Security Bulletin: Vulnerabilities in xorg-x11-server, mod_http2, httpd, openssl, openssl-fips-provider, glibc, libxml2, kernel, sssd, krb5, expat, rsyslog, apr-util libraries affect Power HMC.

Summary The xorg-x11-server, modhttp2,httpd, openssl, openssl-fips-provider, glibc, libxml2, kernel, sssd, krb5, expat, rsyslog, apr-util libraries are used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. The applicable CVEs are as follows: CVE-2026-33999,...

CVE-2024-32030-Nuclei-Template

CVE-2024-32030 Nuclei Template Description This repository contains a Nuclei template for detecting the CVE-2024-32030 vulnerability. This vulnerability allows for remote code execution via JMX Metrics Collection JNDI Resolution. Vulnerability Details ID: CVE-2024-32030 Name: JMX Metrics Collecti...

dscanner

dScanner 🔍 Automated web reconnaissance tool for security audits Description dScanner consolidates multiple reconnaissance tools into a single command for the initial phase of web pentesting. Only use with authorized systems!!!! 🚀 Installation Required dependencies: curl dnsutils nmap whois httpx...

cve-2024-32019-PoC

CVE-2024-32019 — Netdata ndsudo Local Privilege Escalation Summary Netdata’s ndsudo helper installed setuid root restricts which commands it will run, but resolves those commands using the caller’sPATH. In impacted versions, a local user can place a malicious binary earlier in PATH and have ndsud...

BIT-NODE-MIN-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

BIT-NODE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

Amadey-Loader-Multi-Stage-Malware-with-Keylogging-Clipboard-Hijack-Privilege-Escalation-Analysis

1. x64dbg – API Resolution & Resolved Keylogger Strings The Amadey Loader sample was loaded into x64dbg. At the entry point, the loader performs dynamic API resolution through jmp thunks pointing to GetProcAddressForCaller and VirtualAlloc. The dump view below reveals decrypted strings and API...

susvibes-jupyter-server-cve-2026-35397

SusVibes Benchmark Task: Jupyter Server Contents Path Resolution This repository contains one complete SusVibes-style benchmark task built from a real upstream Python security fix in Jupyter Server. The task is designed to evaluate whether an agent can reimplement masked contents path-resolution...

CVE-2026-87902-PoC-pwnVader

CVE-2026-87902 — Unauthenticated local file inclusion in WordPress core page-template resolution → RCE Author: pwnVader · License: MIT repository root | ---|--- Component| WordPress core wp-includes/template.php Type| CWE-98 — PHP file inclusion LFI → RCE Affected| WordPress 7.1.2 7.0 branch fixe...

Massive-Subdomain-Enumerator

Massive-Subdomain-Enumerator This tool uses a combination of dictionary-based wordlists brute-force and DNS resolution checks to verify the existence of subdomains. Features Wordlist Processing: Capable of handling large wordlists efficiently. Multi-threading: Boosts search speed by using multipl...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-115713: Elastic Elastic Cloud Enterprise: Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to…

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack CAPEC-132...

CVE-2020-8277

CVE-2020-8277 For educational purposes only. Quick Run clone this repository $ git clone https://github.com/masahiro331/CVE-2020-8277 run bind $ docker build -t bind-local ./bind Need TCP fallback $ docker run --rm --name bind -it -p 53:53 -p 53:53/udp bind use " v15.2.1" version If you use fixed...

Reverse_ip_Multithreading1

ReverseipMultithreading1 Donation : BTC : 31mtLHqhaXXyCMnT2EU73U8fwYwigiEEU1 Perfect Money : U22270614...

CVE-2026-118655

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...

EUVD-2026-112461

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...

CVE-2026-97045

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...

SSRF-CVE-2020-15002

Summary The URL validation logic applied when handling /appsuite/api/oxodocumentfilter&action=addfile suffers from three defects which can be used to execute Time of Check Time of Use ToCToU SSRF attack. This issue allows malicious actors to execute HTTP GET requests on internal network services...

EUVD-2026-111400

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...

Linux Distros Unpatched Vulnerability : CVE-2026-97045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that...