frida-fuzzer

Frida API Fuzzer v1.4 Copyright C 2020 Andrea Fioraldi [email protected] Released under the Apache License v2.0 This experimental fuzzer is meant to be used for API in-memory fuzzing. The design is highly inspired and based on AFL/AFL++. ATM the mutator is quite simple, just the AFL's havoc...

LibPNG_OSS-Fuzz

Fuzzing and Vulnerability Analysis of libpng Group Security Research Project About Fuzzing: Fuzzing is an automated software testing technique that provides invalid, unexpected, or random data as inputs to a program to discover bugs and vulnerabilities. Coverage-guided fuzzing uses code coverage...

Embedthis GoAhead <3.6.5 - Remote Code Execution

description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. id: CVE-2017-17562 info: name: Embedthis GoAhead 3.6.5 - Remote Code Execution author: geeknik severity: high description: | description: Embedthis GoAhead before...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: virtiofs: added a check for the filesystem context source name In certain scenarios, for example during fuzz testing, the source name may be NULL, which could lead to a kernel panic. Therefore, an additional check for the source...

GO-2026-6571 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei...

PT-2026-105590

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei...

Citrix ShareFile StorageZones Controller - Unauthenticated Remote Code Execution

A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller. id: CVE-2023-24489 info: name: Citrix ShareFile StorageZones...

CVE-2026-76805

A flaw was found in Nuclei, a vulnerability scanner. A malicious scan target can exploit a vulnerability in the Dynamic Application Security Testing DAST/fuzz mode where response content is evaluated twice and reinterpreted as template syntax. This allows the scan target to disclose sensitive...

security-kit

Security Kit — offensive security, testing & debugging for sit...

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

A vulnerability in Nuclei's DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure of scanner-host environment variables when the -env-vars / -ev option is explicitly enabled. This is an incomplete fix for CVE-2026-41645 / GHSA-jm34-66cf-qpvr. The original fix...

GHSA-JPVM-9FRM-HJCQ Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

A vulnerability in Nuclei's DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure of scanner-host environment variables when the -env-vars / -ev option is explicitly enabled. This is an incomplete fix for CVE-2026-41645 / GHSA-jm34-66cf-qpvr. The original fix...

CVE-2026-76805

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...

EUVD-2026-84557

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...

CVE-2026-76805 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...

CVE-2026-76805 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...

CVE-2026-76805

The vulnerability scanner Nuclei (versions 3.0.0 through 3.10.0 ) is vulnerable to environment variable disclosure due to an incomplete fix for CVE-2026-41645. The flaw exists in the DAST/fuzz payload evaluation path (pkg/fuzz/parts.go), where substituted runtime data can be evaluated more than o...

CVE-2026-76805 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...

OSV-2026-1314 Heap-buffer-overflow in vacm_getAccessEntry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=564017938 Crash type: Heap-buffer-overflow READ 3 Crash state: vacmgetAccessEntry snmpsecmodelsfuzzer.c...

PT-2026-96836

Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.9.9 Description In DAST and fuzz modes, the payload path in pkg/fuzz/parts.go can evaluate substituted runtime data multiple times. This occurs when a multi-step template captures response content using an...

CVE-2026-76805: Exposure of Sensitive Information to an Unauthorized Actor

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...