CVE-2026-105757 vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by t...

log4shell

log4shell Script en Python para escanear el sistema de archivos del servidor en busca de archivos JAR de log4j que sean vulnerables a CVE-2021-44228 y CVE-2021-45046. El script recorre recursivamente el sistema de archivos incluyendo zip, ear, war para encontrar versiones de log4j 2. hasta 2.15 c...

CVE-2026-76564

Stored XSS via User-Agent in Admin Order View in PhocaCart PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Stores XSS Payload via Checkout. Executes in Admin Browser Context SUMMARY PhocaCart 6.1.7 for Joomla stores the raw HTTP User-Agent header from checkout requests in the orders database table...

CVE-2025-48708

CVE-2025-48708 Descripción Una vulnerabilidad en Artifex Ghostscript anterior a la versión 10.05.1 provoca que la contraseña en texto plano utilizada para proteger un archivo PDF se incruste en la salida. El problema se debe a la falta de sanitización de argumentos en gslibctxstashsanitizedarg...

Mailphish

Mailphish Codificado por Pro MCracker Mailphish te ayudará a crear correos electrónicos de phishing profesionales de forma rápida y fácil Visita nuestros sitios web para aprender métodos de hacking https://crackcodes.xyz y https://crackcodes.in Si copias el código y haces el tuyo propio, ¡no...

CVE-2026-11105-Stack-Buffer-Overflow-in-Custom-Base64-Decoder

CVE-2026-11105 – Desbordamiento de búfer en la pila en el decodificador Base64 personalizado Código del programa C // base64vuln.c - Vulnerable Base64 decoder include include include int base64decodeconst char in, sizet inlen, char out, sizet outlen static const char table =...

CVE-2018-8174_EXP

CVE-2018-8174EXP usage: CVE-2018-8174.py -h -u URL -o OUTPUT -i IP -p PORT Exploit para CVE-2018-8174 argumentos opcionales: -h, --help muestra este mensaje de ayuda y sale -u URL, --url URL url del exploit -o OUTPUT, --output OUTPUT Archivo rtf de salida del exploit -i IP, --ip IP ip para netcat...

CVE-2026-9809

CVE-2026-9809 CVE-2026-9809 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting Mautic 7 versions 7.0.0 through 7.1.1. The flaw exists in the Projects component, where project names are displayed as tags and hover popovers on administrative pages such as campaigns, emails, and for...

BIT-MOODLE-2026-102581 Moodle: xss in forum post templates due to insufficient escaping

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting XSS vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing t...

weblogicScanner

源工具链接：https://github.com/rabbitmask/WeblogicScan weblogicScaner Chino simplificado | English A fecha del 27 de noviembre de 2020, herramienta de escaneo de vulnerabilidades de weblogic. Si existen vulnerabilidades no registradas con POC público, bienvenido a enviar un issue. El autor original ya ...

Wildfire

CVE-2026-39154 · Stored XSS in CometChat group messages JS SDK 3.0.12 This directory holds an honest, self-contained reproduction of the render sink behind CVE-2026-39154: a stored cross-site scripting defect in the CometChat JavaScript SDK 3.0.12, where a group message's data.text field is...

Astra Linux – Vulnerability in libzstd

Starting from v1.4.1 and before v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and immediately restricted those permissions afterward. As a result, the output files could temporarily be readable or writable by...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: genirq/msi: The IOMMU IOVA is now stored directly in the msidesc, rather than in the iommucookie. The process of translating MSI message addresses using IOMMU involved two steps, separated in time: 1 iommudmapreparemsi: A pointer...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Remove sndBUGON from sndusbmidioutputopen The function sndusbmidioutputopen includes a check for the NULL port, which involves calling sndBUGON. The use of sndBUGON was intended to prevent such issues from...

moria

moria IoT firmware identification and extraction moria identifies files and the structures embedded inside firmware and IoT images filesystems, kernels, bootloaders, archives, keys and unpacks most of what it finds, without root. It reports each finding with a byte offset, a type, and a confidenc...

CVE-2026-37196

CVE-2026-37196 – Cross-Site Scripting XSS Almacenado en nirix traq v3.9.0 Descripción general Existe una vulnerabilidad de Cross-Site Scripting XSS Almacenado en nirix traq v3.9.0 , donde la entrada proporcionada por el usuario en el campo de descripción del ticket no se sanitiza adecuadamente...

CVE-2026-48813-POC

Flawfinder-ANSI-Exploit-POC En la versión 2.0.19 de Flawfinder, no se realiza una sanitización de nombres de archivo al analizar posibles nombres de archivo maliciosos. Los terminales afectados conocidos son los basados en libvte, y el ejemplo a continuación muestra un mate-terminal. Este exploit...

CVE-2025-0924-different

CVE-2025-0924 분석 중 나온 다른 취약점 01. Stored XSS와 WordPress,WP Activity Log 개요 1 Stored XSS와 WordPress,WP Activity Log 개요 Stored XSS는 악성 스크립트가 서버에 저장되어, 이후 다른 사용자들이 해당 페이지를 열 때 자동으로 실행되는 취약점이며 CWE-79Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'로 지정 되어있는 공격의 일종 입니다...

AlmaLinux 9 : ghostscript (ALSA-2026:74457)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:74457 advisory. ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter CVE-2026-39919 Tenable has extracted the preceding description block directly from the...

CVE-2025-52097

CVE-2025-52097 – XSS Reflejado en InstantForum.NET v4.1.4 Este repositorio contiene el aviso público, la prueba de concepto y los materiales de soporte para CVE-2025-52097 , una vulnerabilidad de cross-site scripting XSS reflejado identificada en InstantForum.NET v4.1.4. Resumen Producto:...