poc-CVE-2025-38352

Exploit Details This repository only contains the proof-of-concept that triggers the vulnerability. I have since written a full exploit for this vulnerability. You can find the details in the link below. https://github.com/farazsth98/chronomaly Analysis Blog Posts Part 1 -...

CVE-2026-59171

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application...

CVE-2026-59171

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application...

CLEANSTART-2024-MX66530 Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures

Security vulnerability affects the go package. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures...

UBUNTU-CVE-2026-118694

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated 'a' or '!a' sequences, causing findbalanced to rescan the remaining document for each link...

CVE-2026-118694 python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated 'a' or '!a' sequences, causing findbalanced to rescan the remaining document for each link...

CVE-2026-118694 python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated 'a' or '!a' sequences, causing findbalanced to rescan the remaining document for each link...

CVE-2026-116587

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in brace-expansion

Summary SPSS Collaboration and Deployment Services is affected by vulnerabilities in brace-expansion. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-102276 DESCRIPTION: The brace-expansion library generates arbitrary strings containing a common prefix and...

Astra Linux – vulnerability in dovecot

An attacker can upload a malicious Sieve script to the ManageSieve service or locally to bypass the configured CPU time limits for Sieve by up to 130 times the set limit. This allows the attacker to degrade server performance and circumvent the imposed CPU time limits on Sieve scripts. One soluti...

CVE-2026-105760: Uncontrolled Resource Consumption

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level mediaiokwargs field to select the GLMGA video backend and supply large values for the fps and maxframes options without a strict work ceiling. GLMGA constructs and deduplicates a...

PT-2026-105530

Impact geopy.Point and Point.from string may take excessive CPU time when parsing long, malformed coordinate strings due to inefficient regular-expression behavior. The numeric Point constructor is not affected. Geocoders' reverse methods called with string inputs exercise the vulnerable path...

SUSE CVE-2026-98087

In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushabletasks and still...

SUSE CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

EUVD-2026-90360

basic-ftp: Quadratic-time CPU denial of service in Client.list Unix directory-listing parser RELINE backtracking...

Linux Distros Unpatched Vulnerability : CVE-2026-102990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a...

DEBIAN-CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

UBUNTU-CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...