rules

Hashcat Rules Collection An updated, curated collection of Hashcat rules for cracking complex passwords. !NOTE Hashcat beta has introduced The Table Attack. A collection of tables can be found here. Contributors needed. 🤝 Contributing Simply fork the repo, commit your changes, and open a PR. ⭐...

Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's processfilter function concatenating user-submitted form field values into a PHP code string without proper...

PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct

PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's...

CVE-2026-42533

CVE-2026-42533 — nginx two-pass capture clobbering Pre-auth heap overflow + info leak in nginx 0.9.6–1.30.3 / mainline ≤1.31.2 complex-value script engine; CVSS 9.2. Two trigger surfaces share the same root cause: HTTP regex location + regex map and stream sslpreread + SNI + regex map. In-depth...

CVE-2020-37287 Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the...

CVE-2020-37287

Vyper versions prior to 0.2.6 are susceptible to a call stack corruption vulnerability. The root cause is an incorrect assumption by the compiler that each subtype size is 32, which occurs when complex types with non-base members are passed as function arguments. This flaw leads to corrupted func...

CVE-2020-37287 Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the...

EUVD-2026-106212

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite component: LOV. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-101812

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite component: LOV. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-101812

The Oracle E-Business Suite product Oracle Complex Maintenance, Repair and Overhaul (specifically the LOV component) is vulnerable in versions 12.2.3-12.2.15 . A low-privileged attacker with network access via HTTP can exploit this difficulty-to-exploit vulnerability to compromise the product. Su...

PT-2026-119484

Name of the Vulnerable Software and Affected Versions Oracle Complex Maintenance, Repair and Overhaul versions 12.2.3 through 12.2.15 Description An issue exists in the LOV component of the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite. A low privileged attack...

Oracle E-Business Suite: CVE-2026-101812: Critical Patch Update

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite component: LOV. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Oracle Complex Maintenance Repair And Overhaul security vulnerabilities

Oracle Complex Maintenance Repair And Overhaul has security vulnerabilities. These vulnerabilities stem from issues with the LOV component and are difficult to exploit. Unauthorized attackers may access critical data or all accessible data via the HTTP network, and unauthorized access to critical...

Diem project Diem authorization issue vulnerability

The Diem project has a security vulnerability. This vulnerability stems from improper handling of unknown functions in the dmCorePlugin/lib/vendor/gapi/gapi.class.php file, which is part of the Google Analytics Client component. This could lead to improper certificate verification, allowing remot...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: misc: alcorpci: Fix nullptrderef when there is no PCI bridge There is an issue with the ASPM optional capability checking function. A device may be directly connected to the root complex. In this case, bus-selfbridge will be...

PT-2026-92912

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to...

CVE-2026-83425: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.12-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2026-83445: Improper Privilege Management

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to...

CVE-2026-90505: Concurrent Execution using Shared Resource with Improper Synchronization

A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipulation results in race condition. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is...

Malicious code in complex-black-impala (npm)

Source: amazon-inspector bca9e5db858c1064e6a1d9b2d6e7bbbfb2af406769f92fb9dd372add98e00980 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...