CLEANSTART-2026-OJ74202 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the minio-operator package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

TencentOS Server 4: pcre2 (TSSA-2026:1052)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1052 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-102825

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTHREQUEST path reached from server::runstream in russh/src/server/encrypted.rs increments self.common.authattempts but never compares it with server::Config.maxauthattempts. An unauthenticated remote client can continue...

http2-rst-stream-attacker

CVE-2023-44487 and http2-rst-stream-attacker CVE-2023-44487 CVE-2023-44487 is an exploit against the HTTP2 protocol itself. In HTTP2, requests for data are initiated by sending a HEADERS frame. After receiving this frame, a server will start processing your request, subsequently sending DATA fram...

CVE-2020-1350

CVE-2020-1350 SigRED Workaround to mitigate the impact of the vulnerability by reducing the TCP Recieve Packet Size Maximum Limit on the DNS Server and restarting DNS...

CVE-2026-442_

CVE protobuf.js CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44294, CVE-2026-44295 - protobuf.js ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testin...

SUSE-SU-2026:4394-1 Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues...

CVE-2014-0195

XML-RPC WordPress Brute-Force Exploit Script This repository contains a Python-based proof of concept PoC for brute-forcing login credentials on WordPress instances vulnerable to CVE-2014-0195, where the XML-RPC system.multicall function can be exploited to attempt multiple login requests in a...

CVE-2024-25277

CVE-2024-25277 discovered on MW45APT02.0002 Resources and PoCs This repo serves as collection of scripts and PoCs gathered during analysis and discovery of CVE-2024-25277. You can read more about the finding on:...

CLEANSTART-2026-UC28835 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

CVE-2026-33818 affects multiple packages. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

PT-2026-102648

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description The OpenSSL QUIC server, when configured to skip address validation, incorrectly calculates the unvalidated credit limit. When processing a datagram containing multiple QUIC packets, the serv...

CVE-2022-46485

CVE-2022-46485 ngDoS - ngSurvey Notes: The "slider" question may also be vulnerable with a large integer instead of a string. It could not be confirmed in my local environment. Exploitation steps Open the survey page and find a text or comment field. Fill the survey normally. In the text or comme...

CVE-2020-35590

Exploit Information Exploit Title: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - Login Limit Bypass CVE: CVE-2020-35590 Date: 2020-06-09 Exploit Author: N4nj0 Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Version: 2.13.0 Tested on: WordPress 5.4.1, 5.4.2...

qiomem

Description Arbitrary physical memory read/write using Toshiba qiomem.sys from ring 3 only works upto 4GB physical addresses. Driver is distributed via Microsoft Update Catalog. Other variants. Not listed on Microsoft Vulnerable Driver List, no previous CVE alloted. first run acpi.exe to create t...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to multiple Node.js modules. Vulnerability Details CVEID:CVE-2026-77037 DESCRIPTION:...

zoneminder-1.29-1.30-rce-exploit

ZoneMinder 1.29/1.30 SQLi to RCE Exploit A ready-to-run Python exploit for ZoneMinder 1.29/1.30 that chains the unauthenticated SQL injection CVE-2016-10204 , EDB-41239 all the way to an interactive reverse shell. This is a weaponized/automated PoC for a known, patched CVE, not a new exploit. EDB...

cve-2026-8697

CVE-2026-8697: Login Rate Limit Bypass on TP-Link Archer C64 CVE-2026-8697 is a logic flaw in the TP-Link Archer C64's OS called TPOS in the debug message. It lets any unprivileged user connected to the router to bypass the web UI rate limit by using a residual SSH service. A simple Python script...

cve-2023-44487-POC

cve-2023-44487 - http/2 rapid reset attack by 7pirqte what is this poc for the http/2 rapid reset attack. basically you open a stream with HEADERS frame then immediatly send RSTSTREAM to cancel it. server does all the work setting up and tearing down streams while you just spam requests. the...

CVE-2021-3138

..| Discourse 2.7.0 - CVE-2021-3138 |.. Description : Rate limit Bypass which leads to 2FA Bypass Tested Version : 2.7.0 Attack Type: Remote Impact : 2FA Bypass Vendor of Product : https://www.discourse.org Additional Information : Discourse is discussion platform built for the next decade of the...

Stack overflow on deeply nested LaTeX input

The parser and layout engine in affected versions of latex-rust recurse once per level of nesting with no limit. Deeply nested input, such as \frac1…, braces, \sqrt…, \left, or superscripts nested hundreds or thousands of levels deep, exhausts the call stack. A stack overflow in Rust aborts the...