padding-oracle-attacker

padding-oracle-attacker CLI tool and library to execute padding oracle attacks easily, with support for concurrent network requests and an elegant UI. Install Make sure Node.js is installed, then run $ npm install --global padding-oracle-attacker or $ yarn global add padding-oracle-attacker CLI...

Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore

Impact ActionDispatch::Session::CacheStore writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through resetsession on logout or by deleting its cache entry on t...

EUVD-2026-121707

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations...

rustbuster

rustbuster A Comprehensive Web Fuzzer and Content Discovery Tool Introduction Check the blog post: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool Download You can download prebuilt binaries from here. Installation installrustbuster echo "Installing latest version o...

EUVD-2026-119831

The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests...

CVE-2024-53476

CVE-2024-53476 Description SimplCommerce is affected by a race condition vulnerability in the checkout logic, allowing multiple users to purchase more products than are in stock via simultaneous checkout requests. Detection Method An attacker can detect this vulnerability by attempting to purchas...

strutser

strutser This program checks for CVE-2017-5638. Usage Usage of ./strutser: Usage of ./strutser: -c, --concurrency int Concurrent HTTP requests. default 10 -f, --file string File containing targets -p, --ports intSlice Ports to check. default 80 -t, --timeout int Timeout on HTTP requests. default ...

php-app-race-condition

Vulnerable PHP App Race Condition Environment setup: docker-compose up Environment verification: Connection Test: http://localhost/test.php Vulnerable endpoint: http://localhost/poc.php Race condition exploit: echo http://localhost | nuclei -t race.yml Observe that less than 1280$ were accounted...

CVE-2026-36958

CVE-2026-36958: Denial of Service via Concurrent HTTP Requests CVE ID: CVE-2026-36958 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: U-SPEED Product: U-SPEED Router Firmware Version: V1.0.0 CWE: CWE-400 - Uncontrolled Resource Consumption Description The U-SPEED Router firmware V1.0.0 is...

@better-auth/drizzle-adapter: Concurrent Requests Can Exceed Rate Limits On PostgreSQL

Am I affected? You are affected if you use "@better-auth/drizzle-adapter" from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or "@better-auth/kysely-adapter" 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these...

GHSA-44JH-23M7-HPCF @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...

@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...

EUVD-2026-106242

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite component: Concurrent Requests. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-101844

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite component: Concurrent Requests. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-101844

A vulnerability exists in the Oracle Concurrent Processing product within Oracle E-Business Suite , specifically affecting the Concurrent Requests component in supported versions 12.2.3-12.2.15 . A low-privileged attacker with network access via HTTP can exploit this difficult-to-exploit vulnerab...

PT-2026-119513

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite component: Concurrent Requests. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Oracle E-Business Suite: CVE-2026-101844: Critical Patch Update

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite component: Concurrent Requests. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Oracle Concurrent Processing security vulnerability

Oracle Concurrent Processing versions 12.2.3 to 12.2.15 have security vulnerabilities. These vulnerabilities stem from issues with the Concurrent Requests component, which may allow low-privilege attackers to access certain accessible data via the HTTP network, leading to unauthorized access to...

CVE-2026-94544

A flaw was found in Next.js. Pending cache operations do not properly separate Draft Mode requests from standard requests when fulfilling matching cache keys. Under concurrent request conditions, an unauthenticated user can receive unpublished draft content generated during an editor's session. I...

CVE-2026-79625

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit...