golang: cmd/compile: no-op interface conversion bypasses overlap checking

A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data...

golang: cmd/compile: possible memory corruption after bound check elimination

A flaw was found in the cmd/compile package in the Go standard library. The compiler fails to correctly check for integer overflow or underflow in arithmetic operations involving loop induction variables. As a result, the compiler allows invalid memory indexing to occur at runtime, potentially...

golang: cmd/compile: no-op interface conversion bypasses overlap checking

A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data...

Exploit for Missing Authentication for Critical Function in Langflow

Breaker CVE-2025-3248 배포 정보 GZCTF 운영진 설정용 | 항목 | 설정값 |...

Astra Linux – Vulnerability in unbound

Unbound versions 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can lead to the execution of shell code after receiving a specially crafted answer. This issue can only be exploited if Unbound was compiled with the --enable-ipsecmod option, and Isecmod is enabled and utilized...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: wilc1000 – fixed a potential memory leak in wilcmacxmit The wilcmacxmit function returns NETDEVTXOK without freeing the skb buffer; devkfreeskb was added to address this issue. This fix has been tested only during compilati...

CVE-2026-62847

Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory "Path.GetTempPath", i.e. "/tmp", and...

obfus.h

obfus.h obfus.h is a macro-only library for compile-time polymorphic obfuscation of C applications, designed specifically for TinyCC 0.9.28rc on Windows x86 and x64. Download the complete compiler package from TinyCC-builder releases. One file. Protection baked into your binary. Just seeing obfus...

CVE-2026-104884

Commit "23e8cca3136a" hardened the search-result title against insert-tag/XSS by setting "$objTemplate-title = StringUtil::specialcharsStringUtil::stripInsertTags$arrResult$i'title'". But the default template does not use that "title" variable - it prints the raw "link" variable, which is assigne...

Contao: The registration module re-sends activation mails

ModuleRegistration::compile reaches its follow-up registration branch on any POST to a page carrying the module. That branch checks neither FORMSUBMIT nor the captcha result computed immediately above it, and resendActivationMail leads to OptInToken::send, which has no rate limit at all. Impact...

GHSA-MFXH-VP55-7GC6 Contao: The registration module re-sends activation mails

ModuleRegistration::compile reaches its follow-up registration branch on any POST to a page carrying the module. That branch checks neither FORMSUBMIT nor the captcha result computed immediately above it, and resendActivationMail leads to OptInToken::send, which has no rate limit at all. Impact...

Allocation of Resources Without Limits or Throttling

Overview contao/core-bundle is an Open Source PHP Content Management System for people who want a professional website that is easy to maintain. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ModuleRegistration::compile process. An...

CVE-2026-107843

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORMSUBMIT or the preceding captcha result. resendActivationMail can then invok...

CVE-2026-107843 Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORMSUBMIT or the preceding captcha result. resendActivationMail can then invok...

EUVD-2026-95973

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORMSUBMIT or the preceding captcha result. resendActivationMail can then invok...

CVE-2026-107843

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORMSUBMIT or the preceding captcha result. resendActivationMail can then invok...

CVE-2026-107843

The Contao Open Source CMS (versions 4.1.0 through 5.3.50 and 5.7.12 ) contains a vulnerability where the ModuleRegistration::compile() function fails to verify FORM_SUBMIT or captcha results on unauthenticated POST requests. This allows an unauthenticated attacker to trigger the resendActivation...

CVE-2026-107843 Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORMSUBMIT or the preceding captcha result. resendActivationMail can then invok...

CVE-2026-107843 Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORMSUBMIT or the preceding captcha result. resendActivationMail can then invok...

PT-2026-109302

Name of the Vulnerable Software and Affected Versions Contao versions 4.1.0 through 5.3.49 Contao versions 5.7.0 through 5.7.11 Description An issue exists where the ModuleRegistration::compile function enters its follow-up registration branch on any POST request to a page containing the...