GitLabSniper

GitLabSniper CVE-2026-85706 — неаутентифицированное чтение произвольных файлов в GitLab CE/EE обнаружение · перечисление публичных проектов · сбор данных · интерактивная оболочка · конвейер subfinder/httpx Автор: Yunus Emre Öztaş mitsec X: x.com/ynsmroztas GitHub: github.com/ynsmroztas Сайт:...

CVE-2026-104861 probe-image-size: Quadratic-time Denial of Service in the SVG Parser

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

CVE-2026-104861 probe-image-size: Quadratic-time Denial of Service in the SVG Parser

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

CVE-2026-104861 probe-image-size: Quadratic-time Denial of Service in the SVG Parser

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

CVE-2026-104844

A flaw was found in postcss-selector-parser. A remote attacker could exploit this vulnerability by submitting a specially crafted CSS selector containing numerous class or ID identifiers to an application that parses untrusted input. Due to inefficient processing and repeated scanning during...

OPENSUSE-SU-2026:22014-1 Security update for wireshark

This update for wireshark fixes the following issues: Update to Wireshark 4.4.18: - CVE-2026-19694: TTX Logger file parser crash bsc1275279. - CVE-2026-19695: Gammu DCT3 trace file parser crash bsc1275280. - CVE-2026-19696: Ixia IxVeriWave and Vector Informatik BLF file parser crashes on Windows...

Melkor_ELF_Fuzzer

-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- - | -- DESCRIPTION -- | - -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- - Melkor - An ELF File Format Fuzzer Melkor, a fictional character from J. R. R. Tolkien's Middle-earth legendarium, was the first Dark Lord and master of Sauron. He's mentioned...

Security Bulletin: Vulnerability in socket.io-parser bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the socket.io-parser library, which is affected by a denial of service vulnerability. CVE-2026-69185. Vulnerability Details CVEID:CVE-2026-69185 DESCRIPTION: Socket.IO enables bidirectional and low-latency communication fo...

CVE-2026-104844

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...

CVE-2021-22205

Vuln Impact An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution. Vuln Product Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE...

CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...

CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...

CVE-2026-104844

The PostCSS Selector Parser (prior to version 7.1.6 ) is vulnerable to a Denial of Service (DoS) attack due to quadratic complexity in flat selector parsing. The root cause lies in src/parser.js, where splitWord() accepts selectors with numerous class or ID indexes because period and hash charact...

CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...

CVE-2017-15950

CVE-2017-15950 PoC exploit for vulnerability CVE-2017-15950 SyncBreeze XML Parser and/or Sync functionality Stack-Based Buffer Overflow. Usage When running the XML payload generator, the script will output a XML file xplSyncBreeze.xml containing the payload to import using SyncBreeze. python3...

CVE-2026-64638-PoC-XSS2Shell-

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026-64638 · Reflected XSS on wp-login.php · CVSS 8.9 v4.0 · Patched in WordPress 7.0.3 ⚠️ AUTHORIZED TESTING ONLY. This tool is for security research and authorized penetration testing against systems you own or have explicit written...

poc-CVE-2026-64638-

XSS2Shell — CVE-2026-64638 PoC WordPress Pre-Auth XSS → RCE exploit chain, based on research by pwn.ai published on ionsec.io. ⚠️ LEGAL WARNING : For EDUCATIONAL PURPOSES and AUTHORIZED TESTING only. Only use against systems you own or have explicit written permission to test. Lab Verification...

CVE-2026-64638-PoC-Exploit

🌀 CVE‑2026‑64638 – WordPress XSS2Shell Security Suite ⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse...

CVE-2026-64638-POC

CVE-2026-64638 — XSS2Shell Pre-Authentication Reflected XSS → Remote Code Execution in WordPress Core ⚠️ DISCLAIMER: This repository is for authorized security research and educational purposes only. Do not use against systems you do not own or have explicit written permission to test. Unauthorize...

CVE-2026-64638-WordPress-Core-XSS2Shell

CVE-2026-64638 — Nuclei Detection Template Template Nuclei for non-intrusive detection of XSS2Shell , a pre-authenticated differential parser in WordPress Core that allows injection of DOM elements into the login page, serving as the basis for an XSS → RCE chain. ⚠️ This template only detects the...