cve-2021-41773-lab

CVE-2021-41773 — Minimal FastAPI Lab A small, self-contained FastAPI lab demonstrating how decoding user input before validating filesystem boundaries can lead to directory traversal and local file inclusion LFI, modeled after the Apache HTTP Server issues CVE-2021-41773. Features Minimal,...

Important: Red Hat Security Advisory: rust-sequoia-sq security update

An update for rust-sequoia-sq is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records

A flaw was found in hickory-resolver. This vulnerability allows attackers to bypass Domain Name System Security Extensions DNSSEC authentication checks. By controlling the answering zone or being positioned on the network path, an attacker can have forged DNS records accepted as validated, leadin...

CVE-2026-20127-Exploit-Extension

Executive Summary The CVE-2026-20127 Defensive Companion is a premier, enterprise-grade Browser Extension engineered for proactive threat intelligence and defensive analysis. This tool encapsulates authoritative technical research concerning the authentication bypass vulnerability in the Cisco...

CVE-2025-30144

Summary The fast-jwt library does not properly validate the iss claim based on the RFC https://datatracker.ietf.org/doc/html/rfc7519page-9. Details The iss issuer claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a potential...

jwt_tool

The JSON Web Token Toolkit v2 jwttool.py is a toolkit for validating, forging, scanning and tampering JWTs JSON Web Tokens. Its functionality includes: Checking the validity of a token Testing for known exploits: CVE-2015-2951 The alg=none signature-bypass vulnerability CVE-2016-10555 The RS/HS25...

CVE-2024-2323

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this...

CVE-2026-92287 Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

CVE-2026-92287

Apache Arrow C++ Parquet and PyArrow versions 4.0.0 through 25.0.1 are vulnerable to an improper input validation issue (CWE-20) where file-controlled KMS URLs are forwarded to pluggable KmsClient implementations without host validation. If a user does not use application-controlled settings, an ...

EUVD-2024-55809

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this...

CVE-2024-2323

The RemoteUserStoreManagerService in multiple WSO2 products fails to sufficiently validate password change attempts when the password history validation feature is active. This security oversight allows an attacker to perform brute force attacks to discover user passwords without adequate restric...

CVE-2024-2323 Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this...

CVE-2023-27326

Parallels Desktop VM Escape This repository contains an exploit for a Parallels Desktop vulnerability which has been assigned CVE-2023-27326. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. The exploit was tested on Parallels Deskto...

CVE20264893poc

Topology: https://medium.com/@yanyuyingshu/reproduction-journal-dnsmasq-ecs-validation-and-buffer-overflow-flaws-e0fe0f66f60c Steps​ 1.vi /etc/dnsmasq.conf​ port=5353​ listen-address=xxx.xxx.xxx.x bind-interfaces​ no-resolv​ no-hosts​ no-poll​ cache-size=1000​ log-queries​ log-facility=-​...

llm-council-vapt

LLM Council — VAPT Finding Validation A blind peer-review pipeline that validates a penetration-test finding before it reaches a client. Independent expert lenses assess the finding, blind-review each other, and a Chairman synthesizes one vetted verdict — is it worth reporting, and is the severit...

MemorizingTrustManager

MemorizingTrustManager - Private Cloud Support for Your App MemorizingTrustManager MTM is a project to enable smarter and more secure use of SSL on Android. If it encounters an unknown SSL certificate, it asks the user whether to accept the certificate once, permanently or to abort the connection...

CVE-2025-70828

CVE-2025-70828 Summary An arbitrary file read vulnerability was discovered in Datart v1.0.0-rc.3. The application fails to properly validate the JDBC connection URL during data source configuration. Vulnerability Details Vulnerability Type: Improper Input Validation CWE-20 / Arbitrary File Read...

CVE-2025-1306

Newscrunch Exploit CVE-2025-1306 🚨 Overview This exploit targets a Cross-Site Request Forgery CSRF to Arbitrary File Upload vulnerability CVE-2025-1306 in the Newscrunch WordPress theme. Due to missing nonce validation in the newscrunchinstallandactivateplugin function, an unauthenticated attacke...

CVE-2025-65640

CVE-2025-65640 1. Vulnerability Information CVE ID: CVE-2025-65640 Currently RESERVED Vulnerability Type: Stored Cross-Site Scripting XSS CVSSv3 score: 6.3 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N Vendor: Arket/Bluenext S.r.l. Product: Globe Document Intelligence Affected Version: 5.0.0.559 Discoverer...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud not validated Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-main embedded HTTP server builds its JWT authenticator from a keystore alone when neither jwtIssuer nor jwtAudience is configured, so inbound...