1745786 matches found
EUVD-2026-90088
NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause a format string issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure...
CVE-2026-55174 UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding
UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r"...
CVE-2026-55174 UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding
UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r"...
CVE-2026-55174
The UltrafastSecp256k1 high-performance secp256k1 engine is vulnerable to forged adaptor pre-signatures in versions prior to 4.2.0 . The root cause is a missing DLEQ binding , which allows the ECDSA adaptor verification to accept pre-signatures where the "r" value is not cryptographically bound t...
CVE-2026-55174 UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding
UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r"...
EUVD-2026-90188
UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r"...
opa
Open Policy Agent Open Policy Agent OPA es un motor de políticas de propósito general, de código abierto, que permite la aplicación unificada de políticas conscientes del contexto en toda la pila tecnológica. OPA se enorgullece de ser un proyecto graduado en el panorama de la Cloud Native Computi...
Security Bulletin: Vulnerabilities exists in IBM Netezza Software
Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.4. Vulnerability Details CVEID:CVE-2026-42766 DESCRIPTION: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summar...
subdomain3
Subdomain3 README.md inChinese 中文 Description Subdomain3 is a new generation of tool , It helps penetration testers to discover more information in a shorter time than other tools.The information includes subdomains, IP, CDN, and so on. Please enjoy it. Screenshot medium pattern for speed Feature...
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...
GHSA-FF3F-86QR-9CV3 Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...
GHSA-GFHX-HW2G-V5HG Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Impact serialize-javascript escapes its output so it is safe to embed inside a element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped into the output, terminating the script element early so the remainder is parsed as HTML...
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Impact serialize-javascript escapes its output so it is safe to embed inside a element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped into the output, terminating the script element early so the remainder is parsed as HTML...
lightweight_static_analysis
Análisis estático ligero Este repositorio contiene el código del PoC de una charla de ShellCon 2019, «Crea el tuyo propio: Cómo escribir herramientas de análisis estático personalizadas y ligeras» diapositivas. En pocas palabras, este repositorio demuestra algunos ejemplos concretos de cómo puede...
jackson-databind quadratic forward-reference completion
Summary When an @JsonIdentityInfo collection or map first creates N unresolved object-ID references and later resolves the same IDs in reverse order, jackson-databind scans the remaining pending-reference accumulator for each resolution. A shallow JSON document whose size grows linearly can...
GHSA-CXP5-3PX4-PW24 jackson-databind quadratic forward-reference completion
Summary When an @JsonIdentityInfo collection or map first creates N unresolved object-ID references and later resolves the same IDs in reverse order, jackson-databind scans the remaining pending-reference accumulator for each resolution. A shallow JSON document whose size grows linearly can...
GHSA-3Q6V-R5MR-HXV8 league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Summary league/commonmark's GitHub Flavored Markdown Table extension registers TableStartParser as a block-start parser. While a paragraph is the active block, the core block parser calls TableStartParser::tryStart on every non-blank line. Its first action fetches the entire growing paragraph...
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Summary league/commonmark's GitHub Flavored Markdown Table extension registers TableStartParser as a block-start parser. While a paragraph is the active block, the core block parser calls TableStartParser::tryStart on every non-blank line. Its first action fetches the entire growing paragraph...
Axios: Header Injection via Inherited headers After Minimal Interceptor
Summary Axios request interceptors may return a replacement config object. If an interceptor returns a plain object without an own headers property, dispatchRequest later evaluates config.headers and can resolve an inherited Object.prototype.headers value. In a process where another vulnerability...
Trawler
Dragado de Windows para Persistencia ¿Qué es? Trawler es un script de PowerShell diseñado para ayudar a los respondedores de incidentes a descubrir posibles indicadores de compromiso en hosts Windows, centrado principalmente en mecanismos de persistencia que incluyen tareas programadas, servicios...