CVE-2026-110655 miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses...

POC_CVE-2024-36420

POCCVE-2024-36420 Local reproduction lab and nuclei template draft for CVE-2024-36420 affecting Flowise. Summary CVE-2024-36420 is an arbitrary file read in Flowise caused by unsanitized use of the fileName body parameter in: POST /api/v1/openai-assistants-file This lab was used to validate:...

ghostcat

Ghostcat - CVE-2020-1938 Exploit Read Tomcat files via AJP connector port 8009 Usage: python3 ghostcat.py file """ Save the script cat ghostcat.py 'PYEOF' AQUÍ VA EL CÓDIGO COMPLETO DE ARRIBA PYEOF Set permissions and run chmod +x ghostcat.py Read tomcat-users.xml Tomcat Manager credentials pytho...

CVE-2026-96615

A vulnerability in NGINX Gateway Fabric (versions 2.0.0 - 2.7.2 ) allows a namespaced authenticated attacker with access to a service account to impersonate an authenticated NGINX Agent gRPC connection. This occurs when the software is configured with the Gateway Custom Resource Definition (CRD) ...

CitrixBleed-2-CVE-2025-5777-PoC-

CitrixBleed 2 CVE-2025-5777 Ultimate Analysis An Out-of-Bounds Memory Read in NetScaler ADC / Gateway — A Comprehensive Guide from Root Cause to Offensive and Defensive Exercises poc usage: python3 poc.py https://gateway.example.com exp usage: python3 exp.py https://gateway.example.com admin...

AZL-108146 CVE-2026-98405 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

CVE-2026-98405

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

EUVD-2026-101246

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or...

CVE-2026-110618 SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or...

EUVD-2026-101239

REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or...

CVE-2026-110606

The libdxfrw library used in LibreCAD (versions through LC2.2.0 , which includes LibreCAD through 2.2.1.5 ) is vulnerable to a stack-based out-of-bounds read in the dwgReader18::readFileHeader() function. The root cause is the improper use of strlen on buffers that are not NUL-terminated . An att...

CVE-2026-110606 LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

CVE-2026-110606

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

EUVD-2026-101234

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

CVE-2026-110606 LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

CVE-2026-110598

The Libyal libpff library (through version 20260926) contains an integer underflow vulnerability within the libpff_record_entry_get_multi_value() function. This flaw allows an attacker to trigger heap out-of-bounds reads by providing non-monotonic multi-value offsets. Specifically, by crafting PS...

CVE-2026-110597

Tinyexr versions through 3.2.0 are vulnerable to a heap out-of-bounds read in the ParseEXRMultipartHeaderFromMemory() function. The root cause is a stale remaining-size value that allows a crafted multi-part EXR file to bypass ReadAttribute() bounds checks. This can result in an application crash...

CVE-2026-110598 Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

EUVD-2026-101226

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

CVE-2026-110597 Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...