Exploit for CVE-2026-64638

XSS2Shell — PoC de CVE-2026-64638 Proof of Concept educativ...

SUSE-SU-2026:3525-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. - CVE-2026-7598: integer overflow in function userauthpassword of file src/userauth.c bsc1263890. - CVE-2026-55199: pre-authenticati...

CVE-2026-53977 OpenChamber 1.11.7 Unauthenticated DoS via /api/system/shutdown

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler...

PT-2026-68882

Name of the Vulnerable Software and Affected Versions WordPress affected versions not specified Description WordPress is subject to a pre-authentication reflected cross-site scripting XSS issue on the login screen. This allows an attacker to execute arbitrary JavaScript in the site origin without...

CVE-2026-14587

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for mo...

Allocation of Resources Without Limits or Throttling

Overview org.apache.qpid:proton-j is a lightweight messaging library. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching of symbol values. An attacker can exhaust system resources by sending specially crafted data prior t...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through improper handling of type size and count during the pre-authentication phase. An attacker can exhaust system resources by sending specially crafted requests that trigger excessive memo...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded symbol value caching in the AMQP 1.0 Symbol codec. An attacker can exhaust broker resources by sending pre-authentication AMQP 1.0 traffic that forces the codec to creat...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching in the symbol process. An attacker can exhaust system resources by sending specially crafted requests prior to authentication. Remediation Upgrade...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via improper handling of type size and count during the pre-authentication process. An attacker can trigger excessive memory allocation by sending specially crafted input, potentially leading ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching in the symbol process. An attacker can exhaust system resources and cause a denial of service by sending specially crafted requests prior to authentication...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unchecked AMQP 1.0 list and map size/count handling in the ListConstructor and MapConstructor codec classes. An attacker can trigger excessive allocation and parser work by...

Uncontrolled Recursion

Overview org.apache.qpid:proton-j is a lightweight messaging library. Affected versions of this package are vulnerable to Uncontrolled Recursion through unbounded nesting in the type processing. An attacker can cause a stack overflow and disrupt service availability by sending specially crafted...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through unbounded nesting of types in the process. An attacker can cause a stack overflow and disrupt service availability by sending specially crafted data prior to authentication. Remediation Upgrade...

CVE-2026-67552

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...

CVE-2026-68073

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue...

CVE-2026-67590

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-66274

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...

CVE-2026-67590

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-68060

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue...