net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

Important: Red Hat Security Advisory: gstreamer1-plugins-base security update

An update for gstreamer1-plugins-base is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

CVE-2026-92050

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to race condition in the XPConnect component...

CVE-2026-92035

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Graphics component...

Kubestroyer

Kubestroyer Kubestroyer 旨在利用 Kubernetes 集群的配置错误，成为你 Kubernetes 渗透测试中的瑞士军刀。 浏览文档 » 报告 Bug · 请求功能 目录 1. 关于项目 构建工具 2. 开始使用 先决条件 安装 3. 使用方法 4. 路线图 5. 贡献 6. 许可证 7. 联系方式 关于项目 Kubestroyer 是一个用 Golang 编写的利用工具，旨在利用 Kubernetes 集群的配置错误。 该工具会扫描可能暴露的已知 Kubernetes 端口，并对其进行利用。 回到顶部 构建工具 回到顶部 开始使用...

collection-document

Descripción del Proyecto Colección de artículos de seguridad de calidadpor reconstruir Some are inconvenient to release. Some forget update,can see me star. collection-document awesome 以前的链接中大多不是优质的 渗透测试部分不再更新 因精力有限，缓慢更新 Author: tom0li Blog: https://tom0li.github.io root@kitploit: - Project...

inquisitor

Inquisitor Notice This project is only partially complete and I have yet to implement many of the features described in the following blog post I made: https://penafieljlm.com/2017/07/14/inquisitor/. Inquisitor is a simple tool for gathering information on companies and organizations through the...

CVE-2023-36845-POC

Script de Automatización de PoC para CVE-2023-36845 Este script proporciona una prueba de concepto PoC automatizada para la vulnerabilidad identificada como CVE-2023-36845, que afecta al componente J-Web de Juniper Networks Junos OS en dispositivos de las series EX y SRX. Demuestra el potencial...

CloudFlair

CloudFlair Nota importante: A partir de finales de 2024, Censys ya no proporciona acceso a la API para cuentas gratuitas. Esto significa que CloudFlair ya no funciona con cuentas gratuitas de Censys. CloudFlair es una herramienta para encontrar servidores de origen de sitios web protegidos por...

CVE-2026-92076

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Networking component...

CVE-2026-92079

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Widget: Win32 component...

Venom-JWT

Venom-JWT herramienta de penetración - Pruebas de penetración contra vulnerabilidades JWT y fuerza bruta de claves Declaración seria: Las técnicas, ideas y herramientas mencionadas en este documento son solo para fines de aprendizaje e intercambio con fines de seguridad, nadie puede usarlas para...