gitbleed_tools

GitBleed Tools - for extracting data from mirrorred git repositories About This repo contains shell scripts that can be used to download and analyze differences between cloned and mirror Git repositories. For more information about the underlying quirk in Git behavior, please visit read our blog...

CVE-2026-126938

Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the serv...

EUVD-2026-125228

NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understat...

CVE-2026-126293 NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL

NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understat...

CVE-2026-126293

NocoDB versions prior to 2026.06.2 are vulnerable to an attachment size limit bypass via the v3 upload-by-URL endpoint. The root cause is located in data-attachment-v3.service.ts , which improperly trusts the remote server's advertised content length. This allows authenticated Editor users to upl...

CVE-2026-126938

Zipline versions before 4.6.4 are susceptible to a resource allocation vulnerability (CWE-770) that allows authenticated users to bypass chunked-upload size and quota limits. By forging Content-Range headers with large declared offsets while sending small data chunks to the partial upload endpoin...

EUVD-2026-125127

Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the serv...

CVE-2026-126938 Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers

Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the serv...

CVE-2026-126938 Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers

Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the serv...

PT-2026-146624

NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understat...

CVE-2026-112899

Pillow is a Python imaging library. In versions 2.3.0 through 12.3.0, EPS rendering does not validate the scaled image dimensions before invoking Ghostscript. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive...

CVE-2026-110932

A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many...

EUVD-2026-117567

A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many...

PT-2026-137541

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An issue exists in the theme resource endpoint where the server does not validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can send numero...

Allocation of Resources Without Limits or Throttling

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

CLEANSTART-2024-TE23978 vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API

Security vulnerability affects the cri-o package. A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API...

CVE-2026-116132

A flaw was found in HTTP::Body. A remote attacker could cause a Denial of Service DoS by sending repeated incomplete multipart upload requests. The multipart parser creates a temporary file when a file part begins but fails to track or clean it up if the upload terminates prematurely, allowing an...

CVE-2026-116132 HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk

HTTP::Body versions before 1.2301 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by...

CVE-2026-86018

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment...

Part-DB resource management error vulnerability

Versions prior to Part-DB 2.13.2 contain a resource management error vulnerability. This vulnerability arises because the server’s “Download External Files” attachment feature fails to enforce the MAXATTACHMENTFILESIZE limit. Authentication users can thus bypass this limit, potentially leading to...