GHSA-VCC3-GHJQ-M6FR decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

Impact An attacker who can supply input to decodeUriComponent directly or via a dependency that uses this package on URL/query/path data can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote...

Vehicle-Service-Management-System-User-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46073 漏洞标题：车辆服务管理系统 - '用户列表' 存储型跨站脚本（XSS） 漏洞作者：SANU P.L CVE：CVE-2021-46073 CVSS：4.8 中危 参考： https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-46073 https://vulners.com/cve/CVE-2021-46073 描述：...

Vehicle-Service-Management-System-Settings-Stored-Cross-Site-Scripting-XSS

CVE-2021-46074 漏洞标题: Vehicle Service Management System - 'Settings' 存储型跨站脚本 XSS 漏洞作者: SANU P.L CVE: CVE-2021-46074 CVSS: 4.8 中危 参考资料: https://www.plsanu.com/vehicle-service-management-system-settings-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-46074...

CVE-2025-54939

PoC for QUIC-LEAK CVE-2025-54939 in LSQUIC Overview This PoC highlights CVE-2025-54939, a pre-handshake memory exhaustion Denial of Service vulnerability in the LSQUIC QUIC implementation. The issue, named QUIC-LEAK, was first documented by Imperva:...

Vehicle-Service-Management-System-Service-Requests-Stored-Cross-Site-Scripting-XSS

CVE-2021-46070 漏洞标题：车辆服务管理系统 - “服务请求”存储型跨站脚本（XSS） 漏洞作者：SANU P.L CVE：CVE-2021-46070 CVSS：4.8 中危 参考链接： https://www.plsanu.com/vehicle-service-management-system-service-requests-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-46070 https://vulners.com/cve/CVE-2021-46070 描述：...

Vehicle-Service-Management-System-MyAccount-Stored-Cross-Site-Scripting-XSS

CVE-2021-46068 漏洞标题: Vehicle Service Management System - 'MyAccount' 存储型跨站脚本（XSS） 漏洞作者: SANU P.L CVE: CVE-2021-46068 CVSS: 4.8 中危 参考链接: https://www.plsanu.com/vehicle-service-management-system-myaccount-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-46068...

CVE-2026-82398

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82398 pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82398 pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82398

pypdf , a pure-Python PDF library, is vulnerable to excessive resource consumption in the read_until_whitespace function within pypdf/_utils.py. When processing a crafted PDF containing a long sequence of non-whitespace bytes, the function performs immutable bytes concatenation in a one-byte loop...

CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

CVE-2026-82397

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

CVE-2026-82397

Tornado (Python web framework / async networking library), prior to 6.5.8 , parses application/x-www-form-urlencoded request bodies via urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. Because RequestHandler._execute parses the body before handler dispatch, an unauthenti...

CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

EUVD-2026-42312

Socket.IO: Engine.IO WebTransport SID DoS...

cve-2015-5477

BOND9 TKEY assert DoS CVE-2015-5477 的 PoC 此漏洞利用程序通过发送该漏洞利用代码来测试 BIND9 服务器是否存在漏洞，以观察其是否崩溃。 它是 C 代码，你可以像往常一样在 Unix/Window 上编译，例如： root@kitploit: gcc tkill.c -o tkill 它能在 IPv4 和 IPv6 上运行。 以下是对 localhost 运行时的效果。由于解析该名称会得到两个 IP 地址，因此它会尝试这两个地址。它首先查询“version”字符串，然后发送漏洞利用代码。当探测第二个地址时，version...

CVE-2026-71415

Kirby CMS (versions 5.0.0–5.5.2) contains a flaw in its REST API chunk upload handler (src/Api/Upload.php). The method Kirby\Api\Upload::process() failed to execute the relevant upload authorization preflight before processChunk() persisted chunk data. An authenticated user holding the access.pan...

EUVD-2026-68808

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

CVE-2026-71415 Kirby: File upload permissions are not checked during processing of chunk data

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

Important: Red Hat Security Advisory: libreswan security update

An update for libreswan is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...