438 matches found
tachyon
Tachyon Tachyon is a fast web application security reconnaissance tool. It is specifically meant to crawl a web application and look for left over or non-indexed files with the addition of reporting pages or scripts leaking internal data. User Requirements Linux Python 3.6+ User Installation...
http2-bomb-analysis-paper
HTTP/2 Bomb: HPACK Indexed-Reference Amplification Chain Attack A high school student's independent technical deep-dive June 2026 TL;DR This repository contains my complete analysis of the HTTP/2 Bomb vulnerability CVE-2026-49975 / CVE-2026-47774, which chains two decades-old HTTP/2 primitives:...
cve-2026-49975-http2bomb_reproduction
CVE-2026-49975 HTTP/2 Bomb Complete Reproduction Guide Based on QiAnXin CERT Advisory + Calif Original Research ================================================================ I. Vulnerability Overview CVE-2026-49975 is a critical denial-of-service DoS vulnerability in HTTP/2 server and proxy...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: ext4: checks dot and dotdot of dxroot before making dir indexed Syzbot reports the following issue: ============================================ BUG: Unable to handle page fault for address: ffffed11022e24fe PGD 23ffee067 P4D...
CLEANSTART-2024-WR63276 Use after free in Indexed DB API in Google Chrome prior to 93
Security vulnerability affects the chromium package. Use after free in Indexed DB API in Google Chrome prior to 93...
CLEANSTART-2024-NW17899 Use after free in Indexed DB in Google Chrome prior to 102
Security vulnerability affects the chromium package. Use after free in Indexed DB in Google Chrome prior to 102...
AlmaLinux 9.2 [TuxCare] Security Update: ghostscript / ghostscript-doc / ghostscript-gtk / etc (ALMALINUX9.2:CLSA-2026:1784126222)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784126222 advisory. - An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed...
SUSE CVE-2026-93749
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...
Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal
A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. "Indexed-btree is a malicious npm package...
Malicious Package
Overview chai-as-indexed is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in chai-as-indexed (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd158a05893a55a82bee4867772aefbfb3199a443c38e7161db1a71d47ced86 chai-as-indexed presents itself as a pino-compatible logger package.json keywords fast/logger/stream/json, exports module.exports.pino, lib/ filename...
MAL-2026-16293 Malicious code in chai-as-indexed (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd158a05893a55a82bee4867772aefbfb3199a443c38e7161db1a71d47ced86 chai-as-indexed presents itself as a pino-compatible logger package.json keywords fast/logger/stream/json, exports module.exports.pino, lib/ filename...
GHSA-68FV-2MGG-JV7Q source-map-js allows event-loop denial of service through indexed source-map section offsets
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...
source-map-js allows event-loop denial of service through indexed source-map section offsets
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...
CVE-2026-93749
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...
UBUNTU-CVE-2026-93749
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...
CVE-2026-93749 source-map-js through 1.2.1 Event Loop Denial of Service
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...
CVE-2026-93749
source-map-js (through 1.2.1 ) fails to validate the per-section offset line value in indexed source maps, allowing a remote, unauthenticated attacker to supply an extremely large offset line value. This triggers synchronous event loop blocking for extended periods, preventing the service from ha...
CVE-2026-93749
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...
CVE-2026-93749 source-map-js through 1.2.1 Event Loop Denial of Service
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...