CVE-2026-102805

A flaw exists in Nothings stb up to version 1.16 within the Image Encoding component. Specifically, the functions stbi_write_png_to_mem, stbi_write_jpg_core, and stbi_write_tga_core in the stb_image_write.h library are susceptible to an integer overflow . This vulnerability can be triggered via r...

EUVD-2026-89536

A flaw has been found in Nothings stb up to 1.16. This affects the function stbiwritepngtomem/stbiwritejpgcore/stbiwritetgacore in the library stbimagewrite.h of the component Image Encoding. Executing a manipulation can lead to integer overflow. The attack can be executed remotely. The exploit h...

EUVD-2026-78395

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets...

Security Bulletin: Security vulnerability in IBM Datacap

Summary This vulnerability, CVE-2026-49844, is addressed in IBM Datacap version 9.1.9 Interim Fix 009. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not...

CVE-2025-1094-PoC-Postgre-SQLi

CVE-2025-1094 分析与模拟环境搭建 本详细分析于2025年3月14日进行，探讨了CVE-2025-1094（一个假设的高危PostgreSQL SQL注入漏洞），基于提供的模拟环境搭建和概念验证（PoC）执行。分析涵盖了漏洞介绍、根本原因、文件贡献、PoC步骤及缓解措施，并整合了模拟过程中的所有复杂细节。 漏洞介绍 CVE-2025-1094被描述为PostgreSQL中的一个严重SQL注入漏洞，影响17.3、16.7、15.11、14.16和13.19之前的版本，CVSS...

undici vulnerable to Denial of Service via unbounded decompression of compressed responses

Impact The interceptors.decompress interceptor decompresses HTTP response bodies according to the untrusted Content-Encoding header. The number of decompression layers is capped at 5, but the total decompressed output size is not bounded and there is no option to limit it. A malicious or faulty...

EUVD-2026-71634

undici vulnerable to Denial of Service via unbounded decompression of compressed responses...

CVE-2026-95274

Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

Intensio-Obfuscator

Intensio-Obfuscator Proyecto ya no mantenido Gracias a todos los contribuyentes ¿Qué es esto? La herramienta Intensio-Obfuscator toma un código fuente de Python y lo transforma en un código ofuscado de Python Reemplaza todos los nombres de variables/clases/funciones/nombres-de-archivos por cadena...

XORpass

XORpass is an encoder to bypass WAF filters using XOR operations. Installation & Usage git clone https://github.com/devploit/XORpass cd XORpass $ python3 xorpass.py -h Example of bypass: Using clear PHP function: Using XOR bypass of that function: $ python3 xorpass.py -e "systemls" Why does PHP...

CVE-2026-102718

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

CVE-2024-2961

CVE-2024-2961 CVE-2024–2961 Security Issue Mitigation Script Description This repository contains a Bash script to check and mitigate the buffer overflow vulnerability identified in GNU libc glibc versions 2.39 and older, known as CVE-2024-2961. This vulnerability affects PHP when the iconv...

CVE-2026-95274

Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95274

The Google Chrome browser is vulnerable to improper output encoding within the DevTools component in versions prior to 154.0.8037.57 . A remote attacker who successfully compromises the renderer process can leverage a crafted HTML page to potentially execute arbitrary code outside the sandbox . E...

CVE-2026-95274

Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

ToolsFx

ToolsFx English|中文 前言 为什么开发这个工具? 每次加解密需要找在线工具进行处理,效率低 在线工具支持的功能不全或者某些处理结果不对 如查错网AES CFB/OFB 加密错误 大部分工具不支持文件加密 第三方PC端工具功能不全,体验不好,不支持跨平台 如PYG密码工具箱 主要功能 编解码 wiki base64 urlBase64 base16/32/36/45/58/62/85/91/92/100 base58check UrlEncode Unicode js hex\x61/js octal\140 binary/octal/decimal/hex...

DoodleCloud

DoodleCloud ☁️ 将 Instagram 变成你的个人无限云存储。 DoodleCloud 是一个概念验证 PoC 工具，它利用 Instagram 的内部 API 免费存储无限文件。通过将文件转换为“视觉噪点”图像并以 DM 涂鸦形式上传，我们可以绕过文件类型限制，将 Instagram 的服务器用作后端。 🚀 工作原理 1. 漏洞原理： Instagram 允许用户在私信 DM 中发送“涂鸦”。这些涂鸦本质上是托管在 Facebook CDN 上的 PNG 图像。 2. 编码： DoodleCloud 将任意文件（MP3、APK、ZIP...

rtl_433

rtl433 rtl433 despite the name is a generic data receiver, mainly for the 433.92 MHz, 868 MHz SRD, 315 MHz, 345 MHz, and 915 MHz ISM bands. The official source code is in the https://github.com/merbanan/rtl433/ repository. See also a list of software that works with rtl433 in the wiki. For more...

CVE-2026-97689

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a...

NOW

NØW — Codificador de Shellcode Basado en Palabras Codifica shellcode como prosa en inglés de aspecto natural. Descifralo con la frase y contraseña correctas. ¿Qué es NØW? NØW Natural Output Words es una herramienta en C que convierte bytes de shellcode sin procesar en texto inglés legible por...