CVE-2026-106567

The ImageMagick image manipulation software is vulnerable to a denial of service (DoS) attack on 32-bit builds . A crafted PSD file can trigger an integer-conversion error within the PSD decoder, leading to an infinite loop . This issue is addressed in versions 7.1.2-32 and 6.9.13-57 . No specifi...

CVE-2026-77214

A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist ...

CVE-2026-106566 ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICKSHREDPASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in...

CVE-2026-106566 ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICKSHREDPASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in...

EUVD-2026-94381

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICKSHREDPASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in...

CVE-2026-106566

The ImageMagick image manipulation software is vulnerable to a policy bypass in the delegate symlink cleanup process. Due to a missing check for the MAGICK_SHRED_PASSES environment variable, a local privileged workflow can be exploited to overwrite a file with random data. This issue is fixed in ...

vulnerabilities in Google Android

Google has identified vulnerabilities in Android. Samsung has addressed the vulnerabilities relevant to Samsung Mobile devices in their products. These vulnerabilities include incorrect bounds checking, missing permission checks, integer overflows, improperly initialized pointers, type confusion,...

Crow-Eye

Crow-Eye — Motor de Forense para Windows Una máquina del tiempo forense para Windows. Crow-Eye no solo detecta — reconstruye lo que realmente ocurrió en la línea de tiempo, desde la adquisición hasta un veredicto rastreable hasta sus registros de origen. Tabla de Contenidos Descripción General ✨...

awesome-TS-anomaly-detection

awesome-TS-anomaly-detection Lista de herramientas y datasets para la detección de anomalías en datos de series temporales. Todas las listas están en orden alfabético. En las listas, los proyectos mantenidos tienen prioridad frente a los no mantenidos. Se considera que un repositorio está "no...

njsscan

njsscan njsscan 是一款静态应用程序测试（SAST）工具，它使用来自 libsast 的简单模式匹配器以及语法感知的语义代码模式搜索工具 semgrep，在您的 node.js 应用程序中查找不安全的代码模式。 在印度用 制作 支持 njsscan 通过 Paypal 捐赠： 赞助本项目： 在线学习课程与认证 OpSecX Node.js Security: Pentesting and Exploitation - NJS 安装 pip install njsscan 需要 Python 3.10+，仅支持 Mac 和 Linux 命令行选项 $ njsscan usag...

CVE-2026-77214

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...

CVE-2026-106561

Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding the standard Kubernetes resource read permission could...

CVE-2026-106562

Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject...

CVE-2026-106563

Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes...

CVE-2026-106559

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper input validation in confluence to markdown scaffolder module. Insufficient input validation in the Confluence to...

CVE-2026-106560

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

CVE-2026-106558

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

CVE-2026-106556

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an...

CVE-2026-106510

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdownextensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted...

lighty-sqlinj-demo

title: Ep4 - 网络相关漏洞 members: Ciro S. Costa Marcela Terakado date: 2015年11月10日 相关漏洞: CVE-2014-2323 1 被分配给 SQL 注入漏洞。 CVE-2014-2324 2 被分配给路径遍历漏洞。 确认: http://download.lighttpd.net/lighttpd/security/lighttpdsa201401.txt 受影响版本: 1.4.34 介绍 解释漏洞 介绍要利用的服务 源码中漏洞的位置 漏洞的修复补丁 准备相关漏洞利用演示 漏洞利用 应用漏洞修复 再次尝试利用...