The vulnerability of the readAlf function in the vvdecapp (VVdeC) decoder allows a hacker to cause a service failure or execute arbitrary code.

The vulnerability of the readAlf function in the vvdecapp VVdeC decoder lies in the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

xed

Intel® X86 编码器解码器 Intel® XED Doxygen API 手册与源码构建手册： https://intelxed.github.io Bug 反馈： https://github.com/intelxed/xed/issues/new 简化版 GITHUB 构建说明： root@kitploit: git clone https://github.com/intelxed/xed.git xed git clone https://github.com/intelxed/mbuild.git mbuild cd xed ./mfile.py 然后从 obj 目录中...

web3-decoder

Web3 Decoder Web3 Decoder 是一个 Burp Suite 扩展，可帮助分析涉及 web3 智能合约的操作具体发生了什么。这主要是对以太坊节点以及其他兼容网络（如 Polygon、Arbitrum、BSC…）节点的 JSON-RPC 调用。 下载与安装 下载最新的扩展 JAR — 此链接始终提供最新版本： ⬇ web3-decoder.jar（最新版本） 旧版本可在发布页面获取。 然后在 Burp Suite 中加载： 1. 转到 扩展 → 已安装 → 添加 。 2. 将 扩展类型 设置为 Java ，然后选择下载的 web3-decoder.jar。 3. 单击...

Royal_APT

RoyalAPT Royal APT - APT15 - 来自 NCC Group 网络防御行动研究的相关信息 Sharepoint 工具 在该组织为受害者开发的工具中，APT15 创建了一个 .net 工具，用于枚举受害者的 sharepoint 数据库。以下是反编译二进制文件的截图。 解码脚本 NCC Group 发现的 BS2005 和 RoyalCLI 样本的解码脚本可在 scripts 目录中找到。 BS2005 bsdecoder.py 将提取并解密发送至样本...

dump1090

Dump1090 自述文件 Dump1090 是一款专为 RTLSDR 设备设计的 Mode S 解码器。 主要功能包括： 对弱信号进行稳健解码，许多用户观察到 Dump1090 的覆盖范围相比其他流行解码器有所提升。 网络支持：TCP30003 数据流（MSG5...）、原始数据包、HTTP。 内置 HTTP 服务器，可在 Google 地图上显示当前检测到的飞机。 利用 24 位 CRC 进行单比特纠错。 能够解码 DF11、DF17 消息。 能够解码 DF0、DF4、DF5、DF16、DF20 和 DF21 等 DF 格式，其中校验和与 ICAO...

CVE-2023-4863

CVE-2023-4863 root@kitploit: 签出 webp git clone https://chromium.googlesource.com/webm/libwebp/ webptest cd webptest/ 签出存在漏洞的版本 git checkout 7ba44f80f3b94fc0138db159afea770ef06532a0 启用 AddressSanitizer sed -i 's/^EXTRAFLAGS=./& -fsanitize=address/' makefile.unix 构建 webp make -f makefile.unix cd...

CVE-2026-8461-EXP

CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV 堆 OOB 写入 PoC !WARNING 本仓库包含一个针对堆损坏漏洞的有效利用 PoC。 仅供授权的安全研究、CTF 环境和防御性分析使用。 请勿对非你拥有或未经明确书面许可的系统进行测试。 受影响: FFmpeg 8.0.1 MagicYUV 解码器 libavcodec/magicyuv.c 原语: 堆 OOB 写入 → AVBuffer.free 劫持 → system 调用 漏洞 magydecodeslice 使用 sheight（未限制的切片高度）作为写入 Cb/Cr...

CVE-2026-69210

Http4s , a Scala HTTP service library, is vulnerable to a denial of service via its WebSocket decoder. In versions prior to 0.23.35 and 1.0.0-M47 , FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but incorrectly permits negative 64-bit lengths . A remote client...

CVE-2026-69216

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data...

CVE-2026-56997

In Av1DecodeFrameTag of vp9hwdheaders.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56942

In ReadTileInfo of vp9hwdheaders.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56920

In sdecodevuiparam of fwhevcdecheader.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0170

In Vp9DecodeFrameTag of vp9hwdheaders.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

msmap

MSMAP MsmapはメモリWebShellジェネレーターです。さまざまなコンテナ、コンポーネント、エンコーダー、 WebShell / Proxy / Killer 、および管理クライアントと互換性があります。简体中文 アイデアの背景 I, アイデアの背景 II, アイデアの背景 III 機能 WIP 機能 動的メニュー 自動コンパイル スクリプト生成 ライトモード...

CVE-2026-69216 Http4s: Ember chunk parser lenience (TE.TE request smuggling)

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data...

EUVD-2026-79176

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data...

CVE-2026-69209

Http4s , a Scala library for HTTP services, contains an unbounded memory buffering flaw in its shared WebSocket decoder . Defragmentation accumulates fragments without a size limit, and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that completes a WebSocket handsha...

CVE-2026-58710

In DecodeFilmGrainParams of filmgraindec.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-79002

In Vp9DecEndOfStream of vp9hwdoutput.cc, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58699

CVE-2026-58699 is an out-of-bounds read vulnerability in the Vp9DecEndOfStream function of vp9hwd_output.cc , caused by an incorrect bounds check. The flaw enables local escalation of privilege without requiring additional execution privileges and without user interaction. The vulnerability is tr...