CVE-2026-23918-Apache-H2-PoC

CVE-2026-23918-Apache-H2-PoC This is a proof-of-concept exploit for the double-free vulnerability in Apache's modhttp2 CVE-2026-23918. It's a nasty bug that hits the h2mplx.c stream cleanup path. Basically, if you time it right, you can get the server to try and clean up the same stream twice,...

CVE-2026-42536-PoC

CVE-2026-42536: Apache HTTP Server modxml2enc Heap Overflow PoC This PoC code is part of the blog post at https://erberkan.github.io/2026/PatchDiffingandN-DayDefense/ . This repository contains a controlled proof of concept for CVE-2026-42536, a heap-based out-of-bounds write in Apache HTTP...

CVE-2021-23017-POC

CVE-2021-23017-POC A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. The issue only affects nginx if the "resolver"...

CVE-2026-42945

CVE-2026-42945 PoC Go 中文 | English A detection and exploitation helper for nginx HTTP/2 CVE-2026-42945. Use it only in authorized environments to verify vulnerability presence, compare patched vs. vulnerable behavior, and reproduce PoC logic in a controlled lab. Affected versions heuristic: nginx...

NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256

CVE-2026-9256 NGINX ngxhttprewritemodule PoC Derivation Process and Thoughts Scope: Only for local ranges, authorized reproduction environments, vulnerability verification, and protection rule analysis. Do not use against unauthorized targets. The PoC ideas in this document only verify remotely...

Exploit for CVE-2026-109619

CVE-2026-109619 Cross-request use-after-free in PHP's se...

fix_nginx_cve_2026_42945

NGINX CVE-2026-42945 One-Click Fix Script Automatically detect OS distribution, upgrade NGINX to the fixed version ≥1.30.1, backup configuration, and auto-rollback. Vulnerability Description Vulnerability ID: CVE-2026-42945 Vulnerability Name: NGINX Rift When NGINX processes specific rewrite...

CVE-2021-26690---Apache-mod_session

Patch diffing for CVE-2021-26690 - Apache modsession This vulnerability is a NULL pointer dereference within the modsession Apache's module. It will cause a denial of service for the child processes of Apache's httpd. By using a repetitive loop, each Apache workers will crash, leading to a denial...

CVE-2026-97205

A flaw was found in NGINX. In certain configurations using asynchronous file I/O and SSI pages with include virtual commands, request processing can access freed memory in a worker process. A remote attacker may trigger memory corruption or a worker crash. Arbitrary code execution may be possible...

nginx: NGINX ngx_http_core_module vulnerability

A flaw was found in NGINX. In certain configurations using asynchronous file I/O and SSI pages with include virtual commands, request processing can access freed memory in a worker process. A remote attacker may trigger memory corruption or a worker crash. Arbitrary code execution may be possible...

CVE-2026-107294

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, webfetchtool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An...

Astra Linux – Vulnerability in Samba

A Type Confusion vulnerability was discovered in Samba’s mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary, where the keys are character strings, and the values can be any of the supported types in the mdssvc...

CVE-2026-100651

A flaw was found in vLLM. The service fails to properly enforce length limits on input prompts when handling certain multimodal inference requests. A remote attacker with access to the inference service could exploit this vulnerability by submitting an excessively long prompt, causing an internal...

CVE-2026-48521 Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transportsocketoptions while selecting an HTTP/3 connection pool without first checking whether the...

EUVD-2026-84109

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transportsocketoptions while selecting an HTTP/3 connection pool without first checking whether the...

CVE-2026-48521 Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transportsocketoptions while selecting an HTTP/3 connection pool without first checking whether the...

CVE-2026-48521

Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contain a null pointer dereference (CWE-476) in ProdClusterManagerFactory::allocateConnPool during HTTP/3 connection pool selection. When auto_config and HTTP/3 are enabled, certain LoadBalancerContext implementations used by synthetic, ...

SUSE CVE-2026-57173

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the inputaudio handling path for /v1/chat/completions calls AudioMediaIO.loadbytes or AudioMediaIO.loadfile without passing VLLMMAXAUDIODECODEDURATIONS to the shared audio decoder. An unauthenticated client can...

CVE-2026-57173

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the inputaudio handling path for /v1/chat/completions calls AudioMediaIO.loadbytes or AudioMediaIO.loadfile without passing VLLMMAXAUDIODECODEDURATIONS to the shared audio decoder. An unauthenticated client can...

CVE-2026-57173

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the inputaudio handling path for /v1/chat/completions calls AudioMediaIO.loadbytes or AudioMediaIO.loadfile without passing VLLMMAXAUDIODECODEDURATIONS to the shared audio decoder. An unauthenticated client can...