Asymmetric Resource Consumption (Amplification)

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification in the parseBody function, which expands dot-separated form field names into nested objects without limiting nesting depth or total object...

Directory Traversal

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Directory Traversal in the toSSG static site generation function, whose path normalization does not fully collapse runs of consecutive .. segments and treats output directories that diffe...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the compile and merge functions in lib/messages.js, where a language key named proto or constructor in a user-supplied messages object causes writes to flow onto Object.prototype rather than the intended target...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the rename method. An attacker can manipulate the prototype of the validated object by supplying specially crafted input keys that are interpreted as proto, leading to unintended property inheritance or behavior i...

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

In this article 1. Attack chain overview 2. Campaign scope and targeting 3. Mitigation and protection guidance 4. References 5. Learn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribu...

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

In this article 1. Attack chain overview 2. Campaign scope and targeting 3. Mitigation and protection guidance 4. References 5. Learn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribu...

CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-84423

Casdoor versions up to 4.0.0 are affected by a missing authentication vulnerability in the upload-resource API , specifically in the controllers/resource.go file. The flaw allows a remote, unauthenticated attacker to perform an arbitrary file upload via the upload-resource endpoint. The exploit h...

CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

SSH-User-Enum-Python3-CVE-2018-15473

SSH-User-Enum-Python3-CVE-2018-15473 Énumérateur d'utilisateurs SSH en Python3, CVE-2018-15473. J'ai mis à jour le code de cet exploit https://www.exploit-db.com/exploits/45939 pour fonctionner avec Python3 au lieu de Python2, et j'essaie d'implémenter des fonctionnalités permettant d'énumérer...

CVE-2025-2825

CVE-2025-2825/CVE-2025-31161 مقدمة توثّق هذه الوثيقة البحث في الثغرة الأمنية CVE-2025-2825 التي تؤثر على مكوّن الخادم في CrushFTP — وهو حل تجاري لتنظيم نقل الملفات وتخزينها FTP، SFTP، HTTP/S، وواجهات مشابهة لـ S3 وغيرها. يُصنَّف هذا الخلل كـ تجاوز للمصادقة authentication bypass ، مما يسمح لمهاجم ...

FBI Probes Service Selling 153M+ Drivers Licenses

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphonin...

CVE-2022-35914

CVE-2022-35914 PoC المراجع https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr https://github.com/cosad3s/CVE-2022-35914-poc شكر لـ Sébastien Copin على PoC الذي قمت بتكييفه هنا اطلع على مقالتي الكاملة هنا: https://link.medium.com/tBwDlpQl3Ib الاستخدام root@kitploit: pip...

CVE-2026-22003-Redis-Lua-Sandbox-Escape-via-debug.sethook-

CVE-2026-22003 – تجاوز صندوق الرمل Lua في Redis عبر debug.sethook كود البرنامج مشغل Lua + Python root@kitploit: -- redissandbox.lua - Script that attempts sandbox escape local function escape debug.sethookfunction -- This hook runs in a privileged context os.execute"id /tmp/redisescape" end, "r"...

expat_2_1_0_CVE-2024-28757

Expat، الإصدار 2.1.0 هذا هو Expat، وهي مكتبة بلغة C لتحليل XML، كتبها جيمس كلارك. Expat هو محلل XML موجه للتيار stream-oriented. هذا يعني أنك تسجل معالجات handlers مع المحلل قبل بدء التحليل. يتم استدعاء هذه المعالجات عندما يكتشف المحلل البنى المرتبطة في المستند الذي يتم تحليله. تعتبر علامة البداي...

CVE-2026-84289

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function listtools of the file tools/mcptool.py of the component MCP Tool. Performing a manipulation results in uncontrolled memory allocation. It is possible to initiate the attack remotely. The...

CVE-2026-84288

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acpadapter/session.py of the component ACP Prompt Workflow. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has...

CVE-2025-55182-POC-SCANNER

CVE-2025-55182: ثغرة تنفيذ أوامر عن بُعد حرجة قبل المصادقة في مكونات خادم React بحث أمني بواسطةschema.cx "السيطرة وهم. الأنظمة التي نبنيها هي التي تسيطر علينا—ما لم نفهمها أولاً." 📋 جدول المحتويات إخلاء المسؤولية والإشعار القانوني الملخص التنفيذي الوصف الفني الأنظمة المتأثرة إثبات المفهوم تقييم...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0)

Summary Vulnerabilities exists in IBM Cloud Pak for Data System CPDS 1.0 addressed in 11.3.1.2-IF1 Vulnerability Details CVEID:CVE-2025-38527 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifsoplockbreak A race condition can...