CVE-2026-42533

CVE-2026-42533 — nginx Heap Buffer Overflow PoC Exploit Pre-Authentication Remote Code Execution via Two-Pass Capture Clobbering Public PoC released 2026-07-27 — Don't wait, patch now. | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2 Critical Type| Heap Buffer Overflow CWE-122 Affected| nginx 0.9.6 –...

CVE-2026-42533

CVE-2026-42533 — nginx map/regex capture clobbering tracking site Source for the CVE-2026-42533 patch-status tracker: a single-page site recording which distributions have shipped a fix for the nginx map/regex capture-clobbering heap overflow. Where the facts live Everything about the bug —...

CVE-2026-42533

CVE-2026-42533 Lab — NGINX Two-Pass Capture Clobbering RCE CVSS 9.2 Critical — Pre-auth heap buffer overflow + info leak in nginx Affected: nginx 0.9.6 – 1.30.3 / 1.31.2 | Patched: 1.30.4 / 1.31.3 Architecture ┌─────────────────────────────────────┐ │ Host machine │ │ │ PoC scripts ──────┤ :8080...

CVE-2026-42945-POC

CVE-2026-42945 RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This vulnerability — along with three other memory...

CVE-2026-42533-Config-Scanner

nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...

CVE-2026-42533

CVE-2026-42533 — nginx two-pass capture clobbering Pre-auth heap overflow + info leak in nginx 0.9.6–1.30.3 / mainline ≤1.31.2 complex-value script engine; CVSS 9.2. Two trigger surfaces share the same root cause: HTTP regex location + regex map and stream sslpreread + SNI + regex map. In-depth...

Nginx-Rift

NGINX Rift Prueba de concepto de RCE para CVE-2026-42945 , un desbordamiento crítico de búfer en el montón en el módulo ngxhttprewritemodule de NGINX introducido en 2008. El error permite la ejecución remota de código no autenticada contra servidores que utilizan las directivas rewrite y set. Est...

Exploit for Heap-based Buffer Overflow in F5 Nginx_Gateway_Fabric

CVE-2026-42533 Lab — NGINX Two-Pass Capture Clobbering RCE...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

Improper Input Validation

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power o...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

Improper Input Validation

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

FreeBSD Security Advisory - FreeBSD-SA-26:55.elf

FreeBSD Security Advisory - The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two...

CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...

CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

Exploit for CVE-2026-42533

nginx capture-clobber scanner A read-only static scanner that...

GHSA-4XGF-CPJX-PC3J pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

Summary NestedSecretsSettingsSource reads secret values from files in a configured secretsdir. When secretsnestedsubdir=True, a directory entry inside secretsdir that is a symbolic link pointing outside secretsdir is followed, so files outside the configured directory are read into settings value...

GHSA-H5JC-78HR-3PC9 Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe

Impact A stored cross-site scripting XSS vulnerability affected the Markdown/RichText field preview renderer in Sveltia CMS. The DOMPurify sanitization configuration used for Markdown previews explicitly permitted iframe elements without enforcing a sandbox attribute or restricting iframe sources...