CVE-2026-104874

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

CVE-2026-104874 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

EUVD-2026-91800

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2020-5258 DESCRIPTION: In affected versions of dojo NPM package, the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject...

Security Bulletin: User Entity Behavior Analytics App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. User Entity Behavior Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2011-4969 DESCRIPTION:...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for September 2026.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in September 2026. Vulnerability Details CVEID:CVE-2025-71329 DESCRIPTION: image-size through 2.0.2 contains a denial of...

EDRSandblast

EDRSandBlast EDRSandBlast 是一个用 C 编写的工具，它利用一个有漏洞的已签名驱动程序来绕过 EDR 检测（通知例程回调、对象回调和 ETW TI 提供程序）以及 LSASS 保护。还实现了多种用户态脱钩技术，以规避用户态监控。 在发布时，结合了用户态（--usermode）和内核态（--kernelmode）技术，在 EDR 监视下转储了 LSASS 内存，既没有被阻止，也没有在产品（云）控制台中生成与“OS Credential Dumping”相关的事件。测试在 3 种不同的 EDR 产品上进行，并且在每种情况下都成功了。 描述 通过移除内核通知例程绕过 E...

pytm

pytm：一个基于 Python 的威胁建模框架 简介 传统的威胁建模往往在开发后期才介入，有时甚至根本不做。此外，手动创建数据流和报告可能极其耗时。pytm 的目标是将威胁建模左移，使其更加自动化并以开发者为中心。 功能 根据您对架构设计的输入和定义，pytm 可以自动生成以下内容： 数据流图 DFD 序列图 与您的系统相关的威胁 要求 Linux/MacOS Python 3.11+ Graphviz 包 Java OpenJDK 10 或 11 plantuml.jar 快速开始 tm.py 是一个示例模型。您可以通过运行它来生成它引用的报告和图表图像文件： mkdir -p tm...

java-html-sanitizer

OWASP Java HTML Sanitizer Un sanitizador de HTML rápido y fácil de configurar escrito en Java que te permite incluir HTML generado por terceros en tu aplicación web mientras te proteges contra XSS. La dependencia existente es de JSR 305. Los otros archivos JAR solo son necesarios para el conjunto...

Security Bulletin: Multiple secuirty vulnerabilities addressed with IBM Business Automation Workflow traditional and containers September 2026

Summary In addition to updating many operating system level packages, IBM Business Automation Workflow traditional and container fixes address the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-53668 DESCRIPTION: React Router is a router for React. In versions 6.30.2 through 6.30...

Payload-and-Polyglot-Lists

Payload 与 Polyglot 列表 发现一个不起作用的 payload？ 请 open an issue 附上 payload、目标上下文以及你期望的结果。欢迎提交修复或新 payload 的 Pull Request。 研究正在进行中。 该项目正在积极开发中，并将定期更新新的 payload、漏洞类别和验证改进。 免责声明： 这些 payload 仅供授权安全测试、教育和研究目的使用。作者对任何滥用或下游影响不承担任何责任。完全由使用者自行承担风险。使用本项目即表示您对自己的行为承担全部责任。 许可证： MIT - 参见 LICENSE 1,353 个经过验证的注入...

pytm

pytm：一个Python式的威胁建模框架 简介 传统的威胁建模往往姗姗来迟，有时甚至根本不会进行。此外，手动创建数据流和报告极其耗时。pytm 的目标是将威胁建模前置，使其更加自动化并以开发人员为中心。 功能特性 基于您对架构设计的输入和定义，pytm 可以自动生成以下内容： 数据流图（DFD） 序列图 与您的系统相关的威胁 依赖要求 Linux/MacOS Python 3.11+ Graphviz 软件包 Java（OpenJDK 10 或 11） plantuml.jar 快速开始 tm.py 是一个示例模型。您可以运行它以生成其引用的报告和图表图像文件： mkdir -p tm...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

CVE-2026-104907

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104845

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can...

CVE-2026-104845 Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can...

CVE-2026-104845

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can...

EUVD-2026-91744

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can...

EUVD-2026-91743

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...