CVE-2026-97626 Gitea profile feed disclosure bypassing user visibility

Requesting a user or organization profile page GET /username with an Accept: application/rss+xml or Accept: application/atom+xml header returned the owner's activity feed without the visibility check that the profile page and the .rss and .atom routes apply. Anonymous users, restricted users and...

CVE-2026-106452

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data,...

CVE-2026-106453

The yawkat LZ4 Java library is vulnerable to a memory exhaustion issue in versions prior to 1.11.2 . The LZ4DecompressorWithLength component incorrectly trusts a four-byte decompressed-length header from the input without prior validation. An attacker can provide a small (e.g., five-byte) input t...

CVE-2026-106453 yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size...

CVE-2026-106452 yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data,...

CVE-2022-22963-PoC

CVE-2022-22963 RCE PoC مثال بسيط لإعادة إنتاج تنفيذ التعليمات البرمجية عن بُعد RCE في CVE-2022-22963 عبر org.springframework.cloud:spring-cloud-function-core. الاستغلال تشغيل الخادم mvn spring-boot:run إرسال طلب curl -X POST -H 'spring.cloud.function.routing-expression:...

CVE-2026-106512

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-106512 MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

EUVD-2026-93657

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

CVE-2026-106512 MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

CVE-2026-106512 MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Eclipse Jetty

Summary IBM SPSS Modeler is affected by vulnerabilities in Eclipse Jetty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-6790 DESCRIPTION: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host a...

CVE-2026-49975

CVE-2026-49975 HTTP/2 बम ★ CVE-2026-49975 HTTP/2 बम PoC ★ अवलोकन CVE-2026-49975 Apache HTTP Server में एक सेवा अस्वीकार DoS कमजोरी है। यह कमजोरी HTTP/2 अनुरोध प्रबंधन पथ में होती है, जहाँ एकाधिक cookie हेडर फ़ील्ड को LimitRequestFields के विरुद्ध उचित रूप से गिने बिना विलय किया जा सकता है। एक छोट...

CVE-2025-2995

CVE-2025-29927 प्राधिकरण बाइपास पुनरुत्पादन यह रिपॉजिटरी next पैकेज में CVE-2025-29927 भेद्यता का पुनरुत्पादन है। पुनरुत्पादन कैसे करें 1. नीचे दिए गए चरणों का पालन करके Next.js एप्लिकेशन को क्लोन करें और चलाएं 2. परीक्षण करें कि प्राधिकरण /api/hello एंडपॉइंट तक पहुंच से इनकार करता है $ curl...

Security Bulletin:Sensitive Data Exposure in Erlang OTP inets (httpc_response module)

Summary Sensitive Data Exposure vulnerability in Erlang OTP inets httpcresponse module allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary...

CVE-2026-84429

A flaw was found in Django. Inefficient processing occurs when the HTTP header parsing function handles quoted parameter values containing numerous separator characters. A remote, unauthenticated attacker could exploit this flaw by sending requests with crafted header parameters, causing excessiv...

CVE-2021-23017

CVE-2021-23017 ماسح الإثبات لمفهوم فحص ثغرة تجاوز سعة المخزن المؤقت لـ NGINX DNS - CVE-2021-23017 PoC يتحقق هذا النص البرمجي بلغة Python مما إذا كان خادم nginx يحتمل أن يكون عرضة للثغرة الأمنية الحرجة CVE-2021-23017 ، التي تؤثر على محلل DNS المدمج في nginx ويمكن أن تؤدي إلى تجاوز سعة المخزن المؤق...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...