CVE-2026-107392 music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...

CVE-2026-107392

The music-metadata library, a metadata parser for audio and video files, is vulnerable to an uncatchable process crash in versions prior to 11.15.0 . The DSF parser fails to await a promise or validate chunk sizes (specifically those smaller than 12 bytes) when handling unrecognized chunks. A cra...

CVE-2026-107392 music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...

EUVD-2026-95248

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...

EUVD-2026-95238

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available...

CVE-2026-107389

The music-metadata metadata parser for audio and video media files is vulnerable to memory exhaustion or process aborts in versions prior to 11.16.0 . The Matroska and WebM EBML parsers fail to validate that a decoded VINT element length fits within its parent or the available input before alloca...

CVE-2026-107389 music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available...

Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

Skrull

Skrull Skrull est un DRM pour malware, qui empêche la soumission automatique d'échantillons par les AV/EDR et le scan de signatures depuis le noyau. Il génère des lanceurs capables d'exécuter des malwares sur la victime en utilisant la technique Process Ghosting. De plus, les lanceurs sont...

CVE-2025-61303

CVE-2025-61303 - Triage de RecordedFuture : Déni d'analyse par bifurcation récursive de processus Description Le sandbox Windows 10 build 2004 et Windows 10 LTSC 2021 de Triage de RecordedFuture contient une vulnérabilité critique dans son moteur d'analyse comportementale Windows qui permet à un...

EUVD-2026-95152

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...

CVE-2026-106431

The MongoDB C Driver contains a one-byte heap buffer overflow in the BSON bulk document writer . An off-by-one error allows a zero byte to be written past a heap allocation when a document ends at a specific buffer boundary. This vulnerability can lead to process memory corruption or a process te...

One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...

CVE-2026-107703 @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

EUVD-2026-95145

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to childprocess.exec in ppt2png.js,...

PoolParty

PoolParty Коллекция полностью необнаруживаемых техник внедрения процессов, злоупотребляющих пулами потоков Windows. Представлено на брифингах Black Hat EU 2023 под названием - Вечеринка в пуле, которую вы никогда не забудете: новые техники внедрения процессов с использованием пулов потоков Window...

CVE-2026-1880

CVE-2026-1880 https://github.com/user-attachments/assets/2602558f-abd8-4773-9094-64c32501dfed ASUS DriverHub Update TOCTOU LPE Уязвимость TOCTOU в процессе обновления драйверов ASUS DriverHub, приводящая к повышению привилегий LPE Технические ресурсы Техническая презентация PDF 한국어.md | English.m...

KillChain

KillChain ?? Отказ от ответственности: Этот проект предназначен строго для образовательных целей и исследований в области безопасности. Автор не несёт ответственности за любое неправомерное использование, ущерб или незаконную деятельность, вызванную этим инструментом. Используйте только в...

Cohab_Processes

CohabProcesses Ce script Aggressor est conçu pour aider les équipes rouges internes à identifier les processus suspects ou étrangers « Cohabitation » exécutés dans leurs environnements. Les équipes rouges peuvent constituer une liste de processus « connus » indépendamment ou en collaboration avec...

EDRKiller

EDRKiller Use cve-2026-36425 killer edr，360 can killer Kills any antivirus processes, including but not limited to 360 Security and Huorong Security. I am exploiting a driver vulnerability for process manipulation, registering the driver via NT‑functions. No hiding is implemented. Compiled with...