CVE-2020-37180

CVE-2020-37180 affects GTalk Password Finder 2.2.1. A denial-of-service can crash the application by supplying an oversized Key payload (1000 characters). Exploitation details: the payload is entered into the Key field to trigger the crash; CVSS metrics show Network attack vector (3.1) with high ...

CVE-2020-37179

APKF Product Key Finder 2.5.8.0 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input field. Attackers can generate a 1000-character payload and paste it into the registration name field to trigger an application crash...

PT-2026-7699

Name of the Vulnerable Software and Affected Versions NetShareWatcher version 1.5.8.0 Description A buffer overflow occurs in the registration name input, which can lead to an application crash. This happens when a payload of 1000 characters is entered into the 'Name' field. Recommendations At th...

PT-2026-7687

TaskCanvas 1.4.0 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the registration field to trigger an application crash...

PT-2026-7685

SpotDialup 1.6.7 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Name' field to trigger an application crash...

PT-2026-7689

Top Password Software Dialup Password Recovery 1.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing input fields. Attackers can trigger the vulnerability by inserting a large 5000-character payload into the User Name and Registration Code...

PT-2026-7683

Backup Key Recovery 2.2.5 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input field. Attackers can generate a 1000-character payload and paste it into the registration name field to trigger an application crash...

PT-2026-7706

Name of the Vulnerable Software and Affected Versions SpotFTP version 3.0.0.0 Description A buffer overflow occurs in the registration key input field, which can lead to an application crash and denial of service. This happens when a payload of 1000 characters is entered into the Key field...

PT-2026-7710

Name of the Vulnerable Software and Affected Versions SpotMSN version 2.4.6 Description A denial of service issue exists in the registration name input field. An attacker can cause the application to crash by submitting a 1000-character payload into the Name field. Recommendations At the moment,...

PT-2026-7677

APKF Product Key Finder 2.5.8.0 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input field. Attackers can generate a 1000-character payload and paste it into the registration name field to trigger an application crash...

PT-2026-7678

GTalk Password Finder 2.2.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration key. Attackers can generate a 1000-character payload and paste it into the 'Key' field to trigger an application crash...

PT-2026-7673

P2PWIFICAM2 for iOS 10.4.1 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the Camera ID input field. Attackers can paste a 257-character buffer into the Camera ID field to trigger an application crash on iOS devices...

PT-2026-7704

Name of the Vulnerable Software and Affected Versions ShareAlarmPro affected versions not specified Description A denial of service issue exists where attackers can crash the application by providing an oversized registration key. This is achieved by pasting a 1000-character buffer payload into t...

Huawei HarmonyOS OS Command Injection Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS 0.1.0 version exists operating system command injection vulnerability, the vulnerability stems from the function inputtext parameter text...

Output Injection

Badkeys is vulnerable to output injection. The vulnerability is due to improper handling and sanitization of control characters in input, which allows an attacker to inject malicious content that produces misleading or manipulated command-line output when scanning DKIM keys, SSH keys, or filename...

CVE-2026-24320

Due to improper memory management in SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory...

CVE-2026-25479 Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to 2.20.0, in litestar.middleware.allowedhosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning e.g., . matches any character. This enables a bypass...

CVE-2026-25478

Litestar (ASGI framework) contains a vulnerability in CORSConfig.allowed_origins_regex prior to 2.20.0 where a regex built from allowlist values is used with fullmatch without escaping metacharacters, allowing a malicious origin to match unexpectedly. Impact is indicated as HIGH (CVSS 3.1: AV:N/A...

CVE-2026-25478 Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to 2.20.0, CORSConfig.allowedoriginsregex is constructed using a regex built from configured allowlist values and used with fullmatch for validation. Because metacharacters are not escaped, a malicious origin can match...

GHSA-2P2X-HPG8-CQP2 Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins

Summary CORS origin validation can be bypassed because the allowed-origins allowlist is compiled into a regex without escaping metacharacters notably .. An allowed origin like https://good.example can match https://goodXexample, resulting in Access-Control-Allow-Origin being set for an untrusted...