CVE-2020-4463

IBM Maximo Asset Management is vulnerable to Information Disclosure via XXE Vulnerability CVE-2020-4463 IBM Maximo Asset Management is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive...

AirDroidPwner

AirDroidPwner CVE-2019-9599 This exploit is no longer functional Proof of Concept Video: https://www.youtube.com/watch?v=0QDM2246DM CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-9599 Exploit-db: https://www.exploit-db.com/exploits/46337 What is AirDroid? AirDroid is one of the best known and mos...

CVE-2021-32675

CVE-2021-32675 – Redis Pre-Allocation Denial of Service OOM This repository contains a functional exploit for CVE-2021-32675, a denial-of-service DoS vulnerability in Redis. The flaw allows unauthenticated remote attackers to trigger massive memory pre-allocations on the Redis server by sending...

CVE-2026-112892

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted Microsoft Paint MSP image file to an application that processes image pixels. Due to missing expansion limits during decompression, the run-length encoding RLE decoder expands image da...

CLEANSTART-2026-CX91057 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual...

CVE-2026-115391

A flaw was found in Wasmtime. A malicious guest can cause a Denial of Service DoS on the host by submitting excessively large data buffers to file or HTTP write streams within the WebAssembly System Interface WASI. Because incoming guest writes are buffered in host memory without size limits, thi...

ingress-nginx

Ingress NGINX Retirement Retiring What You Need to Know about Ingress NGINX Retirement: Best-effort maintenance will continue until March 2026. Afterward, there will be no further releases, no bugfixes, and no updates to resolve any security vulnerabilities that may be discovered. Existing...

CVE-2026-98710

A flaw was found in the Linux kernel's iwlegacy wireless driver. The driver fails to release memory allocated for device configuration data when a wireless network device is removed from the system. A local user could exploit this vulnerability by repeatedly triggering device disconnection or...

DEBIAN-CVE-2026-114136

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

DEBIAN-CVE-2026-113791

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0...

CVE-2026-75508

A flaw was found in graphql-core. The parser's token limit improperly tracks only non-comment tokens while continuing to allocate and retain memory for skipped comments. An unauthenticated remote attacker could exploit this vulnerability by submitting a specially crafted, comment-padded GraphQL...

CVE-2026-115391

Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causi...

EUVD-2026-108324

Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causi...

CVE-2026-115391

The Wasmtime runtime versions 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 are vulnerable to an uncontrolled resource allocation issue within the WASIp3 implementation. The root cause is that the host buffers guest-specified-length writes without any upper limit. A malicious guest can provide la...

CVE-2026-115391 Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams

Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causi...

CVE-2026-115388

The wasmtime-wasi-http component in Wasmtime versions before 36.0.16 , 37.0.0 before 48.0.3 , and 49.0.0 before 49.0.1 fails to enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies. This oversight allows oversized writes to succeed instead of trapping, enabling a mali...

EUVD-2026-108318

wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A malicious guest can pass large buffers to write on...

CVE-2026-114644

The MongoDB C# Driver's BSON library is vulnerable to an uncontrolled resource consumption weakness during the deserialization of a specific BSON value type. The root cause involves the library retaining data derived from untrusted content for the entire lifetime of the process without any accumu...

CVE-2026-114644 Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization

The MongoDB C Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no...

CVE-2026-21986-VirtualBox-DoS

CVE-2026-21986 - VirtualBox Shared Folders Kernel Memory Exhaustion DoS Overview This repository contains a proof of concept and technical write-up for CVE-2026-21986, a denial-of-service vulnerability in Oracle VM VirtualBox. The issue exists in the Shared Folders driver interface and allows...