CVE-2026-114143

The toml-node TOML parser for Node.js and the browser is vulnerable to a Quadratic-complexity Denial of Service (DoS) in versions prior to 5.0.1 . The root cause is located in lib/compiler.js , where the toml.parse() function repeatedly slices and rejoins path prefixes when processing long dotted...

CVE-2026-114143 toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign, deepRef, and setNestedKey. The resultin...

CVE-2026-114143 toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign, deepRef, and setNestedKey. The resultin...

Important: Red Hat Security Advisory: php:8.2 security update

An update for the php:8.2 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-114142

The toml-node TOML parser for Node.js and the browser is vulnerable to a Prototype Pollution vulnerability in versions prior to 5.0.1 . The root cause lies in lib/compiler.js, where quoteDottedString() produces identical bookkeeping strings for distinct quoted key paths. This allows addTableArray...

CVE-2026-114142 toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse can write attacker-controlled properties to Object.prototype because quoteDottedString in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray to clear another...

CVE-2026-114142 toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse can write attacker-controlled properties to Object.prototype because quoteDottedString in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray to clear another...

CVE-2026-114142

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse can write attacker-controlled properties to Object.prototype because quoteDottedString in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray to clear another...

HyperOS-Directory-Traversal-Analysis

🔬 CVE-2025-21082: HyperOS AVCodec Use-After-Free Comprehensive Analysis of the Use-After-Free Vulnerability in Xiaomi HyperOS AVCodec Media Framework and Simulation with Rust University Final Project — Cybersecurity Research Project 🌐 Experience the Live Simulation in Browser 📖 About the Project...

php2shell-safe-poc

php2shell-safe-poc Detection-only verification toolkit for...

CVE-2026-114141 toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse compiler's addTableArray function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct name paths are not pruned, so a document...

CVE-2026-114141

The toml-node TOML parser for Node.js and the browser is vulnerable to a Denial of Service (DoS) attack due to inefficient algorithmic complexity. In versions prior to 5.0.1 , the addTableArray() function in lib/compiler.js fails to prune distinct [[name]] paths, causing it to rescan complete boo...

CVE-2026-114141 toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse compiler's addTableArray function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct name paths are not pruned, so a document...

CVE-2026-114141

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse compiler's addTableArray function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct name paths are not pruned, so a document...

CVE-2026-18963

Keycloak Reset Path Finder Nuclei template to discover exposed Keycloak reset-credentials endpoints across multiple proxy prefixes, context paths, realm names, and path variations. Summary This template helps identify reachable password reset flows that may be relevant during validation of...

Exploit for CVE-2026-97629

CVE-2026-97629 — nginx TLS session-ticket forgery client-cert...

browser-security-project

OWASP Browser Security Project The OWASP Browser Security Project raises awareness, provides education, and establishes best practices for securing modern web browsers. Browsers now serve as the primary execution environment for most applications, and this project offers clear, actionable guidanc...

CVE-2026-41940---cPanel-WHM-check

IOC Check Sessions Files Overview iocchecksessionsfiles.sh is a cPanel-provided detection script referenced in the official cPanel security advisory: Security: CVE-2026-41940 - cPanel & WHM / WP2 Security Update 04/28/2026 The script is used to scan cPanel/WHM session files for suspicious...

CVE-2026-114140 nbconvert: File write via path traversal in cell output filenames

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...

CVE-2026-114140

The nbconvert tool (jupyter nbconvert) versions 5.4.0 through 7.17.2 contains a path traversal vulnerability in the ExtractOutputPreprocessor component located at nbconvert/preprocessors/extractoutput.py. The flaw exists because the tool joins attacker-controlled cell output metadata filenames wi...