CVE-2026-107820

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcpserver.zig parses an unbounded Content-Length value in parseContentLength and uses it in unchecked usize addition in wsRecv before token...

CVE-2026-107635

A flaw was found in dislocker. An integer underflow vulnerability in metadata parsing functions can lead to a Denial of Service DoS by crashing the application. By providing a maliciously crafted BitLocker volume image with an invalid datum size, an attacker can trigger an out-of-bounds memory...

CVE-2026-106437

A flaw was found in mongo-c-driver. An attacker who can influence the buffer length supplied by an embedding application can trigger an integer underflow by passing an undersized value to the Binary JSON BSON buffer-reservation function. This issue leads to out-of-bounds memory reads and writes...

CVE-2026-106429

A flaw was found in libmongocrypt. An integer underflow in the Key Management Service KMS endpoint-parsing logic can cause a memory allocation failure when processing a malformed endpoint. An authenticated user can trigger this flaw by modifying a key document in the key vault collection or by...

CVE-2026-96396

The Affinity by Canva application for macOS before 3.3.1 October 2026 release did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could...

CVE-2026-98222

A flaw was found in the Linux kernel's encrypted keys subsystem. An integer overflow occurs during memory size calculations for key data, resulting in an undersized buffer allocation. A local user can exploit this issue by supplying crafted key data to trigger an out-of-bounds write to kernel...

CVE-2026-96396

The Affinity by Canva application for macOS before 3.3.1 October 2026 release did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could...

CVE-2026-96396

The Affinity by Canva application for macOS versions prior to 3.3.1 (October 2026 release) is vulnerable to an integer overflow leading to a heap-based buffer overflow . The flaw occurs because the application does not safely calculate the size of an image buffer when generating QuickLook thumbna...

EUVD-2026-95751

The Affinity by Canva application for macOS before 3.3.1 October 2026 release did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could...

CVE-2017-7529

Nginx整数溢出漏洞 CVE-2017-7529 漏洞信息 当使用nginx标准模块时，攻击者可以通过发送包含恶意构造 range 域的 header 请求，来获取响应中的缓存文件头部信息。在某些配置中，缓存文件头可能包含后端服务器的IP地址或其它敏感信息，从而导致信息泄露。 参考：【漏洞分析】Nginx range 过滤器整形溢出漏洞 CVE–2017–7529预警分析 漏洞影响 该漏洞影响所有 0.5.6 - 1.13.2版本内默认配置模块的Nginx只需要开启缓存攻击者即可发送恶意请求进行远程攻击造成信息泄露。...

CVE-2013-2729

Adobe Reader BMP/RLE 堆损坏 - CVE-2013-2729 Adobe Reader X 是由 Adobe Systems 开发的一款功能强大的软件解决方案，用于查看、创建、操作、打印和管理便携式文档格式（PDF）文件。自版本 10 起，它包含了保护模式（Protected Mode），这是一种类似于 Google Chrome 中的沙箱技术，可提高产品的整体安全性。 标题： Adobe Reader BMP/RLE 堆损坏 CVE 名称： CVE-2013-2729 永久链接：...

CVE-2026-106432

A flaw was found in the MongoDB PHP Driver. In non-default runtime configurations permitting multi-gigabyte values, the BSON Binary JSON encoder converts large string lengths without validation, triggering an integer wrap and subsequent heap-based buffer overflow when encoding strings near four...

CVE-2022-26809

CVE-2022-26809 此仓库仅针对该 CVE 进行简单研究，更详细的分析请参考此处。 更新:2022/05/19 此分析尚未完成.... 更新:2022/05/22 HuanGMz 的文章 和 corelight 博客 展示了真正的漏洞点： OSFCASSOCIATION::ProcessBindAckOrNak 此漏洞的触发方式与 CVE-2021-43893 类似——当向 lsass.exe 发送 ESFRPC 请求并携带 UNC 路径 时，受害方将尝试作为客户端 访问目标，从而在客户端 API 中触发整数溢出。 如果有更好的触发此漏洞的方法，欢迎提交 issue 或 pr ...

cve-2024-46483

CVE-2024-46483 - Xlight SFTP 服务器预认证堆溢出 受影响版本 32位和64位 Xlight 版本 = 3.9.4.2 影响 未认证的攻击者可访问 Xlight SFTP，从而实现代码执行或引发拒绝服务。 根本原因 SFTP 协议中通过线路发送的字符串前面带有四个字节的长度前缀。Xlight 用于从网络数据包读取这些字符串的函数，在验证长度和分配所需内存时存在整数溢出。通过构造字符串的四个字节长度，我们可以触发一次从攻击者控制的缓冲区向堆外进行的大规模 memmove（约4GB）。 该易受攻击的函数用于 SSH...

gosentry

gosentry gosentry is a security-focused fork of the Go toolchain, integrating numerous features for state-of-the-art fuzzing campaigns on Go codebases. If you were using go test -fuzz before, you should use gosentry as a replacement. It comes with various fuzzing improvements and bug detectors th...

kernel: nvmet-rdma: handle inline data with a nonzero offset

A flaw was found in the nvmet-rdma component of the Linux kernel. This vulnerability arises from incorrect handling of inline data with a non-zero offset, which can lead to an integer underflow. An attacker could exploit this to cause the system to read beyond its allocated memory, potentially...

CVE-2026-42980-POC

CVE-2026-42980 公开披露 本仓库包含 CVE-2026-42980 的公开披露材料，这是一个 Windows 内核 WMI 整数下溢漏洞，可在漏洞实验室构建中被利用以实现本地权限提升至 NT AUTHORITY\SYSTEM。 完整文章 英文文章 Artículo en español 仓库布局 public/ README.md README.es.md writeup-en.md writeup-es.md build.ps1 Makefile src/ cve202642980lpe.c helpers.c wmiguids.h assets/...

CVE-2026-66729-Out-of-Bounds-Read-in-facil.io-MIME-Parser-leads-to-Server-Crash

安全披露：facil.io MIME 解析器中的越界读取导致服务器崩溃 指定 CVE ID CVE-2026-66729 产品： facil.io 受影响版本： facil.io = 0.6.0（所有 0.6.x、所有 0.7.x、master）；该问题随 0.6.0 中新增的 MIME 解析器引入 组件： lib/facil/http/parsers/httpmimeparser.h CWE： CWE-191（整数下溢）、CWE-125（越界读取） CVSS v3.1： 7.5（AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H） 研究人员： Theodosis...

CVE-2026-19569 Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap

dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...

CVE-2026-19569

An integer overflow vulnerability exists in the Zephyr RTOS kernel's dynamic_object_create() function within kernel/userspace/userspace.c. The system fails to check for unsigned wrap-around when computing backing allocations for dynamically allocated kernel objects and thread stack elements. An u...