Astra Linux - Vulnerability in libfastjson

json-c through version 0.14 is vulnerable to an integer overflow and an out-of-bounds write when processing a large JSON file, as demonstrated by printbufmemappend...

Astra Linux – Vulnerability in python-jwcrypto

JWCrypto implements the JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker could cause a denial-of-service attack by passing in a malicious JWE Token with a high compression ratio. When the server processed this token, it would consume a lot of memory...

weblogicScanner

源工具链接：https://github.com/rabbitmask/WeblogicScan weblogicScaner 简体中文 | English 截至 2020 年 11 月 27 日，weblogic 漏洞扫描工具。若存在未记录且已公开 POC 的漏洞，欢迎提交 issue。 原作者已经收集得比较完整了，在这里做了部分的 bug 修复，部分脚本 POC 未生效，配置错误等问题。之前查了一下发现部分 POC 无法使用。在这个项目里面对脚本做了一些修改，提高准确率。 注意 ：部分漏洞由于稳定性原因需要多次测试才可验证 目前可检测漏洞编号有（部分非原理检测，需手动验证）：...

CVE-2026-42127

A flaw was found in Grafana. An unauthenticated attacker can exploit the public dashboard query endpoint by sending arbitrarily large JSON payloads. This vulnerability, caused by a lack of request body size limits, triggers excessive memory allocation, leading to a denial of service through memor...

nvdcve

NVD/CVE® 作为 JSON 文件 重要提示 ：本仓库现在与 CVEProject/cvelist 项目部分冗余，该项目允许使用 git 探索 CVE®/NVD 修改历史，并通过 GitHub pull requests 提交新漏洞。但本仓库仍与字典同步，以便以 JSON 格式获取每个漏洞。 关于 本仓库包含描述来自 NVD 和 CVE® 字典的漏洞的 JSON 文件。 它有两个主要目标： 方便地以 JSON 格式获取漏洞描述（schema） 使用 git 探索 CVE®/NVD 修改历史 本仓库中的 JSON 文件是通过 NVD 的 JSON feeds 和 Travis CI...

PT-2026-91182

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been...

WP2Shell-Scanner

Escáner WP2Shell Una herramienta de línea de comandos que comprueba si un sitio WordPress está expuesto a WP2Shell CVE-2026-63030 y CVE-2026-60137. Lee la versión de WordPress y la superficie de la API REST mediante peticiones de solo lectura y emite un veredicto. No explota nada. !WARNING Solo...

CVE-2026-73633

CVE-2026-73633 Apache Struts S2-072 — PoC + Entorno Principio: El relleno JSON del plugin JSON body habilitado en el servidor «JSON filling» es una funcionalidad central proporcionada por el plugin JSON de Struts 2, que puede entenderse simplemente como un mecanismo automático de conversión de...

CVE-2026-78903-SWIFT-Kick-to-the-Creds

CVE-2026-78903 — SWIFT Kick to the Creds Confusión de algoritmo JWT en SWIFT API Gateway...

crack-0.1.8-fixed

= crack 非常简单的JSON和XML解析，取自Merb和Rails。XML解析器取自Merb，JSON解析器取自Rails。我不居功，只是打包它们以便大家轻松使用。 == 关于版本发布 版本会在GitHub上打标签，并在GitHub和RubyForge上作为gem发布。每当我添加补丁或新功能时，都会推送到master分支。要从master构建，可以克隆代码，生成更新后的gemspec，构建gem并安装。 rake gemspec gem build crack.gemspec gem install 构建好的gem == 关于补丁/拉取请求 Fork项目。 添加功能或修复bug。...

cover

Cover Keep private data, internal infrastructure and secrets out of cloud coding agents without breaking your workflow. Install · Quick start · Policies · Monitoring · Pi / OMP · Security Cover is a bidirectional privacy proxy for AI coding agents. It replaces matched sensitive values locally wit...

cfgrip

cfgrip PE/ELF x86/x64 CFG 提取器。输入一个二进制文件，反汇编它，解析每个跳转和调用（GOT、跳转表、寄存器追踪），并将完整的控制流图导出为结构化 JSON。 为什么 你需要确切知道每个分支的去向——不是为了阅读，而是为了打补丁。将 JSON 输入 Zydis 或 AsmJit，定位你需要挂钩或修改的确切指令，然后写回。反作弊团队用它来映射游戏二进制文件；逆向人员用它来将代码提取到自己的分析管线中；软件分析师在不运行二进制文件的情况下追踪执行路径。 cfgrip 提供地图。怎么用取决于你。 它提取什么 对于每个 cfgrip 处理的二进制文件，它会生成： 函数列表...

gf

gf A wrapper around grep to avoid typing common patterns. What? Why? I use grep a lot. When auditing code bases, looking at the output of meg, or just generally dealing with large amounts of data. I often end up using fairly complex patterns like this one: root@kitploit: ▶ grep -HnrE...

EUVD-2026-76937

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-90668

UnrealIRCd versions 6.0.5 through 6.2.6 contain a denial-of-service vulnerability in its webserver component. The server does not limit the number of HTTP request headers, allowing a remote unauthenticated attacker to send a single HTTP request with an unlimited number of headers, causing excessi...

couchdb-exploit

🚀 CouchDB Exploit - CVE-2017-12635 & CVE-2017-12636 Apache CouchDB - Privilege Escalation & Remote Code Execution 📖 Overview This tool exploits two critical vulnerabilities in Apache CouchDB: CVE| Description| Severity ---|---|--- CVE-2017-12635| Privilege Escalation via JSON Parsing Bypass| 🔴...

web3-decoder

Web3 Decoder Web3 Decoder es una extensión de Burp Suite diseñada para analizar operaciones de blockchain e interacciones con contratos inteligentes. Procesa llamadas JSON-RPC a Ethereum y redes compatibles incluyendo Polygon, Arbitrum, BSC, y otras Claves API de exploradores de bloques La mayorí...

PT-2026-90782

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

react-ssr-vulnerability

CVE-2025-55182 - React Server Components RCE POC Este es un PoC con fines educativos y de investigación en seguridad únicamente. Esta vulnerabilidad ha sido parcheada en las últimas versiones de los paquetes afectados. Utiliza esta herramienta solo en sistemas que te pertenezcan o sobre los que...

CVE-2026-41729

CVE-2026-41729: Spring Data REST JSON Patch Map Key SpEL Injection PoC Este repositorio es el PoC mínimo de reproducción de CVE-2026-41729, publicado como aviso de seguridad oficial de Spring. Aviso oficial: https://spring.io/security/cve-2026-41729/ Título oficial: Spring Data REST SpEL Injectio...