encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

graphql-threat-matrix

GraphQL Threat Matrix Why graphql-threat-matrix? graphql-threat-matrix was built for bug bounty hunters, security researchers and hackers to assist with uncovering vulnerabilities across multiple GraphQL implementations. The differences in how GraphQL implementations interpret and conform to the...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

EUVD-2026-77480

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.8, 10.11.x = 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service CPU resource exhaustion via a crafted post containing deeply nested...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

RelayKing-Depth

RelayKing v1.10 统治域。将中继推向王权。 RelayKing 是一款全面的中继检测与枚举工具，旨在识别 Active Directory 环境中的中继攻击机会。提供实用的报告选项、全面的攻击覆盖。发现隐藏的中继向量，并以您喜欢的输出格式报告。将检测到的可中继主机整理为精选目标列表，供 Impacket 的 ntlmrelayx.py 使用。再也不会错过域中关键的可利用 NTLM 中继路径。 博客/推荐阅读： 请参阅 Depth Security...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: The issue in fdt: fix off-by-one error in unflattendtnodes Commit 78c44d910d3e “drivers/of: Fix depth when unflattening devicetree” forgot to fix the depth check within the loop body of unflattendtnodes. This could lead to an...

AgentWard

AgentWard · 玄甲OS...

fence

Fence はコマンドをサンドボックスでラップし、デフォルトでネットワークアクセスをブロックし、設定可能なルールに基づいてファイルシステム操作を制限します。これは、半信頼のおけるコード（パッケージインストール、ビルドスクリプト、CIジョブ、馴染みのないリポジトリ）を副作用を制御しながら実行する場合に最も役立ち、また、AIコーディングエージェントに対して多層防御として補完することもできます。 root@kitploit: すべてのネットワークアクセスをブロック（デフォルト） fence curl https://example.com → 403 Forbidden 特定のドメインを許可...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

sqlmc

SQLMC - SQL Injection 大規模チェッカー デモ 情報 このツールは教育目的のみに使用されます。事前の相互同意なしにSQLMCを使用してターゲットを攻撃することは違法です。開発者は一切の責任を負わず、このプログラムによって引き起こされた誤用や損害について責任を負いません。 概要 SQLMC SQL Injection 大規模チェッカー は、ドメインのSQLインジェクション脆弱性をスキャンするために設計されたツールです。指定された深さまで指定されたURLをクロールし、各リンクのSQLインジェクション脆弱性をチェックして結果を報告します。 機能...

jshole

jshole A simple JavaScript components vulnrability scanner, based on RetireJS. Why use JShole instead of RetireJS? By default, RetireJS only searches one page, but JShole tries to crawl all pages. Get Started Requirements requests Install git clone https://github.com/callforpapers-source/jshole.g...

bug-bounty-findings-o-research-disclosures.

バグバウンティ発見・研究開示. バグバウンティ: CVE-2023-50839 IDORがサードパーティのサポートコンポーネントで 'gau' と 'Nuclei' により特定されました。境界リダイレクトにもかかわらず、古いソフトウェアが露出したままでした。手動のヘッダー分析により確認。深刻度: 5.3 Medium。多層防御の失敗とPII保護に焦点。ステータス: Intigritiに報告済み。...

jackson

Jackson core 2.13.5 安全漏洞分析与修复 CVE-2025-52999 SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 GHSA-2m67-wjpj-xhg9 SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538 Sonatype-2022-6438 此分支（2.13.5-CVE-2025-52999-sonatype-2022-6438-GHSA-2m67-wjpj-xhg9）包含针对 jackson-core...

pmg

Package Manager Guard PMG Block malicious npm and pip packages before they install. Defense in depth for the package managers you already use...

CVE-2025-14174-analysis

CVE-2025-14174 分析：ANGLE Metal 暂存缓冲区越界写入 CVE-2025-14174 的技术分析与概念验证 | ---|--- CVE| CVE-2025-14174 严重性| 高 在野利用| 是 - 针对 iOS 26 的有目标攻击 受影响范围| iOS Safari、macOS Chrome/Chromium/Electron（不包括 macOS Safari） 状态| 已在 ANGLE 提交 95a32cb 中修复 致谢| Apple、Google 威胁分析小组 在野利用 据 Apple 称，CVE-2025-14174 在早于 iOS 26 的 iOS...

h2buster

h2buster v0.4d A fast, threaded, recursive, web directory brute-force scanner over HTTP/2 using hyper, inspired by Gobuster. Features Fast and portable - install hyper and run. Multiconnection scanning. Multithreaded connections. Scalable: scans can be as docile or aggressive as you configure the...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...