CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where...

CVE-2026-6307

CVE-2026-6307: confusion de type JS-to-Wasm de V8 → RCE sur Chrome 146 Reproduction locale et weaponization de la confusion de type de désoptimisation V8 JS-to-Wasm décrite par Nebula, aboutissant à un xcalc ouvert depuis le renderer de Chrome for Testing 146.0.7680.165 le bug est corrigé dans...

DivideAndScan

DivideEt Impera And Scan y también fusiona los resultados del escaneo Proyectos Destacados...

dymerge

Una herramienta simple pero poderosa, escrita puramente en Python, que toma listas de palabras dadas y las fusiona en un diccionario dinámico que puede usarse como munición para un ataque exitoso basado en diccionario o por fuerza bruta. Compatible con Python 2.6 y 2.7. Autor: Nikolaos Kamarinaki...

http-mcp-bridge

HTTP MCP Bridge Questo progetto implementa un server HTTP che funge da ponte tra le richieste HTTP/1.1 e un server MCP remoto, utilizzando la libreria python mcp GitHub. Lo scopo principale di questa iniziativa è poter utilizzare strumenti di sicurezza HTTP per testare server MCP remoti utilizzan...

wordreaper

Über das Projekt Dieses Tool wurde entwickelt, um intelligente und fokussierte Wortlisten zu scrapen und zu generieren für effektives Passwort-Cracking, wobei CSS-Selektoren mit chirurgischer Präzision eingesetzt werden. Funktionsübersicht HTML-Scraping Extrahiert Text mit präzisen CSS-Selektoren...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ Panoramica CVE-2026-49975 è una vulnerabilità Denial of Service DoS in Apache HTTP Server. La vulnerabilità si verifica nel percorso di gestione delle richieste HTTP/2, dove più campi header cookie possono essere uniti senza essere...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: udf: Do not bother merging very long extents. When merging very long extents, we try to assign as much length as possible to the first extent. However, this is unnecessarily complicated and not really worth the effort. Moreover,...

DEBIAN-CVE-2026-63379

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...

Linux Distros Unpatched Vulnerability : CVE-2026-63297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project...

CVE-2026-63297

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before...

CVE-2026-68354

In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnetfragnew keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment al...

CVE-2026-68354

CVE-2026-68354 affects the Linux kernel FireWire networking driver (fwnet_frag_new) and its fragmented datagram reassembly. The root cause is incorrect neighbor-edge handling when fragments are adjacent: list-edge checks incorrectly treat the head as a real neighbor and merge decisions use the ol...

CVE-2026-68354 firewire: net: Fix fragmented datagram reassembly

In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnetfragnew keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment al...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksm: The range-walk function is used to bypass holes in scangetnextrmapitem. Currently, scangetnextrmapitem walks every page address in a VMA to locate mergeable pages. This approach becomes highly inefficient when scanning large...

MGASA-2026-0327 Updated python-starlette package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Proxy-Authorization header kept across hosts. CVE-2024-28849 Starlette vulnerable to On^2 DoS via Range header merging in starlette.responses.FileResponse. CVE-2025-62727 Security restriction bypass via malformed HTTP Host header. CVE-2026-48710...

CVE-2026-14574

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys proto, constructor, prototype. Because this function is invoked by PreferenceServiceImpl.doResolve for eve...

kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item

A resource exhaustion vulnerability was found in the Kernel Same-page Merging KSM subsystem of the Linux kernel. When scanning processes with large sparse virtual memory mappings e.g., 32 TiB with one mapped page, ksmd inefficiently walks every address rather than skipping unmapped holes. This...

EUVD-2026-51592

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

CVE-2026-54737 @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...