openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by flooding a connection with connection identifier update requests while withholding acknowledgments. This behavior bypasses connection limits and forces the system to accumulate pending retirement frames, resulting...

gdid-reversal

Full writeup of the Windows GDID Global Device Identifier fully reverse engineered -8a2be2 -0078d6 How Microsoft's "Global Device Identifier", the persistent Windows fingerprint named in the July 2026 Scattered Spider complaint, is actually generated, stored, and transmitted. TL;DR !NOTE Listed...

CVE-2026-121472

The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a...

CVE-2026-104718

The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone...

hash-identifier

hash-identifier Software to identify the different types of hashes used to encrypt data and especially passwords. Encryption formats supported: ADLER-32 CRC-32 CRC-32B CRC-16 CRC-16-CCITT DESUnix FCS-16 GHash-32-3 GHash-32-5 GOST R 34.11-94 Haval-160 Haval-192 110080 ,Haval-224 114080 ,Haval-256...

JS Help Desk <= 2.8.1 - SQL Injection

The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to SQL Injection via the 'email' and 'trackingid' parameters in all versions up to 2.8.2 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

cvelistV5

Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...

Intensio-Obfuscator

Intensio-Obfuscator Project not maintained anymore Thanks to all contributors What is this ? Intensio-Obfsucator tool takes a python source code and transform it into an obfuscated python code Replace all names of variables/classes/functions/files-name to random strings with length defined then a...

tinfoleak

tinfoleak The most complete open-source tool for Twitter intelligence analysis Introduction tinfoleak is an open-source tool within the OSINT Open Source Intelligence and SOCMINT Social Media Intelligence disciplines, that automates the extraction of information on Twitter and facilitates...

CVE-2026-126061

Winter CMS (versions 1.2.13 until 1.2.14) is vulnerable to an authorization bypass in the Backend\Controllers\MyAccount controller. The controller inherits create, update, and preview actions from FormController while declaring an empty $requiredPermissions array. Because formFindModelObject() us...

CVE-2026-97890

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...

EUVD-2026-121257

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...

Security update for python-soupsieve

This update for python-soupsieve fixes the following issues: CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex REWSEND can lead to DoS bsc1281119. CVE-2026-86000: quadratic complexity when running the IDENTIFIER / VALUE selector sub-patterns can lead to a DoS...

config-demo

CVE-2020-5410...

Issabel Authenticated - Remote Code Execution

A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asteriskcli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated...

PT-2026-141793

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...

CVE-2026-124077 Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)

The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could...

CVE-2026-124077 Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)

The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could...

CVE-2026-101031 Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier

The exampledagdecorator example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's ipaddress module and then placed it into a shell command. ipaddress accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded loadexamples...

CVE-2026-101031 Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier

The exampledagdecorator example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's ipaddress module and then placed it into a shell command. ipaddress accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded loadexamples...