CVE-2026-40345

deepmerge-ts mergeleft.self, right.self - mergeleft.self, right.self - mergeleft.self, right.self - RangeError: Maximum call stack size exceeded 当 deepmergeInto、deepmergeCustom 和 deepmergeIntoCustom 收到同类图时，也会出现相同的行为。 本地复现 在 package.json 中，该包被固定到受影响的 7.1.6 版本。 root@kitploit: npm install npm run po...

libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...

CVE-2023-21971_Analysis

CVE-2023-21971 Connector/J RCE Analysis分析 参考 Remote Code Execution RCE in com.mysql:mysql-connector-j | CVE-2023-21971 | Snyk New Vulnerability in MySQL JDBC Driver: RCE and Unauthorized DB Access MYSQL JDBC反序列化解析 - 跳跳糖 tttang.com 漏洞概述 Oracle MySQL 的 MySQL Connectors...

CVE-2026-26449

A flaw was found in Stomper. A remote attacker can send a specially crafted message, specifically a SEND frame missing the destination header field, to the server. This action triggers a null pointer dereference, which is an attempt to access memory that does not exist, causing the server process...

CVE-2026-26448

A flaw was found in Stomper. A remote attacker can trigger a use-after-free vulnerability by sending multiple CONNECT frames on the same TCP connection, followed by SEND frames to a previously subscribed destination. This can cause the broker to dereference a freed memory region, leading to a hea...

CVE-2026-26447

A flaw was found in Stomper. An unauthenticated client can exploit a use-after-free vulnerability by repeatedly issuing SUBSCRIBE commands for the same destination over a single connection and then closing that connection. This leads to incorrect cleanup of internal subscription structures,...

CVE-2026-26445

A flaw was found in stomper. A remote attacker can exploit this by sending partial STOMP Streaming Text Oriented Messaging Protocol frames. This action can cause the broker's sockets to enter a permanent half-read state. Consequently, the broker stops processing new messages, leading to a Denial ...

ms08-067

📖 概述 本仓库包含 MS08-067 Windows 服务器服务漏洞（CVE-2008-4250）的 Metasploit 模块实现。这是一个影响旧版 Windows 系统的经典远程代码执行漏洞。 🛠️ 安装与使用 前提条件 Kali Linux 已安装 Metasploit Framework 经过授权的测试环境 🤔如何使用？ 首先，登录 Kali Linux。然后 👉 运行以下命令： root@kitploit: git clone https://github.com/BinRacer/ms08-067.git cd ms08-067 sudo cp -a...

CVE-2026-51684

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-80609

A flaw was found in the qede driver of the Linux kernel. An out-of-bounds read vulnerability exists due to an incorrect index check for cqe-lenlist before element access. This flaw could potentially allow an attacker to cause a denial of service or disclose sensitive information...

CVE-2026-80601

A flaw was found in the batman-adv Better Approach To Mobile Ad-hoc Networking - Advanced module of the Linux kernel. When the pskbmaypull function is called by batadvgetvid, it can reallocate the buffer, causing variables to point to a freed memory region. This use-after-free vulnerability could...

CVE-2026-80679

A flaw was found in the Linux kernel. Specifically, within the s390/dasd component, the dasdreleasespace function incorrectly checks a function pointer by using a logical AND operator instead of a logical OR operator. This error can lead to a NULL pointer dereference, which may cause a system cra...

CVE-2026-80669

A flaw was found in the Linux kernel. A local attacker with the ability to load BPF Berkeley Packet Filter LSM Linux Security Module programs could exploit a vulnerability in the xfrmdecodesession hook. This could lead to a system panic, resulting in a Denial of Service DoS...

CVE-2026-80640

A flaw was found in the Linux kernel's CXL subsystem firmware control cxl/fwctl. A buffer overflow vulnerability exists in the cxlctlgetsupportedfeatures function due to improper initialization of an array size. This could lead to a system crash, resulting in a denial of service DoS...

CVE-2026-80722

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. A remote attacker sending a specially crafted S1G TWT setup frame could cause the system to process an incomplete parameters block. This incomplete processing can lead to memory corruption or a system crash, resulting in a Denial of...

CVE-2026-80691

A flaw was found in the Linux kernel's SCSI target iblock module. A missing null pointer check in the iblockexecuteprout function, specifically for the ops-prclear callback during PREEMPT and RELEASE operations, allows unimplemented hooks to be called. This can lead to dereferencing a null functi...

CVE-2026-80656

A flaw was found in the Linux kernel's hfsplus filesystem. A local attacker could provide a specially crafted and corrupted HFS+ image. When attempting to mount this image, a malformed btree node size value could lead to the use of an uninitialized value within the kernel. This could result in a...

CVE-2026-80645

A flaw was found in the Linux kernel's rapidio/tsi721 component. This vulnerability arises from incorrect handling of a variable within a specific loop in the tsi721dbdpc function. If a particular item is not found, the system attempts to access invalid memory. This could allow a local attacker t...

nhi-zero-trust-bypass

项目：利用协议漏洞操纵非人类身份秘密并绕过零信任策略 截图 以下是演示的真实截图。更多信息请参阅 screenshots/README.md。 1. DNS 漏洞利用（BIND 崩溃） A. 发送漏洞利用数据包 Scapy 向 BIND 发送一个格式错误的 TSIG DNS 数据包（参见dnsexploit.py）。 B. 确认容器崩溃 docker ps -a 显示 BIND 容器在漏洞利用后已退出。 C. 崩溃日志证据 来自docker logs vulnerablebind 的相关断言失败和崩溃日志。...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...