UBUNTU-CVE-2026-73071

Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, jsondecodeitem in src/json.c can retain a stale pointer after jsondecodestring invokes channelfill to refill and free the current buffer, causing the error path to read freed memory instead of reader-jsbuf +...

CVE-2026-71217

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

EUVD-2026-55990

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-71217 Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-71217

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-71217

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

PT-2026-70098

Name of the Vulnerable Software and Affected Versions iperf3 affected versions not specified Description A remote unauthenticated attacker can exploit a flaw in the JSON read function. The function accepts a message length controlled by the peer and allocates memory without an upper bound, which...

PT-2026-70097

Name of the Vulnerable Software and Affected Versions iperf3 affected versions not specified Description A flaw in the server's handling of control-channel JSON allows a remote attacker to cause a Denial of Service DoS. By sending crafted JSON containing oversized numeric parameters, specifically...

Linux Distros Unpatched Vulnerability : CVE-2026-71217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized numeric parameters, such as...

CVE-2026-11809

The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in zimplupdatehubprobe. The probe response from the UpdateHub server is copied into a heap buffer metadata that is correctly NUL-terminated, but a second buffer metadatacopy is...

PT-2026-80170

Name of the Vulnerable Software and Affected Versions Icinga 2 versions prior to 2.14.9 Icinga 2 versions prior to 2.15.4 Icinga 2 versions prior to 2.16.2 Description Parsing deeply nested JSON can exhaust the call stack because the nesting depth is not bounded. This issue is reachable by...

PT-2026-76461

Summary WebhookHandler.feed update deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Severity...

CVE-2026-70646: Uncontrolled Resource Consumption

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

Exploit for CVE-2026-16723

Disclaimer: This project is intended only for secure researc...

PT-2026-68953

Impact The internal island renderer endpoint / nuxt island/... decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated POST / nuxt island/ .json with a large JSON body for example 4.6 MB / 150k keys is fully read, destr-parsed, and run...

CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

Exploit for Improper Privilege Management in Apache Couchdb

🚀 CouchDB Exploit - CVE-2017-12635 & CVE-2017-12636 !Pytho...

Exploit for Improper Privilege Management in Apache Couchdb

🚀 CouchDB Exploit - CVE-2017-12635 & CVE-2017-12636 !Pytho...

CVE-2026-10848

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parserpcmsg subsys/net/lib/ocpp/ocppj.c using a hand-rolled helper, extractstringfield, that copied the message's uid and action fields with strncpyoutbuf, token + 1, outlen - 1 and then scanned the result with...

CVE-2026-10848 Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parserpcmsg subsys/net/lib/ocpp/ocppj.c using a hand-rolled helper, extractstringfield, that copied the message's uid and action fields with strncpyoutbuf, token + 1, outlen - 1 and then scanned the result with...