1437136 matches found
CVE-2026-79744
MCPHub is a unified hub for centrally managing and orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29 , the PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check — it is protected only by...
CVE-2026-79744 MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...
Awesome-LLMs-for-Vulnerability-Detection — Updated!
Awesome Large Language Models for Vulnerability Detection A curated list of papers, projects, and agent skills on using LLMs for vulnerability detection and discovery. 📄 Papers Only showing 2025 and later. For earlier work, see Papers Archive 2024 and earlier. Title| Venue| Year| Paper| Github...
CVE-2026-19953
URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...
CVE-2026-19953 URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep
URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...
SysTrace
SysTrace v1.5 A Linux system-call monitoring and behavioral security analysis tool combiningptrace-based tracing, lightweight namespace isolation, and machine learning classification. SysTrace observes the runtime behavior of a target program at the system-call level, extracts behavioral features...
JCEzploit-CVE-2026-48907
JCEzploit Joomla JCE Security Testing Framework A professional command-line utility for authorized penetration testing, controlled vulnerability research, and defensive validation. Authorized use only. Run this project exclusively against systems you own or are explicitly permitted to test. Use a...
[SECURITY] Fedora 44 Update: bind-9.18.50-2.fc44
BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...
[SECURITY] Fedora 44 Update: nebula-1.11.1-1.fc44
A scalable overlay networking tool with a focus on performance, simplicity and security...
cve-2022-27666-exploits
cve-2022-27666-exploits There are 2 exploitation methods that exploit CVE-2022-27666. For more info on how to use these code bases please check my blog here...
CVE-2010-3971-hotpatch
CVE-2010-3971-hotpatch 使用 Deviare 创建你自己的安全热补丁。 原文文章：使用 Deviare 创建临时零日补丁...
CVE-2026-65182
A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...
[SECURITY] Fedora 43 Update: bind-9.18.50-2.fc43
BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...
[SECURITY] Fedora 43 Update: hcloud-1.67.0-1.fc43
A command-line interface for Hetzner Cloud...
CLSA-2026-1788195644 TuxCare security update for axios (5 CVEs)
TuxCare rebuilt axios to address 5 CVEs. Fixed in 1.7.9-tuxcare.4...
security-research
security-research Proof-of-concept code and technical write-ups for vulnerabilities I discovered and reported through coordinated disclosure. Every entry here is already public: the vendor advisory is published and a fixed release is available. Nothing under embargo or in draft is included. The...
azure-security-auditor
Azure Security Posture Auditor A lightweight, production-style CLI tool that audits Azure security configurations and surfaces common misconfigurations — mirroring what Microsoft Defender for Cloud checks internally. Checks...
CVE-2025-4427-CVE-2025-4428
CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428 is a post-auth remote code execution vulnerability in EPMM's DeviceFeatureUsageReportQueryRequestValidator. It arises from the unsafe handling of user-supplied input within error messages processed via Spring’s AbstractMessageSource, which allows...
CVE-2026-80713
A flaw was found in the Linux kernel's iouring subsystem. When a task that has used iouring performs an exec call, its per-task restrictions are not properly preserved. This oversight allows a subsequent iouring ring created by the task to operate without the intended security restrictions,...