434177 matches found
CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...
CVE-2026-81636
ash_graphql (ash-project) versions 0.16.23 through before 1.11.0 contain an allocation-of-resources flaw that lets an unauthenticated client bypass the configured GraphQL query-complexity limit. The root cause is in AshGraphql.Graphql.Resolver.query_complexity/3, which multiplies child complexity...
EEF-CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service
Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash\graphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.query\complexity/3 multiplies child...
Exploit for CVE-2026-76581
CVE-2026-76581 - WPMU DEV Dashboard Vulnerability Detector A...
Kaspersky-CTF-2026
Kaspersky CTF 2026 Solutions, exploits, and writeups for the...
Harden-Windows-Security HardenSystemSecurity-v1.0.80.0
Harden Windows Security | A New Threat to Malware Harden Windows Safely, Securely, Only With Official Microsoft Methods !.NET Badgehttp...
z0d1ak-ctf-qualifiers-2026
z0d1ak CTF Qualifiers 2026 — Writeups Solutions, exploits, an...
Exploit for CVE-2026-48611
USE AT YOUR OWN RISK. This tool is provided strictly for...
OPENSUSE-SU-2026:21705-1 Security update for go1.26-openssl
This update for go1.26-openssl fixes the following issues: Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips. Security issues fixed: - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can...
CVE-2026-82658
Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoi...
CVE-2026-82655
Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relationtypelist parameter of listsshow.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in rolelist and inject SQL through...
CVE-2026-82657
Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/announcements.php, disclosing titles, full post...
CVE-2026-82646
WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then...
CVE-2026-82648
WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in hexadecimal form. Attackers can bypass SSRF protections by supplying hex-encoded NAT64 addresses like 64:ff9b::a9fe:a9fe to reach cloud...
CVE-2026-82643
WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...
CVE-2026-82644
WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...
OPENSUSE-SU-2026:21696-1 Security update for go1.25-openssl
This update for go1.25-openssl fixes the following issues: Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues fixed: - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures c...
EUVD-2026-68244
Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoi...
CVE-2026-82658 Admidio before 5.0.12 Broken Access Control via profile_function.php
Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoi...
CVE-2026-82658 Admidio before 5.0.12 Broken Access Control via profile_function.php
Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoi...