39221 matches found
PT-2026-5013
Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.11.7 Description The Serve static Middleware for the Cloudflare Workers adapter in Hono does not properly validate user-controlled paths, potentially allowing attackers to read arbitrary keys from the Workers...
Hono code issue vulnerabilities
Hono is a web framework built in TypeScript for the Hono community. Versions of Hono prior to 4.11.7 had code vulnerabilities. These vulnerabilities stemmed from information leaks in the caching middleware, which could potentially cache private or authenticated responses and expose them to...
PT-2026-4884
An issue from the component luaG runerror in dependencies/lua/src/ldebug.c in praydog/REFramework version before 1.5.5 leads to a heap-buffer overflow when a recursive error occurs...
Root security vulnerabilities
Root is a big data processing tool developed by ROOT OpenSource. There is a security vulnerability in Root, which stems from a flaw in the zlib component inffast.C, potentially leading to memory corruption...
Root security vulnerabilities
Root is a big data processing tool developed by ROOT OpenSource. Versions of Root 6.36.00-rc1 and earlier have security vulnerabilities. These vulnerabilities stem from a flaw in the zlib component inftrees.C, which may lead to memory corruption...
Allocation of Resources Without Limits or Throttling
Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Partial Prerendering resume endpoint when unauthenticated POST requests with the Next-Resume: 1 header are processed and attacker-controlled postpon...
Allocation of Resources Without Limits or Throttling
Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the decoding reply functions of React Flight protocol. An attacker can cause server crashes, out-of-memory exceptions, or excessive CPU usage by sending...
Introducing SITF: The First Threat Framework Dedicated to SDLC Infrastructure
Moving beyond simple checklists to visualize, map, and block attacks on production SDLC infrastructure...
CVE-2026-23864: React and Next.js Denial of Service via Memory Exhaustion
...
CVE-2026-1417 GPAC filedump.c dump_isom_rtp null pointer dereference
A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dumpisomrtp of the file applications/mp4box/filedump.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and coul...
CVE-2026-1416
A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump.c. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released...
macOS Mavericks 10.9 Local Privilege Escalation Tooling
This is not an exploit but rather a theoretical ROP chain construction framework for macOS Mavericks 10.9 that is inspired by older research...
GPAC code-related vulnerabilities
GPAC is an open-source multimedia framework developed by GPAC. Versions of GPAC prior to 2.4.0 have code vulnerabilities. These vulnerabilities stem from incorrect handling of parameters in the Name field in the src/mediatools/mediaexport.c file, which may lead to null pointer dereferencing...
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups
PeckBirdy is a sophisticated JScript-based C&C framework used by China-aligned APT groups to exploit LOLBins across multiple environments, delivering advanced backdoors to target gambling industries and Asian government entities...
PT-2026-4843
Name of the Vulnerable Software and Affected Versions MobSF versions prior to 4.4.5 Description MobSF is a mobile application security testing tool. A Stored Cross-site Scripting XSS vulnerability exists in MobSF’s Android manifest analysis. This allows an attacker to execute arbitrary JavaScript...
GPAC code-related vulnerabilities
GPAC is an open-source multimedia framework developed by GPAC. Versions of GPAC prior to 2.4.0 have code vulnerabilities, which stem from a null pointer dereferencing in the file applications/mp4box/filedump.c...
GPAC code-related vulnerabilities
GPAC is an open-source multimedia framework developed by GPAC. Versions of GPAC prior to 2.4.0 have code vulnerabilities, which stem from a null pointer dereferencing in the file applications/mp4box/filedump.c...
Security Bulletin: A vulnerability in express.js affect IBM® Db2® Big SQL on IBM Cloud Pak for Data.
Summary A vulnerability in express.js affect IBM® Db2® Big SQL 7 on IBM Cloud Pak for Data 4 and 5 Vulnerability Details CVEID:CVE-2024-43796 DESCRIPTION: Express.js minimalist web framework for node. In express 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirec...
Security Bulletin: A vulnerability in Express.js affect IBM® Db2® Big SQL on IBM Cloud Pak for Data.
Summary A vulnerability in Express.js affect IBM® Db2® Big SQL 7 on IBM Cloud Pak for Data 4 and 5 Vulnerability Details CVEID:CVE-2024-29041 DESCRIPTION: Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are...
