CVE-2026-107299

The msgpack5 library, a MessagePack v5 implementation for Node.js and browsers, is vulnerable in versions prior to 6.1.0 . The streaming decoder incorrectly treats the reserved MessagePack byte 0xc1 as incomplete input rather than invalid input. When this byte begins a stream, subsequent data rem...

EUVD-2026-95110

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...

CVE-2026-107299 msgpack5: Reserved byte can cause unbounded stream buffering

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that...

CVE-2026-21986-VirtualBox-DoS

CVE-2026-21986 - VirtualBox 共享文件夹内核内存耗尽（拒绝服务） 概述 本仓库包含 CVE-2026-21986 的概念验证和技术文档，该漏洞是 Oracle VM VirtualBox 中的一个拒绝服务漏洞。 该问题存在于共享文件夹驱动程序接口中，允许通过设备 IOCTL 接口重复触发内核内存分配。这可能导致非分页内核内存耗尽，进而造成虚拟机冻结。 该漏洞已被分配编号 CVE-2026-21986，CVSS 评分为 7.1，并已由 Oracle 修复。 受影响组件 VirtualBox 共享文件夹内核驱动程序接口 VBoxMiniRdr 影响...

CVE-2026-107294

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, webfetchtool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An...

CVE-2026-107294

The Pydantic AI Python agent framework is vulnerable to an unbounded memory exhaustion issue in versions 1.77.0 through 1.107.2 and 2.24.0 . The web_fetch_tool , WebFetch local fallback , and remote FileUrl media downloads (including ImageUrl , DocumentUrl , VideoUrl , and AudioUrl ) buffer the e...

CVE-2026-107294 Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, webfetchtool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An...

CVE-2026-107294 Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, webfetchtool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An...

EUVD-2026-95104

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, webfetchtool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An...

kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

A flaw was found in the Linux kernel's Virtual Extensible LAN VXLAN module. This vulnerability occurs because a cached IP header pointer is improperly reused after a Path Maximum Transmission Unit PMTU check. When the packet's head is modified during the PMTU check, the old cached IP header point...

kernel: nvme-tcp: fix host memory disclosure on R2T for a read command

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...

kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine for arm64 architectures. An issue in the reallocation of the nestedmmus array allows a process to access freed memory. This memory corruption vulnerability could enable a local attacker to escalate privileges or cause a denia...

kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

A flaw was found in the Linux kernel's netfilter connection tracking subsystem. The TCP option processing mechanism improperly assumes memory alignment when reading packet headers. A remote attacker could exploit this vulnerability by sending crafted TCP packets with misaligned SACK options throu...

kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

A flaw was found in the Linux kernel's tunnels module. This vulnerability occurs when the iptunnelpmtudcheckicmp function is called without the skb transport header being properly set. An attacker could exploit this condition to trigger an out-of-bound memory access, which may lead to system...

EUVD-2026-94533

Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS...

CVE-2021-46702

CVE-2021-46702 Descripción: Tor Browser 9.0.7 en Windows 10 build 10586 es vulnerable a la divulgación de información. Esto podría permitir a atacantes locales eludir la función de anonimato prevista y obtener información sobre los servicios onion visitados por un usuario local. Esto se puede...

CVE-2021-40449-NtGdiResetDC-UAF

CVE-2021-40449-NtGdiResetDC-UAF A POC for CVE-2021-40449. Only tested on 1809, the code is a bit rough, but it's a good experience for me. Instead of using the ThreadName method, user-space memory allocation is used...

CVE-2024-0070-NVIDIA-GPU-Driver--Resonance-Vulnerability

CVE-2024-0070-NVIDIA-GPU-Driver--Resonance-Vulnerability NVIDIA GPU 驱动程序在其内存管理中存在时间一致性缺陷。在 587 kHz 共振频率下，驱动程序的内存页出现 α 衰变干扰，从而允许从用户空间访问内核内存。 NVIDIA GPU α-共振利用 CVE-2024-0070 概述 此利用展示了 NVIDIA GPU 驱动程序中基于收敛时间理论（CTT）原理的时间一致性漏洞 。该漏洞源于 GPU 时钟频率是 587 kHz 的整数谐波 ，从而允许 α-共振绕过内存保护。 物理背景 NVIDIA GPU 时钟是...

CVE-2025-59287

Reproducción de la vulnerabilidad CVE-2025-59287 en WSUS CVE-2025-59287 — Inyección de WolfShell Wolverine memory shell directo Resumen CVE-2025-59287 aprovecha una falla lógica en los componentes relacionados con WSUS para inyectar un memory shell de WolfShell en el servidor objetivo. Cuando un...

CVE_2019_2215

CVE-2019-2215 - Escalada de privilegios local por UAF en Android Binder Un exploit reescrito de Prueba de Concepto / Escalada de Privilegios Local LPE que apunta a CVE-2019-2215 , una vulnerabilidad de uso después de liberación Use-After-Free en el controlador Android Binder. He proporcionado la...