CVE-2021-31805

CVE-2021-31805 PoC для CVE-2021-31805 Apache Struts2 Это приложение, использованное в пояснительной статье о CVE-2021-31805. Настройка $ docker-compose build $ docker-compose up -d Проверка работы Откройте http://localhost:8080/struts2-showcase-2.5.29/index.html и убедитесь, что отображается...

OpenCVE: Server-Side Request Forgery (SSRF) in notifications

ImpactOpenCVE contains a Server-Side Request Forgery SSRF vulnerability in the notification testing functionality for both Webhook and Slack integrations.An authenticated user with permission to configure notification channels can trigger test requests to arbitrary HTTPS endpoints. Insufficient...

CVE-2021-26855-PoC

PoC CVE-2021-26855 Code d'exploitation PoC pour CVE-2021-26855. Le code original a été développé par https://github.com/GreyOrder. Exercices simples d'utilisation de golang pour le SSRF CVE-2021-26855 Version affectée Exchange Server 2013 inférieur à CU23 Exchange Server 2016 inférieur à CU18...

USN-8861-1: OpenSSL vulnerabilities

It was discovered that OpenSSL had an inefficient algorithm in its QUIC stream reassembly implementation. A remote attacker could possibly use this issue to cause OpenSSL to use excessive CPU resources, leading to a denial of service. CVE-2026-42772 It was discovered that OpenSSL did not properly...

AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788279341)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788279341 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

ROS-20260930-73-0096

The vulnerability in the kernel-lt is related to insufficient control of resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

AlmaLinux 9.6 [TuxCare] Security Update: mod_md (ALMALINUX9.6:CLSA-2026:1782919559)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782919559 advisory. - Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's modmd via OCSP response data. This issue affects...

ROS-20260930-73-0097

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260930-73-0095

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260930-73-0094

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-103516

Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1 Description The gateway WebSocket transport contains an allocation of resources without limits. This allows connected gateways to exhaust node memory by sending an unending sequence of WebSocket...

CVE-2026-95290

A flaw was found in chromium-browser. Due to missing authorization checks in the Near Field Communication NFC component, a remote attacker who has compromised a renderer process can bypass system access restrictions via a crafted HTML page. Successful exploitation allows the attacker to access...

CyberClass

CyberClass Ce dépôt contient des ressources éducatives pour Class'Code CyberClass. Arborescence des fichiers 📦CyberClass ------------------------------------ Répertoire racine ┣ 📂docs --------------------------------------- Sources du site web ┃ ┣ 📂assets -----------------------------------...

CVE-2026-75804: Allocation of Resources Without Limits or Throttling

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804: Allocation of Resources Without Limits or Throttling

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

Allocation of Resources Without Limits or Throttling

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Address6.isValid method and the Address4 constructor when parsing an oversized input...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Address6.isValid method and the Address4 constructor when parsing an...

ai-kubernetes-helm-chart-security

AI в Kubernetes: безопасность Helm-чартов по умолчанию доказательства Этот репозиторий содержит данные и доказательства, лежащие в основе технического отчёта Sorami «AI в Kubernetes: 10 из 14 Helm-чартов поставляются без аутентификации API» версия 1.2. Читайте отчёт здесь:...

Allocation of Resources Without Limits or Throttling

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into t...