6819 matches found
ActiveScanPlusPlus
ActiveScan++ ActiveScan++ extends Burp Suite's active and passive scanning capabilities. Designed to add minimal network overhead, it identifies application behaviour that may be of interest to advanced testers: Potential host header attacks password reset poisoning, cache poisoning, DNS rebindin...
-CVE-2024-45352
🚨 CVE-2024-45352 – Xiaomi Smarthome Remote Code Execution RCE 📌 Summary A critical vulnerability CVE-2024-45352 was discovered in the Xiaomi Smarthome application, allowing unauthenticated remote code execution RCE via improper input handling in the internal API parser. This vulnerability can be...
NextJS-CVE-2025-29927
Here's a clean and informative README.md for your GitHub repo that explains it's a vulnerable Next.js application for CVE-2025-29927 and includes a link to your setup YouTube video: 🔓 NextJS-CVE-2025-29927 - Vulnerable Demo Application This is a vulnerable Next.js application that demonstrates...
Alfred
WIP - Revamped Alfred 2.0 Alfred - A Modular Recon and Exploitation Framework EXPIREMTNAL PHASE Alfred is a Python-based framework designed to assist in various reconnaissance, exploitation, and post-exploitation tasks. It is highly modular, allowing users to easily add plugins to extend...
CVE-2024-23113
CVE-2024-23113 The script is designed to detect CVE-2024-23113, which is a format string vulnerability in the FortiGate FGFM service FortiGate to FortiManager protocol running on TCP port 541. The vulnerability occurs because an attacker can control a format string, which could lead to Remote Cod...
EUVD-2026-101633
An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability...
CVE-2026-0319 PAN-OS: Improper Input Handling Vulnerability
An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability...
CVE-2026-0319
A vulnerability exists in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software due to improper input handling . This flaw allows an authenticated user to establish a GlobalProtect session while masquerading as another user . While Cloud NGFW and Panorama are not affected, no known wor...
PAN-OS: Improper Input Handling Vulnerability
An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability. Work around: No known...
Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Vulnerability
The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, 12.1.x, or 12.2.x. It is, therefore, affected by a vulnerability. An improper input handling vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS software...
CVE-2026-105315
A flaw was found in django-haystack. This flaw allows a remote attacker to achieve arbitrary code execution on the hosting server by supplying crafted data to the search index. Due to improper input handling, the Elasticsearch backend unsafely evaluates raw search result values as executable code...
thrift: thrift: Denial of Service via improper message handling in language bindings
A flaw was found in Apache Thrift. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending specially crafted requests to applications utilizing affected language bindings. Flawed input parameter processing and resource allocation can trigger...
Astra Linux – Vulnerability in libmysofa
Incorrect handling of input data in the mysofaresamplerresetmem function in the libmysofa library between versions 0.5 and 1.1 may lead to heap buffer overflow and overwriting of a large memory block...
CVE-2026-89538
A flaw was found in the Linux kernel's Server Unix Remote Procedure Call SUNRPC component. A remote attacker, with a valid Generic Security Service GSS context, could send a specially crafted Kerberos v2 wrap token with an oversized "extra count" ec field. This improper handling of malformed toke...
PYSEC-2026-3971 PyTorch Lightning denial of service vulnerability
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...
pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a call to readuntilwhitespace with an input which does not have whitespace for a long time. PatchesThis has been fixed in pypdf==6.15.0. WorkaroundsIf you cannot upgrade yet, consider applyin...
CVE-2026-87542
A flaw was found in chromium-browser. This vulnerability, a 'use after free' error in the input handling, allows a remote attacker to execute arbitrary code. By enticing a user to visit a specially crafted HTML page, an attacker could bypass security measures and run malicious code within the...
CVE-2026-78550 Improper Input Handling in Okta Access Gateway Management Console Exception Handler
The Okta Access Gateway management console passes user-supplied input to eval without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console...
CVE-2026-78550
The Okta Access Gateway management console is vulnerable to code execution due to improper neutralization of directives in dynamically evaluated code. During an authenticated administrator SSH session , the console passes user-supplied input to the eval() function without sufficient sanitization....
