CVE-2026-26449

A flaw was found in Stomper. A remote attacker can send a specially crafted message, specifically a SEND frame missing the destination header field, to the server. This action triggers a null pointer dereference, which is an attempt to access memory that does not exist, causing the server process...

CVE-2026-26448

A flaw was found in Stomper. A remote attacker can trigger a use-after-free vulnerability by sending multiple CONNECT frames on the same TCP connection, followed by SEND frames to a previously subscribed destination. This can cause the broker to dereference a freed memory region, leading to a hea...

CVE-2026-26447

A flaw was found in Stomper. An unauthenticated client can exploit a use-after-free vulnerability by repeatedly issuing SUBSCRIBE commands for the same destination over a single connection and then closing that connection. This leads to incorrect cleanup of internal subscription structures,...

CVE-2026-26445

A flaw was found in stomper. A remote attacker can exploit this by sending partial STOMP Streaming Text Oriented Messaging Protocol frames. This action can cause the broker's sockets to enter a permanent half-read state. Consequently, the broker stops processing new messages, leading to a Denial ...

ms08-067

📖 概述 本仓库包含 MS08-067 Windows 服务器服务漏洞（CVE-2008-4250）的 Metasploit 模块实现。这是一个影响旧版 Windows 系统的经典远程代码执行漏洞。 🛠️ 安装与使用 前提条件 Kali Linux 已安装 Metasploit Framework 经过授权的测试环境 🤔如何使用？ 首先，登录 Kali Linux。然后 👉 运行以下命令： root@kitploit: git clone https://github.com/BinRacer/ms08-067.git cd ms08-067 sudo cp -a...

CVE-2026-51684

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-80609

A flaw was found in the qede driver of the Linux kernel. An out-of-bounds read vulnerability exists due to an incorrect index check for cqe-lenlist before element access. This flaw could potentially allow an attacker to cause a denial of service or disclose sensitive information...

CVE-2026-80601

A flaw was found in the batman-adv Better Approach To Mobile Ad-hoc Networking - Advanced module of the Linux kernel. When the pskbmaypull function is called by batadvgetvid, it can reallocate the buffer, causing variables to point to a freed memory region. This use-after-free vulnerability could...

CVE-2026-80679

A flaw was found in the Linux kernel. Specifically, within the s390/dasd component, the dasdreleasespace function incorrectly checks a function pointer by using a logical AND operator instead of a logical OR operator. This error can lead to a NULL pointer dereference, which may cause a system cra...

CVE-2026-80669

A flaw was found in the Linux kernel. A local attacker with the ability to load BPF Berkeley Packet Filter LSM Linux Security Module programs could exploit a vulnerability in the xfrmdecodesession hook. This could lead to a system panic, resulting in a Denial of Service DoS...

CVE-2026-80640

A flaw was found in the Linux kernel's CXL subsystem firmware control cxl/fwctl. A buffer overflow vulnerability exists in the cxlctlgetsupportedfeatures function due to improper initialization of an array size. This could lead to a system crash, resulting in a denial of service DoS...

CVE-2026-80722

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. A remote attacker sending a specially crafted S1G TWT setup frame could cause the system to process an incomplete parameters block. This incomplete processing can lead to memory corruption or a system crash, resulting in a Denial of...

CVE-2026-80691

A flaw was found in the Linux kernel's SCSI target iblock module. A missing null pointer check in the iblockexecuteprout function, specifically for the ops-prclear callback during PREEMPT and RELEASE operations, allows unimplemented hooks to be called. This can lead to dereferencing a null functi...

CVE-2026-80656

A flaw was found in the Linux kernel's hfsplus filesystem. A local attacker could provide a specially crafted and corrupted HFS+ image. When attempting to mount this image, a malformed btree node size value could lead to the use of an uninitialized value within the kernel. This could result in a...

CVE-2026-80645

A flaw was found in the Linux kernel's rapidio/tsi721 component. This vulnerability arises from incorrect handling of a variable within a specific loop in the tsi721dbdpc function. If a particular item is not found, the system attempts to access invalid memory. This could allow a local attacker t...

nhi-zero-trust-bypass

プロジェクト：プロトコル脆弱性を悪用してNHIシークレットを操作し、ゼロトラストポリシーをバイパスする スクリーンショット 以下はデモからの実際のスクリーンショットです。詳細は screenshots/README.md を参照してください。 1. DNSエクスプロイト（BINDクラッシュ） A. エクスプロイトパケット送信 Scapy が不正なTSIG DNSパケットをBINDに送信します dnsexploit.py 参照。 B. コンテナクラッシュ確認 docker ps -a はエクスプロイト後にBINDコンテナが終了したことを示しています。 C. クラッシュログの証拠...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...