CVE-2026-68911 Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911

The Nicotine+ graphical client for the Soulseek peer-to-peer network is vulnerable to a decompression bomb in versions prior to 3.3.11 . A modified remote client can send zlib-compressed peer messages that, when processed, exhaust the recipient's operating system memory. This issue has been addre...

CVE-2026-63209 Integer Overflow or Wraparound and Out-of-bounds Write in compress

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode is subsequently...

CVE-2026-63209

The compress library (prior to version 1.18.7 ) contains a signed integer overflow vulnerability in the s2.NewDict() function. An attacker can bypass repeat index validation by providing a dictionary with a uvarint-encoded repeat value exceeding MaxInt64 . When Dict.Encode() is subsequently execu...

EUVD-2026-88977

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode is subsequently...

CVE-2026-63209 Integer Overflow or Wraparound and Out-of-bounds Write in compress

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode is subsequently...

CVE-2026-63209 Integer Overflow or Wraparound and Out-of-bounds Write in compress

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode is subsequently...

EUVD-2026-88976

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

CVE-2026-86035 Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

CVE-2026-86035

Weblate versions 4.11.1 through 2026.7.1 are vulnerable to an argument-injection flaw in the Mercurial backend . The root cause is that repository filenames starting with a hyphen (-) may be misinterpreted as Mercurial options rather than literal paths. An authenticated user with component.edit p...

CVE-2026-86035 Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

EUVD-2026-88975

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version...

CVE-2026-49243 Webmin: Reflected XSS in the Configuration module

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version...

CVE-2026-49243 Webmin: Reflected XSS in the Configuration module

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version...

CVE-2026-49243

Webmin, a web-based system administration tool for Unix-like servers, is vulnerable to a Reflected XSS vulnerability in the Configuration module in versions prior to 2.650 . An attacker can leverage this by tricking a user into clicking a malicious link, which could lead to the execution of attac...

CVE-2026-49243 Webmin: Reflected XSS in the Configuration module

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version...

move-vulnerability-database

¡Bienvenido a la Base de Datos de Vulnerabilidades de Move MVD v3.0! Una colección exhaustiva de patrones de vulnerabilidades en el ecosistema Move. Qué Incluye Patrones de Vulnerabilidad - Problemas de seguridad categorizados con ejemplos y niveles de severidad Apéndice - Informes de auditoría y...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 A fast tool to fetch URLs from HTML attributes by crawl-in. Inspired by the @omespino Tweet, which is possible to extract src, href, url and action values by evaluating JavaScript through Chrome DevTools Protocol. Resources...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 Una herramienta rápida para obtener URLs de atributos HTML mediante rastreo. Inspirada en el tweet de @omespino, que permite extraer valores src, href, url y action evaluando JavaScript a través del Protocolo Chrome DevTools. Recursos...

arp-scan

arp-scan Acerca de arp-scan es una herramienta de escaneo de red que utiliza el protocolo ARP para descubrir y realizar el fingerprinting de hosts IPv4 en la red local. Está disponible para Linux, BSD, macOS y Solaris bajo la licencia GPLv3. Este es README.md para la versión 1.10.1-git de arp-sca...