CVE-2026-83530 Uncontrolled Memory Allocation in cel-go

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

CVE-2026-83530 Uncontrolled Memory Allocation in cel-go

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

Malicious code in @staticj/cropperxmjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac36a108b1e9c92a64955277bdfe9a09cdae61504e9a1bfaf40a15c50595139a @staticj/[email protected] ships a modified cropper.min.js that impersonates the legitimate Cropper.js library. At library load, injected code...

MAL-2026-16081 Malicious code in @staticj/cropperxmjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac36a108b1e9c92a64955277bdfe9a09cdae61504e9a1bfaf40a15c50595139a @staticj/[email protected] ships a modified cropper.min.js that impersonates the legitimate Cropper.js library. At library load, injected code...

check-cve-2025-66478

Check for CVE-2025-66478 Checks if your NextJS server is vulnerable to CVE-2025-66478. This is just a quick and dirty wrapper for the HTTP request provided by Searchlight. By relying on this script, you are assuming that their research is a valid indcator of vulnerability. Usage root@kitploit:...

OPENSUSE-SU-2026:21823-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix...

CVE-2026-79971

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Sanitization of Custom Special Characters vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to scri...

USN-8675-2 perl vulnerabilities

USN-8675-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 26.04 LTS. Original advisory details: It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an...

USN-8675-2: Perl vulnerabilities

USN-8675-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 26.04 LTS. Original advisory details: It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an...

droidground v1.0.15

DroidGround Website | Demo In traditional CTF challenges , it's common to hide flags in files on a system, requiring attackers to exploit vulnerabilities to retrieve them. However, in the Android world, this approach doesn't work well. APK files are easily downloadable and reversible, so placing ...

CVE-2026-61911

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired...

Malicious code in polygon-toolkits-validator (npm)

[email protected] exports Node crypto helper wrappers, but validateinput base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check as action: "validator", content: btoainput through checkvalidator in dist/index.js, then returns true without validating...

UBUNTU-CVE-2026-61911

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired...

MAL-2026-16087 Malicious code in polygon-toolkits-validator (npm)

[email protected] exports Node crypto helper wrappers, but validateinput base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check as action: "validator", content: btoainput through checkvalidator in dist/index.js, then returns true without validating...

Vulnerabilities in Adobe Experience Manager

Adobe has identified several vulnerabilities in Adobe Experience Manager. Adobe Experience Manager contains several Cross-Site Scripting XSS vulnerabilities, including DOM-based and stored XSS vulnerabilities. These vulnerabilities allow attackers to inject and execute malicious JavaScript code...

Exploit for CVE-2026-79387

CVE-2026-79387: SQL Injection in PbootCMS V3.2.5 User Manageme...

EUVD-2026-74907

VLC media player copies an RTSP response line into a fixed buffer without guaranteeing termination and then treats that buffer as a C string. RtspReadLine in modules/access/rtsp/access.c calls strncpy with the full buffer length, which writes no terminator when the source line is at least as long...

CVE-2026-79638

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script...

Security Bulletin: Vulnerabilities in Spring, Tomcat, Netty, PostCSS might affect IBM Storage Protect Plus

Summary IBM Spectrum Protect Plus can be affected by vulnerabilities in PostCSS, Spring, HttpClient, Netty, Tomcat, Jackson-Core, RabbitMQ, urllib3, and Node.js. Vulnerabilities include exposure of sensitive information to an unauthorized actor, authentication bypass by primary weakness, improper...

Regular Expression Denial of Service (ReDoS)

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the Actor.fromstring parsing in git/util.py. An attacker can exhaust CPU and stall commit metadata access by supplying a...