CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled /.. pattern segments inside a fixpoint loop,...

netwave-dosvulnerability

Netwave IP Camera server vulnerable to unauthenticated Denial of Service via one single huge POST request on any firmware. CVE| Description ---|--- CVE-2018-6479| Unauthenticated remote Denial of Service vulnerability CVSS| Score| Details ---|---|--- 3| 7.3|...

Bitrix24DoS

Bitrix24 DoS Exploit This repository contains a Python script designed to exploit a Denial of Service DoS vulnerability in Bitrix24. Please note that this script is for educational purposes only, and its use for unauthorized activities is illegal and unethical. CVE-2023-1718 CVE Identifier :...

Wordpress-DOS

CVE-2018-6389 exploit for Wordpress sites A small DOS script targeting an unpatched vulnerability in wordpress sites. Uses /wp-admin/load-scripts.php to request additional scripts from hosting server. Includes large list of scripts as request payload This implementation is for testing purposes on...

EUVD-2026-109987

zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction...

esp32_esp8266_attacks

ESP32/ESP8266 Wi-Fi Attacks This repository is part of a research outcome from theASSET Research Group. This repository demonstrates 3 Wi-Fi attacks against the popular ESP32/8266 IoT devices: Zero PMK Installation CVE-2019-12587 - Hijacking ESP32/ESP8266 clients connected to enterprise networks;...

CVE-2026-21710

CVE-2026-21710 — Node.js req.headersDistinct DoS Summary Field| Value ---|--- CVE ID| CVE-2026-21710 Published| 2026-03-30 CVSS v3.1| 7.5 HIGH AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE| CWE-770 — Allocation of Resources Without Limits or Throttling Affected| Node.js 20.x, 22.x, 24.x, 25.x Fixed in|...

CVE-2024-24549

Apache Tomcat DoS Exploit CVE-2024-24549 Description This repository contains a proof-of-concept PoC exploit for a denial-of-service DoS attack against Apache Tomcat version 9.0.83 , based on an issue identified in the handling of HTTP headers and payloads. This script generates malicious HTTP...

CVE-2024-38063-poc

Real POC published https://github.com/ynwarcs/CVE-2024-38063 and I have updated in my code as well, This can cause crash into your system so use VM or just learning thing, you can get RCE by making changes in the code. Usage iface Most probably this is enabled bydefault. Check the...

CVE-2020-1967

CVE-2020-1967 Proof of concept exploit about OpenSSL signaturealgorithmscert DoS flaw CVE-2020-1967. Credit for the original finding to Bernd Edlinger, additional analysis by Matt Caswell and Benjamin Kaduk, this demo by Imre Rad. Prerequisite Server or client applications that call the...

CVE-2026-119141

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the mayleave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, su...

CVE-2026-119123

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service...

CVE-2026-115795

P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is read past the end of the buffer. In...

CVE-2026-112200

P-Net before 1.0.3 does not release the Application Relationship AR and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the available sessions. Once they are exhausted t...

CVE-2026-115793

P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available sessions. Once they are exhausted the device no longer answer...

CVE-2026-111733

P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR AR specific indices 0xE000-0xEFFF, and the expected identification data of a slot or subslot. A remote unauthenticated attacker can send...

CVE-2026-111734

P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pfethrecv before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end...

CVE-2026-111735

P-Net before 1.0.3 contains an integer underflow in pfcpmcdataind. When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long...

CVE-2026-111736

P-Net before 1.0.3 dereferences a NULL AR pointer in pffspmcmreadind when handling an implicit read request without a valid target AR UUID for a user specific record index, if the application has registered a read callback. A remote unauthenticated attacker can send such a request to crash the...

CVE-2026-111730

P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in getcheckpeer. The received length up to 255 was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end o...