CVE-2026-92103 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decodenext/2 in lib/mint/http2/frame.ex compares ...

EEF-CVE-2026-92103 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decodenext/2 in lib/mint/http2/frame.ex...

CVE-2026-92103

The elixir-mint mint library (versions 0.1.0 to 1.11.0 ) is vulnerable to an Allocation of Resources Without Limits or Throttling issue. The root cause is located in Mint.HTTP2.Frame.decode_next/2 within lib/mint/http2/frame.ex, where the software only compares the frame size against the max_fram...

EEF-CVE-2026-91043 HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory

Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial of service. Mint.HTTP2 enforces the client's maxheaderlistsize setting only on the compressed size of an inbound...

cve-2024-38819-lab

CVE-2024-38819 客户文档保险库实验室 这是一个针对 CVE-2024-38819 的 Cloud Foundry 就绪 Spring Boot 演示项目，该漏洞是 Spring Framework 功能式静态资源处理中的路径遍历漏洞。 修复了什么？ CVE-2024-38819 在 Spring Framework 中被修复，而不是直接在 Spring Boot 中。 Spring Boot 在演示中仍然很重要，因为它管理应用程序使用的 Spring Framework 依赖版本。换句话说，Spring Boot 的维护版本可以为你引入修复后的 Framework...

CVE-2026-44578-PoC

CVE-2026-44578 - Next.js WebSocket SSRF PoC 漏洞： Next.js WebSocket 升级处理程序中的服务器端请求伪造（13.4.13 → 15.5.15, 16.0.0 → 16.1.6） 使用方法 Detect vulnerability python3 poc.py target.com:3000 --detect Tunnel to internal Redis python3 poc.py target.com:3000 --internal 127.0.0.1:6379 --payload "INFO\r\n" Tunnel to...

CVE-2025-68645

🛡️ CVE-2025-68645 - Zimbra ローカルファイルインクルージョン LFI 分析 📌 概要 このドキュメントでは、Zimbra Collaboration Suite に影響を及ぼす ローカルファイルインクルージョン LFI の脆弱性について説明します。 この問題は、以下のパラメータの不適切な処理に起因します。 /h/?javax.servlet.include.servletpath= これにより、認証されていないユーザーが内部アプリケーションリソースにアクセスできるようになります。 🔍 脆弱性の詳細 タイプ: ローカルファイルインクルージョン LFI アクセス:...

CVE-2026-92103: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decodenext/2 in lib/mint/http2/frame.ex compares ...

cve-2024-38819

CVE-2024-38819 01. File-Traversal 与 Webflux 概述 1 File-Traversal 与 WebFlux 概述 File-Traversal（路径遍历，Path Traversal）漏洞是攻击者绕过 Web 应用程序的文件系统权限，访问任意文件的漏洞，被指定为 CWE-22 的一种攻击类型。 Spring WebFlux 是 Spring 5 引入的支持响应式编程的模块，支持异步非阻塞应用程序开发，WebFlux.fn 提供函数式端点路由，可使用 lambda 表达式实现简洁灵活的路由配置。 CVE-2024-38819 出现在使用...

Cheatsheet-God

diff UPDATE: Added my huge link of bookmarks / references ❤️ 你是否保存了上百万个书签？这些书签是否都包含独特的信息？还有为日后加星的 Github 仓库？ 好吧，这里把所有这类资源汇编到了一个名为 Cheatsheet-God 的仓库中。不再需要书签链接，不再需要打开浏览器。全都为你放在这里了。 这里是一个资源、脚本和易于上手的操作指南的集合。为了准备 OSCP 以及日常渗透测试，我一直在收集（并将继续收集）。想怎么用就怎么用！ 欢迎所有贡献！如果你觉得自己可以贡献并让这些文档更加完整，请尽管做！我会对你致以谢意。...

Cybersecurity-Resources

Cybersecurity-Resources 一个汇集各种网络安全资源的库...

awesome-ai-security

awesome-ai-security A curated list of AI Security materials and resources for Pentesters, Bug Hunters, and Security Researchers. If you find that some links are not working, you can simply replace the username with gmh5225. Or you can send an issue for me. Show respect to all the projects below,...

linux

Linux kernel Linuxカーネルは、あらゆるLinuxオペレーティングシステムの中核です。ハードウェアとシステムリソースを管理し、他のすべてのソフトウェアに基本的なサービスを提供します。 クイックスタート バグを報告する: Documentation/admin-guide/reporting-issues.rst を参照 最新カーネルを入手する: https://kernel.org カーネルをビルドする: Documentation/admin-guide/quickly-build-trimmed-linux.rst を参照 コミュニティに参加する:...

CVE-2026-89000

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only...

EUVD-2026-87892

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the getMediaFromRemoteUrl function. An attacker can access internal network resources or read arbitrary files by supplying a crafted remote playlist URL that points to internal HTTP endpoints or loca...

CVE-2026-100848

AzuraCast versions before 0.23.8 (specifically the azuracast/azuracast Composer package) are vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that the software validates the "Remote Relay" URL only for syntax and scheme (http/https) via Utilitiesase\Urls::parseUserUrl, but fa...

CVE-2026-100848 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL

AzuraCast Composer package azuracast/azuracast before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri and performs no host or IP address restriction. A user holding only the station-scope...

CVE-2026-100848 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL

AzuraCast Composer package azuracast/azuracast before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri and performs no host or IP address restriction. A user holding only the station-scope...

EUVD-2026-87840

AzuraCast Composer package azuracast/azuracast before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri and performs no host or IP address restriction. A user holding only the station-scope...