Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

ownCloud Guests - User Enumeration

ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/email/token, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication. id:...

cve-2025-53779-kerberos_bypass_reproduction

CVE-2025-53779: Microsoft Windows Kerberos Authentication Bypass CVSS Score: 9.8 Critical Status: Active exploitation in the wild Disclosure: Microsoft August 2025 Patch Tuesday Zero-Day Overview CVE-2025-53779 is a critical authentication bypass vulnerability in Microsoft Windows Kerberos protoc...

AAMVA-PDF417-Vulnerability-Research

PDF417 ID Validation Vulnerability Research Overview This repository contains comprehensive security research documenting critical vulnerabilities in AAMVA-standard PDF417 barcode validation systems affecting government IDs, enterprise solutions, and consumer applications. The research includes a...

ResetNightmare

ResetNightmare Proof-of-concept POC tool for ResetNightmare CVE-2026-27912. ResetNightmare is a validation flaw in the Kerberos Change Password protocol that allows for resetting the password of any target user/computer account, without knowing the current one. The attack requires an unpatched...

CVE-2026-85394

python-jose through version 3.5.0 contains an algorithm confusion vulnerability in its HMAC key validation logic. The library fails to properly reject DER-encoded public keys that lack PEM armor or SSH prefixes, allowing them to be accepted as HMAC secrets. An attacker who possesses the service's...

CVE-2026-80465

A vulnerability has been identified in Mendix SAML Mendix 10 compatible All versions V4.2.3, Mendix SAML Mendix 11 compatible All versions V4.2.3, Mendix SAML Mendix 9.24 compatible All versions V3.6.27. Affected versions of the module do not properly validate the SAML response signature. This...

PT-2026-85369

It was discovered that GnuPG incorrectly validated authentication tag lengths when parsing CMS messages encrypted with AES-GCM. An attacker could possibly use this issue to bypass message integrity checks...

CVE-2025-61163

A flaw was found in Cohere North AI. The server fails to properly validate the Origin header of incoming connection requests, leading to an excessively permissive cross-domain policy with untrusted domains. This vulnerability could allow an attacker to gain unauthorized access to sensitive...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098873)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098873 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: fix validation of VF state in get resources VF state I40EVFSTATEACTIVE is not the only stat...

CVE-2026-80101 Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by an improper input validation vulnerability, which may lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a specially crafted file...

Astra Linux – Vulnerability in Netty

The Netty project is an event-driven, asynchronous network application framework. Starting from version 4.1.83.Final and before 4.1.86.Final, when calling DefaultHttpHeaders.set with an iterator of values, header value validation was not performed. This allowed malicious header values in the...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain SAUCE patches that fail to validate invalid sizes of the name field in AppAmor notification responses. This bug can be triggered by an unprivileged local user, and it could lead to the processing of malicious responses...

Astra Linux – Vulnerability in libssh2

The vulnerability of the libssh2packetadd function in the packet.c component of the SSH2 implementation library Libssh2 is related to insufficient input validation. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

Astra Linux – Vulnerability in GIMP

GIMP FLI File Parsing: Out-of-bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a...

Astra Linux – Vulnerability in Apache2

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalation via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2026-76331

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language SPL into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system...