OESA-2026-3820 compat-openssl11 security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than th...

CVE-2021-33959

CVE-2021-33959 It can be seen that Plex service listens to the four udp ports 32410, 32412, 32413 and 32414. Through the analysis of the attack payload and using the message format of the device query request for reference, we write software to send udp packets with the attack payload of M-SEARCH...

owt

Currently unstable will be updated eventually. Offensive Wifi Toolkit owt created by Brennan Mccown clu3bot This tool compiles some necessary tools for wifi auditing in a unix bash script with a user friendly interface. The goal of owt is to have the smallest file size possible while still...

ntpscanner

ntpscanner Scans NTP servers for CVE-2013-5211 NTP DDOS amplification vulnerability...

http2-bomb

HTTP/2 Bomb — CVE-2026-49975 HTTP/2 Stream Amplification PoC · Docker · Web Console Vulnerability HTTP/2 allows multiplexing multiple streams over a single TCP connection. This PoC crafts specially formed HEADERS frames containing a large number of internal references, forcing the server to...

certified-unlearning-neural-networks-icml-2025

Desaprendizaje certificado para redes neuronales Este repositorio contiene la implementación del artículo "Certified Unlearning for Neural Networks" ICML 2025. Métodos PABI Amplificación de privacidad por iteración : Gradient Clipping en el artículo DP-SGD : Con privacidad de grupo como se descri...

callstranger-detector

Paquete Zeek que detecta intentos de CallStranger CVE-2020-12695 http://callstranger.com/ Este paquete intenta detectar intentos de explotación y exfiltración de datos de CallStranger CVE-2020-12695. Lo hace buscando tres elementos clave: 1. Comandos UPnP SUBSCRIBE con una URL de Notify que...

dns_amplification_scanner

DNS Amplification DDoS Detection and Verification Tool This script is designed to identify and verify potential DNS servers vulnerable to exploitation in DNS amplification distributed denial-of-service DDoS attacks. It addresses the limitations of automated vulnerability scanners like Nessus, whi...

ipeeyoupeewepee

ipeeyoupeewepee 一个针对公网主机（主要是 Cisco 路由器）的扫描与攻击套件，这些主机转发未经认证的 IP-in-IP 和 GRE 协议封装的数据包。 此漏洞被称为“隧道协议的不安全实现”，编号为 CVE-2020-10136 和 CVE-2024-7595。它允许你从受影响的主机发送（但不能接收）任意 IP 数据包。 乍看之下，只能发送不能接收数据包似乎毫无用处。然而，许多受影响的主机位于未实施反向路径过滤的网络中。这意味着你可以利用这些漏洞，在没有缺乏源地址验证（通常称为 IP 头部修改或 IPHM）的主机的情况下，在公网上伪造 IP 地址，从而发起 DNS...

netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification

A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to...

CVE-2026-22007-NTP-monlist-Amplification-over-IPv6

CVE-2026-22007 – Amplificación de monlist de NTP sobre IPv6 Código del programa Python root@kitploit: ntpamplifysim.py - NTP server responding to monlist without authentication import socket, struct def ntpmonlistresponse: Simplified NTP reply with many entries return b'\x00' 1200 large response...

PYSEC-2026-3846 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...

HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

SummaryWhen decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respons...

CVE-2026-33033-PoC

PoC CVE-2026-33033 Denegación de servicio mediante amplificación de CPU por espacios en blanco en base64 enMultiPartParser de Django Una única solicitud HTTP de 2,5 MB puede mantener ocupado un worker de Django durante 5 segundos , logrando una amplificación de CPU de 2.100x en comparación con un...

CVE-2026-87011 Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/openwebui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout...

EUVD-2026-73741

Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability...

GHSA-8CP2-47HG-MFGH Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core IIS out-of-process hosting and request decompression. This advisory also provides...

Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core IIS out-of-process hosting and request decompression. This advisory also provides...

CVE-2026-86202

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste...

CVE-2026-86198

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...