http-terminator

http-terminator An AI-assisted research pipeline for discovering and exploiting HTTP request-smuggling / response-desynchronisation vulnerabilities. Published as a reference companion to the research; parts are runnable see the matrix below. The pipeline URL / RFC ──▶ seeker ──▶ flamer ──▶...

Terminator

Terminator : Metasploit Payload Generator Payload List : Binaries Payloads 1 Android 2 Windows 3 Linux 4 Mac OS Scripting Payloads 1 Python 2 Perl 3 Bash Web Payloads 1 ASP 2 JSP 3 War Encrypters 1 APK Encrypter 2 Python Encrypter The author does not hold any responsibility for the bad use of thi...

Terminator

Terminator Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver Spyboy was selling the Terminator software at a price of $3,000 for more detail the sample is sourced from loldrivers usage the compiled version can be found HERE Place th...

Exploit for CVE-2026-102422

CVE-2026-102422 POC Proof of concept for GHSA-pqg4-j6r4-53mv...

CVE-2026-106444

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...

shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

Impact quote emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input: js quote'echo', 'ok',...

GHSA-PQG4-J6R4-53MV shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

Impact quote emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input: js quote'echo', 'ok',...

UBUNTU-CVE-2026-104259

GHSA-qrch-pjfr-9g47: t:removeComments mishandles the character after a comment terminator, bypassing rules...

UBUNTU-CVE-2026-104030

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash a...

CVE-2026-104030

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash a...

EUVD-2026-92759

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: fixed to avoid out-of-boundary access in devs.path - touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123 - truncate -s $102410241024 \ /mnt/f2fs/012345678901234567890123456789012345678901234567890123 -...

Astra Linux – Vulnerability in NTP

In the mstolfp.c file within NTP 4.2.8p15, there is a buffer overflow vulnerability when a \0' character is added. An adversary may be able to attack a client ntpq process, but they cannot attack the ntpd process...

Astra Linux – Vulnerability in netcdf

A issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxmldecode, when parsing a crafted XML file, performs incorrect memory handling. This results in an overflow of the heap-based buffer when strchr is called, starting with a pointer after a '\0' character where the processing of th...

CVE-2026-104182

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

CLEANSTART-2026-PP37381 net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines

Security vulnerability affects the cri-tools package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines...

PT-2026-104010

Name of the Vulnerable Software and Affected Versions stream-json versions prior to 3.6.0 Description The JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash when a block or line comment spans an inpu...

CLEANSTART-2026-RQ84574 net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines

Security vulnerability affects the buildkitd package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines...

SUSE CVE-2026-102422

shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...

Command Injection

Overview shell-quote is a package used to quote and parse shell commands. Affected versions of this package are vulnerable to Command Injection via the quote function when a comment token is followed by a string token containing a line terminator. A comment token emits a -prefixed string that...