netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested PP2TYPESSL type-length-value TLV records. This can lead to a memory leak, causing the underlying cumulation...

Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers

In 2024, MCP Model Context Protocol set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol delivered. Thousands of developers built servers, and enterprises plugged them into agent workflows. The ecosystem around it fell short...

UBUNTU-CVE-2026-98257

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

CVE-2026-98257 rds: ib: use rds_conn_drop() on protocol version mismatch

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

CVE-2026-98257

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

Denial-of-service (DoS)

org.apache.qpid, qpid-broker-plugins-amqp-1-0-protocol is vulnerable to a Denial-of-service DoS. The vulnerability is due to improper handling of type size/count values, which allows a pre-authentication attacker to trigger excessive memory allocation...

ABrake27

ABrake27 Linux-nativer Cross-Compiler + PoC für die Aktivierung des iOS AMFI Developer Mode arm64/arm64e Forschungs-Toolkit. Vergleiche iOS 27.0.1 mit 27.2 Firmware, reverse-engineere die AMFI IOUserClient Dispatch-Tabelle, cross-compiliere einen Bare-Metal IOKit PoC von Linux — kein Xcode...

React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web

React2Shell CVE-2025-55182: Il bug di deserializzazione che ha rotto il Web ⚡ React2Shell, CVE-2025-55182, Vulnerabilità RCE: Un'analisi critica del difetto di deserializzazione non sicura nei React Server Components che consente l'esecuzione di codice remoto non autenticata su installazioni...

react2shell-CVE-2025-55182-full-rce-script

Next.js React2Shell CVE-2025-55182 Exploit-Tool Ein Proof-of-Concept-Tool zur Demonstration der kritischen React2Shell-Sicherheitslücke CVE-2025-55182 / CVE-2025-66478 ausschließlich in autorisierten, lokalen Testumgebungen. ⚠️ KRITISCHE WARNUNG: AKTIVE AUSNUTZUNG Diese Sicherheitslücke CVSS 10.0...

React2Shell-PoC-CVE-2025-55182

Exploit-Simulation von React2Shell CVE-2025-55182 Hinweis: Dieses Dokument dient ausschließlich Lern- und Sicherheitsforschungszwecken. Nicht für Angriffe auf Systeme ohne entsprechende Genehmigung verwenden. 1. Übersicht CVE-2025-55182, auch als React2Shell bekannt, ist eine kritische...

CVE-1999-0524-ICMP-Timestamp-and-Address-Mask-Request-Exploit

CVE-1999-0524 - Exploit für ICMP-Timestamp- und Adressmasken-Anfragen Beschreibung Dieses Tool wurde entwickelt, um CVE-1999-0524 auszunutzen, eine Schwachstelle im ICMP-Protokoll, die es beliebigen Hosts ermöglicht, ICMP-Timestamp- und Adressmasken-Anfragen an ein Zielsystem zu senden. Dies kann...

React2Shell

Docker-Lab & Erkennungsscanner & PoC-Validierung: React2Shell CVE-2025-55182 Haftungsausschluss: Dieses Repository und seine PoC-Artefakte dienen ausschließlich Bildungs-, Forschungs- und defensiven Sicherheitsdemonstrationszwecken in einer isolierten Laborumgebung. Nicht autorisierte Tests an...

ActiveMQ-CVE-2023-46604

CVE-2023-46604 ActiveMQ Safe Validator Ein einziges, nicht-destruktives Validator-Tool für Apache ActiveMQ CVE-2023-46604. Es startet einen eigenen HTTP-Callback-Server, generiert zielspezifisches Spring-XML im Speicher, sendet das präparierte OpenWire-Paket, korreliert Callbacks mit eindeutigen...

CVE-2024-21412_Water-Hydra

CVE-2024-21412Water-Hydra Distribuire malware tramite CVE-2024-21412 Utilizzo Avviare i servizi in sequenza e accedere al web server webserver Avviare il web server nella cartella: python -m http.server Accesso iniziale: Utilizzare la sintassi di query avanzata di Windows AQS per collegarsi al...

PT-2026-106586

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the Reliable Datagram Sockets RDS implementation for InfiniBand ib. The function rds ib cm connect complete operates within the RDMA-CM event handler while holding t...

Rockwell Automation Allen-Bradley Stratix 5950 Resource Management Errors (CVE-2018-0240)

Multiple vulnerabilities in the Application Layer Protocol Inspection feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of servi...

Linux Distros Unpatched Vulnerability : CVE-2026-98257

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA- CM event handler with conn-ccmlock held. When the peer negotiat...

Cisco ASA Improper Input Validation (CVE-2026-20020)

A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. If OSPF authentication is enabled, the attacker must know th...

CVE-2026-105741

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass th...

PoC-CVE-2022-30190

POC CVE-2022-30190 : CVE 0-Day MS Office RCE auch bekannt als msdt follina Info : Neue Microsoft-Office-Zero-Day-Schwachstelle in Angriffen zur Ausführung von PowerShell genutzt Zusammenfassung Am 29. Mai 2022 entdeckte das NaoSec-Team, ein unabhängiges Cybersicherheits-Forschungsteam, ein...