CVE-2024-58379

nodemailer before 6.9.9 contains a regular expression denial of service (ReDoS) vulnerability in email parsing, triggered when the attachDataUrls parameter is set or when processing embedded file attachments. Attackers can send specially crafted emails containing malicious data URLs or embedded a...

CVE-2024-58379

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...

K000163144: Spring Data vulnerability CVE-2026-41696

Security Advisory Description Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected...

CyberLabs-SOC-L1-RetailBreach

🛡️ CyberLabs SOC L1 – RetailBreach Investigation Overview...

K000163143: Multiple CoreDNS vulnerabilities CVE-2026-35579, CVE-2026-33489, CVE-2026-33190, CVE-2026-32934, CVE-2026-32936

Security Advisory Description CVE-2026-35579 CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the configurati...

Exploit for CVE-2026-76569

Reflected XSS via search GET Parameter in Phoca Download Ph...

CVE-2026-52887-NocoBase-SQLi-RCE

CVE-2026-52887 — NocoBase SQL Injection → PostgreSQL-superuser RCE SQL injection in the myInAppChannels:list action of NocoBase's @nocobase/plugin-notification-in-app-message ≤ 2.0.60. The filterlatestMsgReceiveTimestamp$lt request parameter is interpolated directly into a raw Sequelize.literal S...

python-paddingoracle

python-paddingoracle: A portable, padding oracle exploit API UPDATED FOR PYTHON 3 python-paddingoracle is an API that provides pentesters a customizable alternative to PadBuster and other padding oracle exploit tools that can't easily without a heavy rewrite be used in unique, per-app scenarios...

CVE-2026-80694

A flaw was found in the Linux kernel's mtkethsoc Ethernet driver. The mtkpollcontroller function incorrectly passed a netdevice pointer instead of an mtketh structure to mtkhandleirqrx. This incorrect parameter passing can lead to a system crash when ndopollcontroller is called with...

CVE-2026-76071

CVE-2026-76071: Unauthenticated Pre-Auth Stack Buffer Overflow via sscanf %^, in skkset.cgi ipFilterList Handler in Netis NC63 Researcher: Özcan Ersan @ozcanpng Disclosure status CVE: CVE-2026-76071 Vendor: Netis Systems Co., Ltd. Product: Netis NC63 AC1200 Wireless Dual Band Gigabit MU-MIMO Rout...

CVE-2026-40465

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-40465

Nokia NSP (Network Service Platform) is vulnerable to an open redirect caused by insufficient server-side validation of the URL or redirect parameter. An attacker can craft a malicious URL that redirects users to an untrusted destination, potentially facilitating phishing attacks. The CVSS 3.1 sc...

CVE-2026-40465 An Open Re-direct Vulnerability in Nokia NSP

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

EUVD-2026-68374

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-40465 An Open Re-direct Vulnerability in Nokia NSP

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-19913

A flaw was found in the Kaltura HTML5 player mwEmbed / html5lib. An unauthenticated, remote attacker can exploit improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter, used for backend requests, accepts non-HTTP schemes such as file://. When an exception or error...

drupalgeddon2-cli

drupalgeddon2-cli A command-line rewrite of the Drupalgeddon2 CVE-2018-7600 proof-of-concept, built as a study exercise while working through the Hack The Box Academy Attacking Common Applications module. !WARNING For authorised security testing and education only. Running this against systems yo...

CVE-2019-15715

CVE-2019-15715 The current repository is an implementation in Python3 of CVE-2019-15715 and aims to focus on the solely improvement of the CVE-2019-15715 previously reported here by Nikolas Geiselman by adding python's parameter implementation to make the script more flexible. root@kitploit:...

CVE-2026-45585

🔑 CVE-2026-45585 - YellowKey 🔓 Advanced mitigation for CVE-2026-45585 YellowKey 📌 What is YellowKey Vulnerability? YellowKey CVE-2026-45585 is a zero-day physical attack vulnerability discovered in May 2026 that allows attackers with physical access to completely bypass BitLocker encryption on...

CVE-2026-37149

CVE-2026-37149 SQL Injection in GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 Overview CVE ID: CVE-2026-37149 Vulnerability Type: SQL Injection CWE-89 Severity: High Discoverer: Dhyey Patel Description GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0...