CVE-2026-54632 SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

SIPSorcery is a WebRTC, SIP, and VoIP library for C and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while...

massh-enum

+----------------+ | massh-enum 1.0 | +----------------+ root@kitploit: OpenSSH 2.3 から 7.4 までの Mass Username Enumeration CVE-2018-15473 このスクリプトには Matthew Daley の Python スクリプト が含まれています ライセンス: GPLv3, 説明 OpenSSH バージョン 2.3 から 7.4 には、ユーザー名列挙の脆弱性があります。 攻撃者は、不正な形式のパケット（たとえば、切り詰められたパケット）を...

CVE-2018-15473

CVE-2018-15473 OpenSSH 7.7 - 用户名枚举 方法 攻击者可以使用畸形数据包（例如截断的数据包）尝试认证用户，并且： 如果用户无效（不存在），则 userauthpubkey 立即返回，服务器向攻击者发送 SSH2MSGUSERAUTHFAILURE； 如果用户有效（存在），则 sshpktgetu8 失败，服务器调用 fatal 并关闭与攻击者的连接。 用法 库的使用非常简单，只需几行代码即可 root@kitploit: python --port --userlist 受影响系统 Redhat Enterprise Linux 7 Redhat...

nhi-zero-trust-bypass

プロジェクト：プロトコル脆弱性を悪用してNHIシークレットを操作し、ゼロトラストポリシーをバイパスする スクリーンショット 以下はデモからの実際のスクリーンショットです。詳細は screenshots/README.md を参照してください。 1. DNSエクスプロイト（BINDクラッシュ） A. エクスプロイトパケット送信 Scapy が不正なTSIG DNSパケットをBINDに送信します dnsexploit.py 参照。 B. コンテナクラッシュ確認 docker ps -a はエクスプロイト後にBINDコンテナが終了したことを示しています。 C. クラッシュログの証拠...

openssl: QUIC server may trigger double free when processing INITIAL packet

A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID destination connection ID can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service...

CVE-2026-89606

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfsparsetag70packet subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed...

CVE-2020-0796

CVE-2020-0796 一个更简单的CVE-2020-0796 PoC和扫描器，因为它使用静态数据包。具有防止在公网IP上意外使用（不要那样做）的保护措施，以及一个用于触发崩溃的开关。仅需要原始Python 3！ 扫描模式： root@kitploit: python3 poc-and-scan.py 10.0.0.15 N 扫描+崩溃模式： root@kitploit: python3 poc-and-scan.py 10.0.0.15 Y 输出： root@kitploit: SMB v311 with LZNT1 detected. Sending malformed pack...

open-ssh-user-enumeration

OpenSSH ユーザー名列挙スクリプト CVE-2018-15473 このスクリプトは、OpenSSH 7.7（およびそれ以前）のユーザー名列挙の脆弱性（CVE-2018-15473）をチェックします。 不正な形式の認証パケットを送信し、SSHサーバーの応答を解釈して有効なユーザー名を特定します。 オリジナルコード: https://www.exploit-db.com/download/45233 更新内容 1. Python互換性 すべてのprint文をPython 3構文 print"..." に変換しました。 明確さと互換性のため、mapstr.strip,...

PT-2026-90322

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfs parse tag 70 packet subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixe...

CVE-2026-9621

A denial-of-service security issue exists within RSLinx® Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover...

CVE-2026-9621

Rockwell Automation RSLinx® Classic is affected by a denial-of-service vulnerability caused by improper handling of a malformed CIP packet . A network attacker can send a crafted CIP packet that crashes the RSLinx® Classic service, requiring a manual restart to recover. The issue is rated CVSS 4....

CVE-2026-9621 RSLinx Classic® - Multiple Vulnerabilities

A denial-of-service security issue exists within RSLinx® Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover...

CVE-2005-1794

creationtimestamp| type| source ---|---|--- 2026-08-27 16:00:03+00:00| seen| Telegram/tjdPFWmK8d3uOic7fBL4SWiO2RjxR5x57I46YuEU7JS4U 2026-08-28 00:00:36+00:00| seen| Telegram/tjdPFWmK8d3uOic7fBL4SWiO2RjxR5x57I46YuEU7JS4U...

openssl: QUIC server may trigger double free when processing INITIAL packet

A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID destination connection ID can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service...

ALPINE-CVE-2026-18798

Issue summary: QUIC server may double free QRX QUIC record layer RX object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence...

CVE-2026-18798

Issue summary: QUIC server may double free QRX QUIC record layer RX object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence...

CVE-2026-74704

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: drop WARNON1 for malformed packets in ACK filter The schcake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARNON1 which can...

CVE-2026-74704

CVE-2026-74704 affects the Linux kernel 's sch_cake qdisc ACK filter (net/sched). The parsing code contains a WARN_ON(1) that is triggered by a malformed IP header while locating the TCP header. The code already skips the offending packet, making the warning redundant. Depending on system configu...

SUSE CVE-2026-72351

In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE private flags can indicate that remote checksum offload metadata is present. The private flags field itself is accounted for by guehdrflagslen, but guehdrprivflagslen currently...

Linux Distros Unpatched Vulnerability : CVE-2026-74704

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schcake: drop WARNON1 for malformed packets in ACK filter The schcake ACK filter parses packets to find the TCP header and filter duplicated ACKs if...