GHSA-VCC3-GHJQ-M6FR decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

Impact An attacker who can supply input to decodeUriComponent directly or via a dependency that uses this package on URL/query/path data can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote...

Vehicle-Service-Management-System-User-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46073 漏洞标题：车辆服务管理系统 - '用户列表' 存储型跨站脚本（XSS） 漏洞作者：SANU P.L CVE：CVE-2021-46073 CVSS：4.8 中危 参考： https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-46073 https://vulners.com/cve/CVE-2021-46073 描述：...

Vehicle-Service-Management-System-Settings-Stored-Cross-Site-Scripting-XSS

CVE-2021-46074 漏洞标题: Vehicle Service Management System - 'Settings' 存储型跨站脚本 XSS 漏洞作者: SANU P.L CVE: CVE-2021-46074 CVSS: 4.8 中危 参考资料: https://www.plsanu.com/vehicle-service-management-system-settings-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-46074...

CVE-2025-54939

PoC for QUIC-LEAK CVE-2025-54939 in LSQUIC Overview This PoC highlights CVE-2025-54939, a pre-handshake memory exhaustion Denial of Service vulnerability in the LSQUIC QUIC implementation. The issue, named QUIC-LEAK, was first documented by Imperva:...

Vehicle-Service-Management-System-Service-Requests-Stored-Cross-Site-Scripting-XSS

CVE-2021-46070 漏洞标题：车辆服务管理系统 - “服务请求”存储型跨站脚本（XSS） 漏洞作者：SANU P.L CVE：CVE-2021-46070 CVSS：4.8 中危 参考链接： https://www.plsanu.com/vehicle-service-management-system-service-requests-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-46070 https://vulners.com/cve/CVE-2021-46070 描述：...

Vehicle-Service-Management-System-MyAccount-Stored-Cross-Site-Scripting-XSS

CVE-2021-46068 漏洞标题: Vehicle Service Management System - 'MyAccount' 存储型跨站脚本（XSS） 漏洞作者: SANU P.L CVE: CVE-2021-46068 CVSS: 4.8 中危 参考链接: https://www.plsanu.com/vehicle-service-management-system-myaccount-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-46068...

CVE-2026-82398

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82398 pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82398

pypdf , a pure-Python PDF library, is vulnerable to excessive resource consumption in the read_until_whitespace function within pypdf/_utils.py. When processing a crafted PDF containing a long sequence of non-whitespace bytes, the function performs immutable bytes concatenation in a one-byte loop...

CVE-2026-82398 pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

CVE-2026-82397

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

CVE-2026-82397

Tornado (Python web framework / async networking library), prior to 6.5.8 , parses application/x-www-form-urlencoded request bodies via urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. Because RequestHandler._execute parses the body before handler dispatch, an unauthenti...

CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

EUVD-2026-42312

Socket.IO: Engine.IO WebTransport SID DoS...

cve-2015-5477

BOND9 TKEY assert DoS CVE-2015-5477 的 PoC 此漏洞利用程序通过发送该漏洞利用代码来测试 BIND9 服务器是否存在漏洞，以观察其是否崩溃。 它是 C 代码，你可以像往常一样在 Unix/Window 上编译，例如： root@kitploit: gcc tkill.c -o tkill 它能在 IPv4 和 IPv6 上运行。 以下是对 localhost 运行时的效果。由于解析该名称会得到两个 IP 地址，因此它会尝试这两个地址。它首先查询“version”字符串，然后发送漏洞利用代码。当探测第二个地址时，version...

CVE-2026-71415

Kirby CMS (versions 5.0.0–5.5.2) contains a flaw in its REST API chunk upload handler (src/Api/Upload.php). The method Kirby\Api\Upload::process() failed to execute the relevant upload authorization preflight before processChunk() persisted chunk data. An authenticated user holding the access.pan...

EUVD-2026-68808

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

CVE-2026-71415 Kirby: File upload permissions are not checked during processing of chunk data

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process

A flaw was found in Libreswan. An unauthenticated remote attacker can send a specially crafted X.509 certificate payload during an IKEv1 or IKEv2 exchange. This flaw occurs when Libreswan is operating in FIPS Federal Information Processing Standards mode and processing a certificate with an inval...