curl: Timing Attack Vulnerability in curl Digest Authentication via Non-Constant-Time String Comparison

Summary: A timing attack vulnerability exists in curl's Digest Authentication implementation due to the use of non-constant-time string comparison strcmp when comparing authentication algorithms in digest.c line 360. This allows attackers to determine the supported authentication algorithm throug...

curl: Security Analysis Report: CURL Integer Overflow Vulnerability

Vulnerability Overview Vulnerability Type: Integer Overflow in HTTP chunked encoding Location in Source: lib/httpchunks.c line 173 lib/curlx/strparse.c lines 185–186 Impact: Integer overflow leads to memory corruption Can cause buffer overflow Results in Denial of Service DoS for curl Potential...

curl: int overflow in krb5_read_data() leads to (possible) massive `recv()` write

Summary: Note: AI created the PoC, not the report. In the krb5readdata function here, there are two issues one of which I am very surprised hasn't been caught before. Issue 1 is that this block can result in an int overflow, where the following check becomes invalid if the value is wrapped to a...

IBM: IBM Aspera HTTP Gateway stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.

The IBM Aspera HTTP Gateway stored sensitive information in clear text in easily obtainable files, which could be read by an unauthenticated user. The issue was submitted to IBM, analyzed, and remediated...

curl: Stack Buffer Overflow in cURL Cookie Parsing Leads to RCE

Summary I discovered a critical stack-based buffer overflow vulnerability in cURL's cookie parsing mechanism that can lead to remote code execution. The vulnerability occurs when processing maliciously crafted HTTP cookies, affecting all applications that use libcurl for HTTP requests. Descriptio...

Nextcloud: Approval app allows users to request approval for other users file

A security vulnerability was discovered in the Approval app that allowed users to request approval for other users' files. The vulnerability was addressed in a security advisory...

curl: Multiple Unsafe strcpy() Function Calls Leading to Potential Buffer Overflow Vulnerabilities in cURL 8.16.1-DEV

Summary: During a comprehensive security audit of the cURL codebase, multiple instances of unsafe strcpy function usage were identified in critical code paths. These implementations violate secure coding practices and represent latent security risks that could lead to buffer overflow...

Django: SQL Injection in Django ORM via Unvalidated `_connector` in Q Objects

A critical SQL injection vulnerability was discovered in the Django ORM's handling of Q objects. The internal WhereNode.assql method used unsafe string formatting to inject the query connector, which could be controlled by an attacker through the connector key when creating a Q object. This allow...

curl: TOCTOU Race Condition in HTTP/2 Connection Reuse Leads to Certificate Validation Bypass

I've discovered a Time-of-Check to Time-of-Use TOCTOU vulnerability in how libcurl handles persistent HTTP/2 connections. During the initial handshake, libcurl correctly validates the server's certificate against the user-provided CA bundle. However, it then assumes this trust is permanent for th...

Nextcloud: Nextcloud Tables v1 Share Enumeration Without Authorization (Regression of CVE-2024-52507)

A vulnerability was discovered in Nextcloud Tables v1 that allowed unauthorized users to enumerate shares. The vulnerability was a regression of a previously addressed issue, CVE-2024-52507...

curl: Confirmed Security Misconfigurations on curl.se (BREACH, Missing Security Headers, ETag Info Disclosure)

Summary: During a security assessment of curl.se, multiple misconfigurations were identified that led to information disclosure or weakened the security posture of the website. Affected version: Website: https://curl.se Tested on: 09-09-2025 curl version: curl/8.8.0 x8664-pc-linux-gnu Steps To...

curl: CVE-2025-10148: predictable WebSocket mask

No AI was involved. Summary: The curl WebSocket implementation generates a fixed masking key at the beginning of a connection an re-uses it for every frame: Generation of masking key enc.mask in Curlwsaccept: https://github.com/curl/curl/blob/455afa1de5182b95a5dcc988f18cdff584b95239/lib/ws.cL1340...

SingleStore: 2FA bypass possible on https://authsvc.singlestore.com

A vulnerability was discovered that allowed the 2FA authentication mechanism to be bypassed completely. An attacker could access the victim's account by only knowing the email address and password, without requiring the 2FA code...

Basecamp: Improper bot-authentication allows to impersonate any user when sending messages in a room

A vulnerability was discovered in the bot authentication mechanism. The issue allowed an unauthenticated user to impersonate any user and post messages in rooms the impersonated user had access to. The bot authentication function failed to properly validate the bot key, allowing a partial key to...

U.S. Dept Of Defense: Exposed wp-config.php file in ███ National Guard website

A WordPress configuration file containing sensitive information, such as the MySQL database password, was found exposed on a website of the National Guard. The file was accessible at a public endpoint...

Django: Path traversal via archive.extract - CVE 2021-3281 incomplete patch

A vulnerability was discovered in the "extract" function of the ZipArchive and TarArchive classes in the Django framework. The vulnerability was caused by the use of the "abspath" function, which removes terminating path separators. This made the guard logic protection insufficient to protect...

Bykea: Lack of minimum value bid wheel verification on customer_bid in Rental Trips

A missing validation on the customerbid field when creating rental trips allowed passengers to submit arbitrary bid amounts, including very low fares. Proper validation was added to prevent unrealistic values...

AWS VDP: Existence of completed pods allows for bypass of Kubernetes NetworkPolicy

Description The Amazon VPC CNI controller, when configured to manage NetworkPolicy rules, will incorrectly apply firewall rules for Completed pods as if the pods are still running, causing these rules to be applied to other unrelated pods that happen to receive the same IP address as a Completed...

Integer Overflow → Heap Buffer Overflow in BYTES-Tensor Parsing (DoS)

This report is not public...

Mozilla: User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla Pontoon

A vulnerability was discovered in the Mozilla Pontoon application that allowed users to delete other users' personal access tokens at the /delete-token/tokenid/ endpoint without proper permission checks. The vulnerability was caused by the absence of user permission verification in the deletetoke...