BlackBerryC2

BlackBerryC2 2.0.0-beta BlackBerryC2 is an encrypted remote administration and C2 framework designed exclusively for educational use, security research, and controlled laboratory environments. The project demonstrates how to build a custom command-and-control server with application-layer...

EUVD-2026-71956

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining acces...

PT-2026-86395

Name of the Vulnerable Software and Affected Versions AutoAgent affected versions not specified Description An unauthenticated remote code execution issue exists in the TCP server that binds to all interfaces. This allows an attacker to connect to the exposed communication port and execute...

CVE-2023-38632

CVE-2023-38632 async-sockets-cpp 0.3.1 及之前版本在 tcpsocket.hpp 第 102-110 行的 static void ReceiveTCPSocket socket 中包含一个远程缓冲区溢出漏洞。该缓冲区溢出影响所有相应的 TCP 服务器。远程缓冲区溢出可通过连接到套接字并发送大量字节缓冲区来触发。 root@kitploit: while messageLength = recvsocket-sock, tempBuffer, BUFFERSIZE, 0 0 tempBuffermessageLength = '\0';...

CVE-2022-36234

Descripción de CVE-2022-36234 Se descubrió que la confirmación 29bc615f0d9910eb2f59aa8dff1f54f0e3af4496 del Servidor TCP SimpleNetwork contiene una vulnerabilidad de doble liberación double free que se explota mediante paquetes TCP manipulados. Provocar la doble liberación permitirá a los cliente...

CVE-2026-61666

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...

DEBIAN-CVE-2026-61666

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...

CVE-2026-61666

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...

CVE-2026-54465 websocket-driver: Memory exhaustion in HTTP header parser

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a TCP server using WebSocket::Driver.server or to complement a WebSocket client, a peer can make a single connection consume an unbounded...

PT-2026-60380

Name of the Vulnerable Software and Affected Versions websocket-driver versions prior to 0.8.1 Description When used to implement a WebSocket server on top of a TCP server via the WebSocket::Driver.server method or to complement a WebSocket client, the software is susceptible to memory exhaustion...

OESA-2026-2959 fluidsynth security update

FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use...

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms ex. Linux allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Jav...

PYSEC-2026-1428 Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms ex. Linux allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Jav...

EUVD-2026-36661

nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recvmsgheader function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length fiel...

PT-2026-49133

Name of the Vulnerable Software and Affected Versions nanoMODBUS versions prior to 1.23.1 Description The Modbus/TCP server contains an off-by-one buffer overflow in the recv msg header function. Remote unauthenticated attackers can exploit this by sending a crafted MBAP frame with the Length fie...

PT-2026-41947

Name of the Vulnerable Software and Affected Versions Motorola Factory Test affected versions not specified Description An improper authentication issue exists in the com.motorola.motocit component. The application contains a reference to a writable file descriptor in external storage. This allow...

EUVD-2026-29390

An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections...

CVE-2026-37552

CVE-2026-37552 . Affected: MixPHP Framework 2.x up to 2.2.17. Root cause: unsafe deserialization using Opis\Closure\unserialize() on data received by the sync-invoke TCP server, then executed via call_user_func(). No authentication/signature on the localhost TCP port (127.0.0.1). Impact: arbitrar...

CVE-2026-37552

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server Server.php:87 receives data from a TCP socket, passes it directly to Opis\Closure\unserialize, then executes the result via calluserfunc. No authentication or signature verification exists on the...

CVE-2026-37552

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server Server.php:87 receives data from a TCP socket, passes it directly to Opis\Closure\unserialize, then executes the result via calluserfunc. No authentication or signature verification exists on the...