CVE-2022-0847-DirtyPipe-Exploits

CVE-2022-0847-DirtyPipe-Exploits This repository offers a comprehensive collection of exploits and documentation specifically designed for penetration testers and red team professionals. It serves as a valuable resource for those aiming to exploit the Linux Dirty Pipe vulnerability effectively...

CVE-2026-103658

A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of Service DoS by convincing a user to process a specially crafted dictionary file. This issue occurs due to an integer calculation error during buffer capacity checks in the read-only dictionary...

CVE-2026-53922 odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IANA options. ...

CVE-2026-53922 odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IANA options. ...

CVE-2026-53922

The odhcpd DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt is vulnerable to a pre-auth remote Denial of Service (DoS) . In versions prior to commit cfddd56 , an unauthenticated host on the same link can trigger a size_t underflow within the dhcpv6_ia_handle_IAs function. By sendin...

CVE-2026-91135

A flaw was found in Apache Thrift. When an application using the C++ transport layer enables compression on outgoing messages, it copies the compressed frame into the write buffer without verifying that the buffer is large enough. A remote attacker can exploit this issue by supplying incompressib...

CVE-2026-41210

The Moonlight Qt GameStream client (versions 6.1.0 and earlier ) is vulnerable to a remote heap buffer overflow . When a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL if Moonlight selects a decoder path lacking CAPABILITY_REFERENCE_FRAME_INVAL...

CVE-2026-41210 Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

CVE-2026-41210 Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

CVE-2026-103658

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

CVE-2026-103658

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

EUVD-2026-97965

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

CVE-2026-103658

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

CVE-2026-103658

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

CVE-2026-103658

GNU Aspell versions through 0.60.8.2 are vulnerable to a heap-based buffer overflow (CWE-122) within the read-only dictionary loader. The root cause is an integer calculation error in common/string.hpp, where String::reserve() uses a signed integer for capacity checks. This allows a crafted .rws ...

libgd: buffer overflow when processing specially crafted GIF file

A flaw was found in libgd. Processing a specially crafted GIF file allows a remote attacker to trigger a buffer overflow, resulting in an application crash and a denial of service. Arbitrary code execution is possible in theory, but considered highly unlikely because standard image decompression...

Important: Red Hat Security Advisory: gd security update

An update for gd is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

CVE-2026-96261

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 are vulnerable to a stack-based buffer overflow (CWE-121) during host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can provide specially crafted configuration data, caus...

CVE-2026-96261 IBM Power Systems Firmware Buffer Overflow

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash...

CVE-2026-96262 IBM Power Systems Firmware Buffer Overflow

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowi...