moment vulnerable to Path Traversal via crafted non-string locale name

Impact moment before 2.31.0 is vulnerable to path traversal in moment.locale. When an application passes a non-string, attacker-influenced value to moment.locale, a specially crafted object can bypass the locale name validation and cause moment to load a file from an attacker-controlled path. Thi...

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

Summary expand recurses once per level of brace nesting. Deeply nested input exhausts the native stack and crashes the process. This is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the tail iterative recursion on m.post, driven by how many groups are chained. Nesting depth drive...

CVE-2026-103046 WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1...

CVE-2026-69662

The application uses unsafe functions that allow execution of inline scripts and string evaluation functions...

CVE-2026-76729

A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote...

CVE-2026-76722

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code...

EUVD-2026-89348

A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote...

CVE-2026-76729 Authenticated Format String Vulnerability allows Memory Corruption in HPE Networking Instant ON API Endpoint

A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote...

CVE-2026-76729

A format string vulnerability exists in the API endpoint of HPE Networking Instant ON APs . An authenticated remote attacker with high privileges can provide modified input to cause memory corruption . This could lead to a denial-of-service (DoS) condition or remote code execution (RCE) within th...

CVE-2026-76729 Authenticated Format String Vulnerability allows Memory Corruption in HPE Networking Instant ON API Endpoint

A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote...

EUVD-2026-89341

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code...

CVE-2026-76722 Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code...

CVE-2026-76722 Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code...

CVE-2026-76722

Uncontrolled format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs . This flaw could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying host. Successful exploitation may lead to a Denial-of-Service (DoS) or potential r...

CVE-2026-102830

A flaw was found in JupyterLab. Incomplete validation of language pack headers allows arbitrary JavaScript code to be injected and executed during string translation. An attacker could exploit this flaw by enticing a user to load a malicious third-party language pack, resulting in code execution...

CVE-2026-102715

A heap-buffer overflow vulnerability exists in the mDNS implementation within NetX Duo (specifically in addons/mdns/nxd_mdns.c). The root cause is a logic error where the string cache lookup compares the rounded slot size rather than the actual string length . This allows names with lengths of 12...

windows-api-function-cheatsheets

Hoja de referencia de funciones de la API de Windows Contacto 🌨️ Snowcrash: [email protected] Tabla de contenidos Hoja de referencia de funciones de la API de Windows Operaciones de archivos Gestión de procesos Gestión de memoria Gestión de hilos Gestión de bibliotecas de vínculos dinámicos...

Security Bulletin: IBM Documentation Offline may be vulnerable to TLS authentication bypass and authority rebinding due to Node.js (CVE-2026-48618, CVE-2026-48930)

Summary IBM Documentation Offline uses Node.js as its runtime environment. Node.js is affected by two vulnerabilities related to TLS hostname handling. CVE-2026-48618 involves improper handling of Unicode dot separators during TLS certificate verification, which could allow an attacker performing...

PoC-CVE-2024-23113

Disclaimer The code and materials contained in this repository are provided strictly for educational, research, and authorized security testing purposes. Prohibited Use Do not use this tool/code against any infrastructure, systems, or networks without explicit, prior written permission from the...

CVE-2026-95509 Out-of-bounds read vulnerability in string formatting impacts Qt for MCUs

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg formatting by an incorrect buffer size calculation, causing out-of-bounds reading...