CVE-2026-111066

A flaw was found in aiohttp. When processing multipart requests, the framework fails to properly limit the number of open file descriptors retained during request handling. An unauthenticated remote attacker can exploit this issue by sending specially crafted multipart requests, exhausting...

CVE-2026-98534

A flaw was found in the Linux kernel's Integrity Policy Enforcement IPE subsystem. A local attacker can cause a denial of service DoS or potentially execute arbitrary code by triggering a race condition during policy management. This issue occurs when a newly loaded policy is audited after intern...

CVE-2026-8168

A flaw was found in the Qt SVG module. A remote attacker could trigger this issue by providing a specially crafted SVG Scalable Vector Graphics file containing deeply nested elements. When parsed, this leads to uncontrolled recursion and stack exhaustion, resulting in an application crash and a...

ntpdos

ntpdos PoC for distributed NTP reflection DoS CVE-2013-5211. Usage $ ./ntpdos -H --== ntpdos by sepehrdad ==-- usage: ntpdos -t -s options | misc options: -t - target ip address -T - list of target ip addresses -s - ntp server ip address -S - list of ntp server ip addresses -p - number of paralle...

CVE-2026-110675

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

EUVD-2026-104588

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.maxpixels limit when system.images.urlactions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or...

EUVD-2026-104585

Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...

CVE-2026-112275

A flaw was found in netpbm. An attacker could exploit this vulnerability by enticing a user to process a specially crafted Sun raster image file using the rasttopnm conversion utility. A heap-based buffer overflow in the run-length decoder allows out-of-bounds data to be written into memory...

CVE-2026-70405

A flaw was found in Erlang/OTP snmp. A remote attacker can degrade availability by sending a crafted Simple Network Management Protocol SNMP message. This message contains a Basic Encoding Rules BER INTEGER with an arbitrarily large length field, causing the system to consume excessive resources...

CVE-2026-69304

A flaw was found in ASP.NET Core. This vulnerability arises from the improper handling of highly compressed data, a technique referred to as data amplification. An unauthorized attacker can exploit this weakness remotely over a network. Successful exploitation leads to a denial of service,...

CVE-2026-112366

A flaw was found in picomatch. A remote attacker can trigger this vulnerability by supplying crafted pattern-matching inputs containing single-branch repeated extglob expressions. Processing these inputs causes exponential regular expression backtracking, which blocks the event loop and leads to ...

CVE-2026-111064

A flaw was found in aiohttp. The server does not enforce a timeout during the initial phase of a request before any data is received. A remote attacker can exploit this vulnerability by keeping idle connections open indefinitely, exhausting available connection capacity and resulting in a Denial ...

CVE-2026-66055

A flaw was found in Apache Thrift. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending specially crafted requests. Because the affected bindings fail to properly restrict resource allocation during request handling, an attacker can exhaust system resources and...

CVE-2026-98532

A flaw was found in the Linux kernel. A remote attacker could cause a Denial of Service DoS or memory corruption by sending specially crafted IPv6 network packets. The IPv6 extension header parsing mechanism fails to verify that the declared length of a header fits within the received packet data...

CVE-2026-96236

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2002-0200

CVE-2002-0200 Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name. External reference at https://marc.info/?l=bugtraq&m=101174569103289&w=2 Author Alex Hernandez aka @alt3kx...

CVE-2024-35106-POC

NEXTU FLETA Wifi6 Router DOS, Potential RCE POC This document describes how the exploit was carried out on the EZNET FLETA WiFI router through the CVE-2024-35106 vulnerability. Vulnerability information CVE ID CVE-2024-35106 Vendor of Product NEXTU Product FLATA AX1500 Wifi6 Router Version 1.0.3...

CVE-2026-92707

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...

CVE-2026-112259

A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application...

CVE-2026-107324

A flaw was found in the MongoDB Go Driver. An unauthenticated attacker can cause a Denial of Service DoS by supplying a malformed Binary JSON BSON document to an affected application. Due to an integer overflow during BSON value-length processing, validating or accessing the malformed input...