EUVD-2026-57759

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary...

GHSA-XJH9-V7X6-24JW @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...

TelemetrySource

TelemetrySource Project created to map functions repsonsible for triggering events from various telemetry sources. Main Mapping Sheet: Event Mapping Google Sheet Currently mapped sources: Sysmon Window Security Events Microsoft-Windows-Security-Auditing Threat Intelligence Events...

Purpleteam

Purpleteam work in progress Scripts i made to trigger events for SOC detections, mapped to MITRE ATT&CK techniques...

CVE-2021-42667

CVE-2021-42667 CVE-2021-42667 - SQL Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: An SQL Injection vulnerability exists in the Event management software version 2.3.0. An attacker can leverage the vulnerable "id" parameter in the...

Security Bulletin: IBM QRadar SIEM interation for Microsoft Azure Event Hub contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM integration with Microsoft Azure Event Hub Vulnerability Details CVEID:CVE-2026-66257 DESCRIPTION: A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion...

Fuck-Etw

「⚙️」Bypass ETW & Ntdll Unhooking Bypass the Event Trace WindowsETW and unhook ntdll. |\ /| | \ /\ \ /|\ /| | /| || /| \ / /| / | | | | | | || | | / / | | | | | | | | | | | || | | | | | | | | | | | | | || | | \ \ | | | | || || | | | || /| / \ | /\ | | | | |/ /|/ // Made by sorahed v1.0 i...

CVE-2026-104861

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

CVE-2026-104861 probe-image-size: Quadratic-time Denial of Service in the SVG Parser

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

EUVD-2026-91768

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

CVE-2026-104861 probe-image-size: Quadratic-time Denial of Service in the SVG Parser

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

CVE-2026-104907

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104900

MISP contains a stored cross-site scripting XSS vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked...

CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

EUVD-2026-91743

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104907

MISP is vulnerable to a cross-site scripting (XSS) flaw in the remote event preview page. The issue arises because tag identifiers are rendered within an inline JavaScript onclick attribute; while these values are HTML-escaped, they are not properly sanitized for a JavaScript string context. A ma...

CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104901 MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server

MISP contains a cross-site scripting XSS vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked remote MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without...