/
attack_type:denial_of_service × victim_sectors:technology × limpar

Resultados

3 casos · pág. 1/1

yokai.hakaisecurity.io · high

CVE-2026-42931: Gitea npm Package Registry unbounded request body read allows single-request DoS

A denial-of-service vulnerability, CVE-2026-42931, affects the npm endpoint of the Gitea Package Registry. The AddPackageTag function reads the entire HTTP request body into memory with io.ReadAll() before any validation, so a single oversized request can crash the whole Gitea process. Any authenticated user can trigger it against their o…

CVE-2026-42931 technology software_development
cisa.gov · · 2 fontes · 2 atualizações critical

CISA urges Citrix NetScaler ADC/Gateway patching and compromise checks as zero-days, including new CVE-2026-107406, are exploited

CISA issued an alert on exploitation of critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, noting confirmed malicious activity involving at least some of them. The alert references Citrix bulletins for CVE-2026-107406, CVE-2026-88779 and CVE-2026-88771 through CVE-2026-88778. Because NetScaler updates can be …

CVE-2026-88771 CVE-2026-88772 CVE-2026-88779 government education
theregister.com · · 27 fontes · 38 atualizações critical

PHP2Shell: PHP patches critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619; broad exploitation attempts, ASLR-bypass exploit reported, UK government services offline, wide vendor and government response

The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…

CVE-2026-109618 CVE-2026-109619 government transportation