CVE-2026-59277 Spring Security InetAddressMatchers Incomplete Internal Network Classification

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-59277

Spring Security 7.1.0 contains an incomplete internal network classification issue in its InetAddressMatchers utility. The matchInternal() and matchExternal() builders are used to construct an InetAddressMatcher that classifies an IP address as belonging to an internal (private) or external (publ...

CVE-2026-59276 Timing Attack via Non-Constant-Time Comparison of Sensitive Values

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2026-59276

Spring Security is affected by a timing attack vulnerability in several components that compare security-sensitive values using standard String.equals() instead of a constant-time comparison. Because String.equals() returns as soon as a differing character is found, the response time for rejectin...

EUVD-2026-67168

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2026-4398

GitLab EE is affected by an authorization bypass on self-managed instances where an authenticated user could assign compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation during framework assignment. Affected versions inc...

echteeteepee

HTTP/1 Desync भेद्यता परीक्षण उपकरण इस रिपॉजिटरी में PortSwigger के James Kettle के अभूतपूर्व शोध पर आधारित HTTP/1 अनुरोध तस्करी desync भेद्यताओं का पता लगाने के लिए रक्षात्मक सुरक्षा उपकरण शामिल हैं। शोध श्रेय यह कार्य सीधे तौर पर निम्नलिखित तकनीकों से प्रेरित है और उन्हें लागू करता है: "HTTP/1...

monkey

Monkey documentation This folder contains the Monkey Documentation site. For more information see content/development/contribute-documentation.md...

rapidscan

🟥 RapidScan v1.2 - The Multi-Tool Web Vulnerability Scanner RapidScan has been ported to Python3 i.e. v1.2. The Python2.7 codebase is available on v1.1 releases section. Download and use it if you still haven't upgraded to Python 3. Kindly note that the v1.1 Python2.7 will not be enhanced further...

meg

meg meg is a tool for fetching lots of URLs but still being 'nice' to servers. It can be used to fetch many paths for many hosts; fetching one path for all hosts before moving on to the next path and repeating. You get lots of results quickly, but non of the individual hosts get flooded with...

CVE-2024-34370

CVE-2024-34370 CVE-2024-34370, https://vulners.com/cve/CVE-2024-34370...

CVE-2023-22809

CVE-2023-22809...

DEBIAN-CVE-2026-81724

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed...

DEBIAN-CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

DEBIAN-CVE-2026-81722

nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...

CVE-2026-81102

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

DEBIAN-CVE-2026-78002

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory...

Apache-Exploit-2019

Exploits Alcuni dei miei exploit...

CVE-2023-0297

CVE-2023-0297 https://github.com/overgrowncarrot1/CVE-2023-0297/assets/78485709/745d599b-b316-45c6-ae0f-4a720c276844...

log4j-2021-vulnerability-study

log4j-2021-vulnerability-study Questa è una dimostrazione di come la vulnerabilità Log4J CVE-2021-44228 potrebbe essere esplorata. Questo codice è sicuro da eseguire, ma comprendi cosa fa e come funziona!...