CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

EUVD-2026-42312

Socket.IO: Engine.IO WebTransport SID DoS...

cve-2015-5477

BOND9 TKEY assert DoS CVE-2015-5477 的 PoC 此漏洞利用程序通过发送该漏洞利用代码来测试 BIND9 服务器是否存在漏洞，以观察其是否崩溃。 它是 C 代码，你可以像往常一样在 Unix/Window 上编译，例如： root@kitploit: gcc tkill.c -o tkill 它能在 IPv4 和 IPv6 上运行。 以下是对 localhost 运行时的效果。由于解析该名称会得到两个 IP 地址，因此它会尝试这两个地址。它首先查询“version”字符串，然后发送漏洞利用代码。当探测第二个地址时，version...

CVE-2026-71415

Kirby CMS (versions 5.0.0–5.5.2) contains a flaw in its REST API chunk upload handler (src/Api/Upload.php). The method Kirby\Api\Upload::process() failed to execute the relevant upload authorization preflight before processChunk() persisted chunk data. An authenticated user holding the access.pan...

EUVD-2026-68808

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

CVE-2026-71415 Kirby: File upload permissions are not checked during processing of chunk data

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process

A flaw was found in Libreswan. An unauthenticated remote attacker can send a specially crafted X.509 certificate payload during an IKEv1 or IKEv2 exchange. This flaw occurs when Libreswan is operating in FIPS Federal Information Processing Standards mode and processing a certificate with an inval...

Important: Red Hat Security Advisory: libreswan security update

An update for libreswan is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload

A flaw was found in Libreswan's implementation of IKEv2 authentication when processing signatures utilizing the RSASSA-PKCS1-v15 scheme. The RSAauthenticatehashsignaturepkcs115rsa function does not correctly validate the DER encoding of the ASN.1 digest. A remote, unauthenticated attacker could...

librenswan: IKEv2 Denial of Service via malformed fragmentation

A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets fragments containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check assertion failure. A remote, unauthenticated...

CVE-2026-14697

netipv6sendns in subsys/net/ip/ipv6nbr.c allocates a transmit netpkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pendingqueue is already non-empty an NS is already outstanding, the function appends the data packet and...

CVE-2025-50420

在 25.07.0 之前的 Poppler 版本中，其 pdfseparate 工具的 PDFDoc 处理逻辑存在一个漏洞：精心构造的 "/Annots" 字典自引用或相互引用，会导致 "PDFDoc::markAnnotations -- PDFDoc::markPageObjects -- PDFDoc::markObject -- PDFDoc::markDictionary" 中出现无限递归，因为循环检测使用的是字典指针地址，而每次 fetch 获取到的地址都不同。远程攻击者可以通过处理恶意 PDF 造成拒绝服务（应用程序挂起或崩溃）。 这里我构造了一个恶意...

CVE-2026-82623

A flaw was found in open62541. A remote attacker could exploit a use-after-free vulnerability in the UADataValuebackendcopyRange function within the History Backend component. This flaw could lead to a denial of service, making the affected system unavailable. Mitigation Update open62541 to versi...

CVE-2026-59310

CVE-2026-59310 More root@kitploit: echo '1 2026-08-14T12:00:00.000Z ../../../../../../opt/vmware/share/htdocs/configurev2/cve59310chkee57b163c432 research - - - CVE-2026-59310-ee57b163c432'|nc syslogserver 514 root@kitploit: GET /configurev2/cve59310chkee57b163c432-syslog.log HTTP/1.1...

glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses instead of =, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information...

glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

A flaw was found in GLib. A buffer over-read can occur in giochannelreadlinebackend in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes ...

glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime

A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the gdatetimegetymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the gdatetimeaddfull function is processed. This flaw can corrupt the date output and potentially cause logic errors...

glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

A flaw was found in GLib. A buffer over-read can occur in the gregexreplace function when used with the GREGEXRAW compile flag and case-change replacement escapes because the stringappend function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the stri...

glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundar...

Updated python-hpack packages fix a security vulnerability

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...