EUVD-2026-95814

Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots...

CVE-2026-108106 Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-104115 Stack buffer overflow in illumos reparsed nfs-basic plugin allows local users to crash the daemon

A stack-based buffer overflow in the illumos reparse point daemon reparsed allows a local user to crash the daemon. getfslocations in usr/src/cmd/fs.d/nfs/rpbasic/libnfsbasic.c, part of the nfs-basic reparse plugin, copies the host and path components of a reparse string into a fixed 1024-byte...

EUVD-2026-95804

A stack-based buffer overflow in the illumos reparse point daemon reparsed allows a local user to crash the daemon. getfslocations in usr/src/cmd/fs.d/nfs/rpbasic/libnfsbasic.c, part of the nfs-basic reparse plugin, copies the host and path components of a reparse string into a fixed 1024-byte...

EUVD-2026-95802

A NULL pointer dereference in the illumos Network Auto-Magic daemon nwamd allows a local user to crash the daemon. nwamddoorswitch in usr/src/cmd/cmd-inet/lib/nwamd/doorif.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's...

CVE-2026-104112 Missing release of passed file descriptors in illumos nscd allows local users to exhaust kernel memory

A missing release of resources in the illumos name service cache daemon nscd allows a local user to exhaust kernel memory. The nscd door server procedure, switcher in usr/src/cmd/nscd/nscdfrontend.c, does not close file descriptors that are passed with a door call but not used by the request, and...

DEBIAN-CVE-2026-108063

A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an attacker can trigger an unexpected application crash,...

CVE-2026-108063

A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an attacker can trigger an unexpected application crash,...

CVE-2026-104113 Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon

A double free in the IP management daemon ipmgmtd of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmthandler in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c frees the caller's credential with ucredfree...

EUVD-2026-95799

A double free in the IP management daemon ipmgmtd of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmthandler in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c frees the caller's credential with ucredfree...

CVE-2026-108105 Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request

Open5GS through 2.8.0 contains a reachable assertion vulnerability in mmegnhandlesgsncontextrequest that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can...

CVE-2026-108105

The Open5GS software (versions through 2.8.0 ) is vulnerable to a reachable assertion vulnerability within the mme_gn_handle_sgsn_context_request() function. A remote unauthenticated attacker can exploit this by sending malformed SGSN Address IEs via GTPv1-C traffic from a configured SGSN address...

CVE-2026-108105 Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request

Open5GS through 2.8.0 contains a reachable assertion vulnerability in mmegnhandlesgsncontextrequest that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can...

CVE-2026-108103 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsedroppeddltrafficthreshold that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 wi...

EUVD-2026-95391

Strawberry legacy graphql-ws retains naturally completed subscription slots...

GHSA-M952-2W3F-6R8H Strawberry legacy graphql-ws retains naturally completed subscription slots

Summary Strawberry's legacy graphql-ws subscription handler can retain task and subscription bookkeeping after a one-shot subscription has naturally sent its complete message. When the application configures maxsubscriptionsperconnection, the handler counts those completed operations in...

CVE-2022-43293

Exploits for CVE-2022-43293 To get a persistent Windows Denial of Service as shown in the POC above, simply run Exploit.bat and enter %windir%\system32\cng.sys when you're asked which file you want to overwrite. Here you can find my Arbitrary File Write\Overwrite Vulnerability report. Here you ca...

CVE-2017-6074-DOS

CVE-2017-6074 - DoS-Only Exploit Linux DCCP kernel panic This repository provides a modified version of the original CVE-2017-6074 exploit use-after-free in the Linux kernel DCCP subsystem, designed only to demonstrate Denial of Service DoS impact. An authenticated local user can trigger a kernel...

CVE-2026-108063 Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry

A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an attacker can trigger an unexpected application crash,...