CVE-2026-57228

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...

DEBIAN-CVE-2026-93751

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

CVE-2026-93751

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

CVE-2026-93751

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

CVE-2026-93751

uri-js through version 4.4.1 is affected by an improper UTF-8 decoding flaw in the pctDecChars() function. The function incorrectly decodes invalid and overlong percent-encoded sequences into ASCII metacharacters, allowing attackers to craft payloads that bypass platform decoder validation and in...

CVE-2026-93751 uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

CVE-2026-19264

CVE-2026-19264 - Postiz 中未经验证的路径遍历导致完全接管实例 作者： Krithik Babu P @DarkLycn1976 发布时间： 2026-08-10 CVE： CVE-2026-19264 严重性： 严重 - CVSS 4.0 9.3 / CVSS 3.1 9.8 CWE： CWE-22 - 对受限目录中路径名的限制不当 受影响版本： gitroomhq/postiz-app 2.22.1 修复版本： v2.22.1 TL;DR Postiz 通过一条路由提供本地存储的媒体文件，该路由将 URL...

CVE-2026-84447

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processedids is copied per branch and ImageItem::decodeimage has no shared operation budget. This vulnerability is fix...

CVE-2026-84451

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...

EUVD-2026-83023

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processedids is copied per branch and ImageItem::decodeimage has no shared operation budget. This vulnerability is fix...

CVE-2026-84447

libheif (HEIF/AVIF decoder/encoder) versions 1.23.1 and earlier are affected by a CPU/memory amplification denial-of-service vulnerability. Crafted grid , iovl , and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_im...

CVE-2026-93560

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service DoS by exhausting memo...

CVE-2026-86251

A flaw was found in h3. A remote attacker could exploit a path traversal vulnerability in the serveStatic utility. This vulnerability arises from a double-decoding flaw, where specially crafted, double-encoded dot sequences in a request path are incorrectly processed. This allows an attacker to...

Powshell-decode-payload

解码 PowerShell gzip 代码 sal a New-Object;a IO.StreamReadera IO.Compression.GZipStreamIO.MemoryStreamConvert::FromBase64String'xxxx',IO.Compression.CompressionMode::Decompress,Text.Encoding::ASCII.ReadToEnd root@kitploit: sal a New-Object;a IO.StreamReadera...

flare-ida

Code Grafter 関数置き換え Code Grafter について Code Grafter は、IDA Pro の Bochs IDB モード を使用して、Windows API 関数をインポートするコードをエミュレートできるようにする IDA Python スクリプトです。Bochs IDB モードのようなエミュレーション環境は、インポートされた関数を解決またはエミュレートしないため、特定のコードでエミュレーションを使用できず、例外が発生します。Code Grafter は、オペコードとデータを挿入してインポートされた Windows API...

rabid

RABID RA pid B ig I P D ecoder 概要 すべての種類のBigIP Cookieを簡単にデコードできるCLIツールとライブラリ。 特徴 4種類のCookieフォーマットをすべてサポート CLIツールおよびライブラリ ハック可能 参考資料 ホームページ / ドキュメント: https://orange-cyberdefense.github.io/rabid/ 作者 Alexandre ZANNI @noraj（Orange Cyberdefenseのペネトレーションテスター）によって作成されました。...

AspDotNetWrapper-Edited-

AspDotNetWrapper 用于测试 ASP.NET 中的 viewstate 机器密钥 下载 在 Windows 中克隆并解压文件 使用方法 root@kitploit: AspDotNetWrapper.exe --keypath MachineKeys.txt --encrypteddata --decrypt --purpose=viewstate --modifier= --macdecode 将 替换为 viewstate= 参数的 value in the source 将 替换为 VIEWSTATEGENERATOR= 参数的 value in the source...

blackboxprotobuf

Blackbox Protobuf Blackbox Protobuf 现在在 PyPi 上有一个官方包，名称为bbpb。 blackboxprotobuf 包是一个较旧的分支 描述 Blackbox Protobuf 是一组用于处理编码后的 Protocol Buffers（protobuf）数据的工具，无需匹配的 protobuf 定义。 Protobuf 是 Google 的一种二进制序列化格式，可以作为 JSON 或 XML 等格式的更高效替代方案。开发者可以在 .proto 文件中定义消息格式，并使用 protobuf 编译器生成所选语言的 message 处理器。protob...

DriverBuddy

快速入门 DriverBuddy 安装说明 1. 将 DriverBuddy 文件夹和 DriverBuddy.py 文件复制到 IDA 插件文件夹中，例如 C:\Program Files x86\IDA 6.8\plugins 或你安装 IDA 的位置 DriverBuddy 使用说明 1. 启动 IDA 并打开一个 Windows 内核驱动程序 2. 转到 Edit-Plugins 并选择 Driver Buddy，或按 ctrl-alt-d 3. 在 Output 窗口中查看 DriverBuddy 分析结果 4. 要解码 IOCTL，请高亮可疑的 IOCTL 并按...

CVE-2025-47273-PoC

CVE-2025-47273: setuptools 78.1.0 版本 - setuptools.packageindex 中的路径遍历漏洞 免责声明 此概念验证（PoC）仅供教育目的和授权安全审计使用。作者不对本信息的滥用承担任何责任。未经授权访问计算机系统是非法的且不道德。 漏洞分析 CVE-2025-47273 是在 setuptools 库（v78.1.0 及更早版本）的 packageindex 模块中发现的一个路径遍历漏洞。该漏洞允许攻击者通过向 PackageIndex.download 方法提供特制 URL 来执行任意文件写入。 根本原因：os.path.join 的行...