CVE-2024-24549

Here’s a README.md for a Proof of Concept PoC demonstrating the Denial of Service DoS vulnerability in Apache Tomcat due to improper input validation of HTTP/2 requests: Proof of Concept PoC for Denial of Service DoS Vulnerability in Apache Tomcat This repository contains a Proof of Concept PoC...

CVE-2026-18649

CVE-2026-18649 - GStreamer rtph264depay Unbounded Memory Growth DoS Proof of concept for a resource exhaustion vulnerability in GStreamer's H.264 RTP depayloader rtph264depay. The same pattern also affects rtph265depay. What it is During H.264 FU-A fragmented RTP reassembly, each incoming fragmen...

CVE-2026-0897

CVE-2026-0897 — Google Keras: Denial of Service via HDF5 Shape Bomb in Weight Loading -orange?style=for-the-badge -brightgreen?style=for-the-badge Overview Field| Details ---|--- CVE ID| CVE-2026-0897 Package| keras Google Keras Registry| PyPI Affected Versions| 3.0.0 through 3.13.0 inclusive...

CVE-2026-67230

A flaw was found in RabbitMQ. When the Web STOMP plugin is enabled, the WebSocket handler fails to enforce maximum frame size limits or login timeouts prior to client authentication. An unauthenticated remote attacker can exploit this vulnerability by sending a continuous stream of small frames t...

CVE-2026-67227

A flaw was found in rabbitmq-server. An authenticated remote user with policymaker privileges can cause a Denial of Service DoS by sending repeated HTTP requests with unique parameter names to the global parameters API endpoint. Because user-supplied parameter names are unsafely converted into...

CVE-2026-66073

A flaw was found in rabbitmq-server. An authenticated user with management API access can cause a Denial of Service DoS by sending requests containing arbitrary node names to queue, exchange, or binding endpoints. Because untrusted input is converted into internal system identifiers atoms without...

poc-graphql

Table Of Content Table Of Content Research on GraphQL Objective Labs Deploying on Docker Security weaknesses Authorization Issue Reco Injection Issue Reco Resource exhaustion Issue Reco Exposure of private data Issue Reco Exposure of technical information in case of unexpected error Issue Reco...

CVE-2026-85977

A vulnerability exists in libtirpc where a remote attacker can trigger a Denial of Service (DoS) by sending specially crafted PMAPPROC_DUMP replies. The flaw occurs when a client application uses the pmap_getmaps() function against an attacker-controlled host, leading to unbounded decoding that c...

EUVD-2026-103020

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROCDUMP replies to a client application that uses the pmapgetmaps function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation,...

CVE-2026-85977

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROCDUMP replies to a client application that uses the pmapgetmaps function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation,...

CVE-2026-57487

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser-contentlength at zero while parserparsechunkyentity and parserparsechunkybody accumulate decode...

CVE-2026-57487

The pupnp SDK (prior to version 2.0.2 ) contains a vulnerability where chunked Transfer-Encoding in HTTP requests allows an attacker to bypass g_maxContentLength checks. The HTTP parser in upnp/src/genlib/net/http/httpparser.c fails to set the content_length correctly for chunked bodies, while pa...

CVE-2026-51788

Security Advisory: CVE-2026-51788 Denial of Service DoS Vulnerability in cleverangeauth v0.1.10 CVE ID: CVE-2026-51788 Status: Assigned Date Discovered: 2026-04-27 Researcher: Aykhan Isgandarli Severity: High CVSS v3.1: 7.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Produc...

WaSonar

Disclaimer : This tool is for educational purposes and security research only. The developers are not responsible for misuse. Please use responsibly and ethically. WaSonar is a powerful CLI tool designed for educational research, device tracking, and stress testing on the WhatsApp protocol. Built...

CVE-2026-111374

A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol RDP server to cause a Denial of Service DoS on a connecting client. When camera redirection is enabled, an attacker-controlled server can send stream requests with unadvertised or excessively large dimensio...

cve-2026-5950-bind9-resolver-dos

CVE-2026-5950 - BIND 9 Resolver DoS Research notes and defensive guidance for CVE-2026-5950, an unbounded resend loop vulnerability in the BIND 9 resolver state machine. Overview CVE-2026-5950 affects recursive BIND 9 resolvers. Under specific retry and bad-server handling conditions, a remote...

CVE-2026-111383

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

CVE-2026-111378

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parsenlamodepdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffe...

CVE-2026-111374

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigur...

EUVD-2026-102564

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...