decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

SUSE CVE-2026-96642

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

EUVD-2026-107561

Pillow: TarIO negative size field causes infinite CPU-spin loop...

DEBIAN-CVE-2026-96642

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

Linux Distros Unpatched Vulnerability : CVE-2026-96642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek...

CVE-2026-96642

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

CVE-2026-96642

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

CVE-2026-96642

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

PT-2026-120820

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size, causing a backward seek that returns to the same 512-byte header. If the requested member name does not match, the pars...

GO-2026-6696 Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza

Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza...

cryptovenom

CryptoVenom CryptoVenom: The Cryptography Swiss Army knife What is CryptoVenom? CryptoVenom is an OpenSource tool which contains a lot of cryptosystems and cryptoanalysis methods all in one, including classical algorithms, hash algorithms, encoding algorithms, logic gates, mathematical functions,...

Astra Linux – Vulnerability in RustC

The library/std/src/net/parser.rs file in Rust before version 1.53.0 does not properly handle zero characters at the beginning of an IP address string. In some cases, this allows attackers to bypass access controls based on IP addresses due to incorrect octal interpretation of those zero characte...

CVE-2026-109380 modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks indefinitely, exhausting...

CVE-2026-104774

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/jsdecode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is...

CVE-2026-104774 OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/jsdecode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is...

CVE-2026-104774 OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/jsdecode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is...

CVE-2026-104774 OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/jsdecode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is...

CVE-2026-104774

The OWASP Coraza WAF library (versions 3.0.0 through 3.7.0 ) contains an off-by-one error in the t:jsDecode transformation within internal/transformations/js_decode.go. The flaw occurs because the code incorrectly includes the backslash character in the octal number buffer during parsing. This ca...

EUVD-2026-97825

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/jsdecode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is...

CVE-2026-104774: Encoding Error

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/jsdecode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is...