CVE-2026-85751 Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust

Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXYAUTHWHITELIST configured but REALIPHEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The...

EUVD-2026-83975

Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXYAUTHWHITELIST configured but REALIPHEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The...

CVE-2026-85751 Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust

Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXYAUTHWHITELIST configured but REALIPHEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The...

CVE-2026-40345

deepmerge-ts 8.0.0: рекурсивный DoS через граф объектов Я воспроизвёл ошибку переполнения стека в версиях deepmerge-ts до 8.0.0. Интересно то, что для краха не нужен огромный вложенный объект. Причина — в идентичности объектов. Если оба объединяемых значения ссылаются сами на себя через одно и то...

CLSA-2026-1790005086 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.1-tuxcare.3...

CVE-2026-27771

CVE-2026-27771 — Обход аутентификации реестра контейнеров Gitea CVSS: Н/Д не опубликовано Затрагивает: Gitea Отказ от ответственности: Эта концепция предоставлена только для образовательных целей и авторизованных исследований безопасности. Несанкционированный доступ к компьютерным системам...

badepoll-selinux-disabler

badepoll-selinux-disabler Автономное извлечение этапа отключения SELinux из эксплойта UAF для CVE-2026-43074 в eventpoll. Он гоняет проверку глубины цикла eventpoll epgetupwardsdepthproc, чтобы записать ноль в selinuxstate.enforcing, переводя устройство в режим Permissive с помощью одно-байтовой...

CVE-2001-0931

CVE-2001-0931 Уязвимость обхода каталогов в Cooolsoft PowerFTP Server 2.03 позволяет злоумышленникам перечислять или читать произвольные файлы и каталоги с помощью .. точка-точка в 1 LS или 2 GET. Публикация SecurityFocus: https://www.securityfocus.com/bid/3593/info Публикация Securiteam:...

CVE-2025-54794-Hijacking-Claude-AI-with-a-Prompt-Injection-The-Jailbreak-That-Talked-Back

🧠 CVE-2025-54794: Hijacking Claude AI with a Prompt Injection – The Jailbreak That Talked Back By Aditya Bhatt | Offensive Security Specialist | Red Team Operator | VAPT Addict ⚔️ Introduction: When Your AI Can Be Hacked With Words In an era where language models have become the co-pilots of our...

CVE-2018-15473

CVE-2018-15473 OpenSSH 7.7 - Перечисление имен пользователей Метод Атакующий может попытаться аутентифицировать пользователя с помощью поврежденного пакета например, усеченного пакета, и: если пользователь недействителен не существует, то userauthpubkey возвращается немедленно, и сервер отправляе...

CVE-2026-53940

Conda versions prior to 26.5.2 are vulnerable to a path traversal during noarch:python package installation. The function parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a package's info/link.json metadata, which was then interpolated into the...

CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

EUVD-2026-83974

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

CVE-2003-0358

CVE-2003-0358 Публикуется по историческим причинам. snowcrash [email protected] https://github.com/snowcra5h/ Описание Переполнение буфера в 1 nethack 3.4.0 и более ранних версиях, а также в 2 falconseye 1.9.3 и более ранних, основанной на nethack, позволяет локальным пользователям повысить...

nf-tables-lpe

nf-tables-lpe Эксплойты команды Orca из Sea Security и Qrious Secure для множества уязвимостей в модуле nftable Netfilter...

CLSA-2026-1790004677 TuxCare security update for webpack-dev-server (3 CVEs)

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 5.2.2-tuxcare.2...

CVE-2018-17456

CVE-2018-17456 Vulnerability Overview Vulnerability Name: Git Input Validation Error Vulnerability CNNVD ID: CNNVD-201810-234 Hazard Level: Critical CVE ID: CVE-2018-17456 Vulnerability Type: Input Validation Error Published Date: 2018-10-08 Threat Type: Remote Updated Date: 2019-04-25 Vendor:...

cve-2023-38408

CVE-2023-38408: Understanding and Simulating a Real-World SSH-Agent Vulnerability Table of Contents 1. Introduction 2. Background Concepts 3. The CVE-2023-38408 Vulnerability 4. Practical Simulation and Testing 5. Technical Analysis 6. Fix and Mitigation 7. Conclusion 1. Introduction Purpose of...