26 matches found
CVE-2026-42533
CVE-2026-42533 — nginx Heap Buffer Overflow PoC Exploit Pre-Authentication Remote Code Execution via Two-Pass Capture Clobbering Public PoC released 2026-07-27 — Don't wait, patch now. | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2 Critical Type| Heap Buffer Overflow CWE-122 Affected| nginx 0.9.6 –...
CVE-2026-42533
CVE-2026-42533 — nginx map/regex capture clobbering tracking site Source for the CVE-2026-42533 patch-status tracker: a single-page site recording which distributions have shipped a fix for the nginx map/regex capture-clobbering heap overflow. Where the facts live Everything about the bug —...
CVE-2026-42533
CVE-2026-42533 — nginx two-pass capture clobbering Pre-auth heap overflow + info leak in nginx 0.9.6–1.30.3 / mainline ≤1.31.2 complex-value script engine; CVSS 9.2. Two trigger surfaces share the same root cause: HTTP regex location + regex map and stream sslpreread + SNI + regex map. In-depth...
CVE-2026-42533
CVE-2026-42533 Lab — NGINX Two-Pass Capture Clobbering RCE CVSS 9.2 Critical — nginx의 인증 전 힙 버퍼 오버플로 + 정보 유출 영향받는 버전: nginx 0.9.6 – 1.30.3 / 1.31.2 | 패치됨: 1.30.4 / 1.31.3 아키텍처 root@kitploit: ┌─────────────────────────────────────┐ │ 호스트 머신 │ │ │ PoC 스크립트 ──────┤ :8080 ──► nginx-vuln 1.26.x │ │ │...
Nginx-Rift
NGINX Rift RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This vulnerability — along with three other memory...
CVE-2026-42945-POC
CVE-2026-42945 CVE-2026-42945 에 대한 RCE 개념 증명입니다. 이는 2008년에 도입된 NGINX의 ngxhttprewritemodule에서 발생하는 심각한 힙 버퍼 오버플로입니다. 이 버그는 rewrite 및 set 지시문을 사용하는 서버에 대해 인증되지 않은 원격 코드 실행을 가능하게 합니다. 이 취약점은 세 가지 다른 메모리 손상 문제CVE-2026-42946, CVE-2026-40701, CVE-2026-42934와 함께 depthfirst의 보안 분석 시스템이 NGINX 소스를 온보딩하는 단 ...
CVE-2026-42533-Config-Scanner
nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...
Exploit for Heap-based Buffer Overflow in F5 Nginx_Gateway_Fabric
CVE-2026-42533 Lab — NGINX Two-Pass Capture Clobbering RCE...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...
Improper Input Validation
Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the...
Improper Input Validation
Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power o...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...
CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...
CVE-2026-55717
In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...
Exploit for CVE-2026-42533
nginx capture-clobber scanner A read-only static scanner that...
GHSA-4XGF-CPJX-PC3J pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size
Summary NestedSecretsSettingsSource reads secret values from files in a configured secretsdir. When secretsnestedsubdir=True, a directory entry inside secretsdir that is a symbolic link pointing outside secretsdir is followed, so files outside the configured directory are read into settings value...
GHSA-H5JC-78HR-3PC9 Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe
Impact A stored cross-site scripting XSS vulnerability affected the Markdown/RichText field preview renderer in Sveltia CMS. The DOMPurify sanitization configuration used for Markdown previews explicitly permitted iframe elements without enforcing a sandbox attribute or restricting iframe sources...