CVE-2026-92284 Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

CVE-2026-92284

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

CVE-2026-92284

The Caddy server platform is vulnerable in version 2.11.3 and earlier due to an unbounded io.Copy operation within the modules/caddyhttp/replacer.go component. When resolving the {http.request.body} placeholder, the system reads the complete request body before any request-body middleware limits ...

CVE-2019-19231

CVE-2019-19231 https://techdocs.broadcom.com/us/product-content/recommended-reading/security-notices/CA20191218-01-security-notice-for-ca-client-automation-agent-for-windows.html...

CVE-2018-16987

CVE-2018-16987 Esta es una vulnerabilidad de almacenamiento de texto claro de información sensible y exposición de información sensible que encontré en Squash TM durante una prueba de penetración. SquashTM Squash TM es una interfaz web utilizada para gestionar casos de prueba. Enlace al proyecto...

CLSA-2026-1790186133 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.14.2-tuxcare.2...

CVE-2015-1397

POC for CVE-2015-1397 Magento SQL Injection. Read more at : https://blog.checkpoint.com/security/analyzing-magento-vulnerability/...

CVE-2019-14322-scanner

CVE-2019-14322-scanner A vulnerability was found in Pallets Werkzeug up to 0.15.4. It has been declared as critical. This vulnerability affects the function SharedDataMiddleware of the component Windows. The manipulation with an unknown input leads to a directory traversal vulnerability. The CWE...

CVE-2026-71300

A flaw was found in Apache Camel Atmosphere Websocket. This improper input validation vulnerability allows a remote attacker to inject specific Exchange headers, such as websocket.connectionKey.list, which are not properly filtered. By manipulating these headers, an attacker can take control of t...

CVE-2026-65583

A flaw was found in Apache CXF. The OpenID Connect OIDC relying-party token validation in Apache CXF could accept specially crafted self-issued ID tokens. This bypasses necessary claim checks, such as issuer, subject, audience, and time, leading to an authentication bypass. This vulnerability...

CVE-2026-64958

A flaw was found in Apache CXF. This vulnerability allows a remote attacker to perform a denial of service DoS attack by sending a message with an excessive number of attachment headers. This can lead to the affected system becoming unresponsive or unavailable...

CVE-2026-61899

A flaw was found in Apache Tapestry tapestry-core. A remote attacker could exploit this vulnerability by manipulating URLs to download sensitive classpath assets. This could lead to unauthorized access to internal application resources. Mitigation Mitigation for this issue is either not available...

debian-ssh

PRNG predecible de OpenSSL de Debian Enlaces URL original: http://metasploit.com/users/hdm/tools/debian-openssl/ Espejo Exploit: https://www.exploit-db.com/exploits/5622/ Perl https://www.exploit-db.com/exploits/5720/ Python https://www.exploit-db.com/exploits/5632/ Ruby Herramienta recomendada:...

CLSA-2026-1790185871 TuxCare security update for 8 packages (2 CVEs)

TuxCare rebuilt 8 packages to address 2 CVEs. Fixed in 3.6.5-tuxcare.9...

CVE-2024-21626-runcPOC

Vulnerability Reproduction CVE-2024-21626 docker runc Escape Vulnerability 1. Vulnerability Overview Vulnerability Name| docker runc Escape Vulnerability ---|--- CVE ID| CVE-2024-21626 Disclosure Date| 2024-01-31 Characteristic| / Affected Versions| runc @ v1.0.0-rc93, 1.1.11 2. Exploitation &...

CVE-2021-29267

CVE-2021-29267 SherlockIM ChatBot XSS Suggested description: SherlockIM is vulnerable to Persistent XSS. Additional Information: SherlockIM - Platform for manage all kind of conversations with customers. Vulnerability Type: Cross Site Scripting XSS A letter was sent to the vendor about the...

CVE-2026-18165

A flaw was found in @fastify/oauth2, an OAuth 2.0 plugin for Fastify. This vulnerability allows a remote attacker to perform a Login Cross-Site Request Forgery CSRF attack. By planting predictable OAuth state and code verifier cookies, an attacker can trick a victim's browser into completing an...

CVE-2026-88840

BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message...

EUVD-2026-85513

BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message...

CVE-2026-88840 Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello

BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message...