WebSocket ByteParser receiver. In affected versions (5.15.0 through 6.29.0 , 7.0.0 through 7.30.0 , and 8.0.0 through 8.12.1 ), a remote attacker can s...
Astra Linux – Vulnerability in Linux, Linux 5.10
A guest can force the Linux netback driver to consume a large amount of kernel memory. This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVEs. Incoming data packets for a guest in the Linux kernel’s netback driver are buffere...
CVE-2026-107756
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-107756
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 5.6.2 . The flaw stems from insufficient input sanitization and output escaping of the display_name + comment parameters. An authenticated attacker with subscriber-level acces...
CVE-2026-107756 Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
EUVD-2026-100906
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-107756: Improper Neutralization of Input During Web Page Generation
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2026-114355
Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http v3 module module. When HTTP/3 is used in conjunction with the proxy request buffering directive set to on, a...