8976 matches found
PT-2026-102383
Name of the Vulnerable Software and Affected Versions FastStone Image Viewer versions prior to 8.4 Description A remote attack can trigger an out-of-bounds write, which occurs when data is written outside the intended memory boundary, within an unknown function of the 1bpp RLE Decoder component...
CVE-2026-100889: Off-by-one Error
A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkimqpdecode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor w...
PT-2026-102390
Name of the Vulnerable Software and Affected Versions FastStone Image Viewer versions prior to 8.4 Description A remote out-of-bounds read can be triggered within the PCX Decoder component. This occurs when the software processes a specially crafted file, allowing an attacker to read memory outsi...
Medium: ImageMagick
Issue Overview: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This...
CVE-2026-14266
CVE-2026-14266 — 7-Zip XZ 解码器堆缓冲区溢出 严重级别 | CVSS: 8.8（高危）| CWE-122：基于堆的缓冲区溢出 受影响版本：7-Zip ≤ 26.01 | 已修复版本：7-Zip 26.02（2026-06-25） 发现与分析：Li Yuxuan（liyuxuan504-byte）及其团队 执行摘要 7-Zip 版本 ≤ 26.01 的多线程 XZ 解码器路径 中存在堆缓冲区溢出漏洞。恶意构造的 .xz 压缩包可触发越过堆分配输出缓冲区的越界写入，从而导致： 拒绝服务（DoS） （已确认）——可稳定触发崩溃，错误码为...
CVE-2026-100889 Trusted Domain Project OpenDKIM Decoder util.c dkim_qp_decode off-by-one
A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkimqpdecode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor w...
CVE-2026-100889
A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkimqpdecode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor w...
CVE-2026-100889
A vulnerability exists in Trusted Domain Project OpenDKIM up to version 2.11.0 . The issue is caused by an off-by-one error in the dkim_qp_decode function within the util.c file of the Decoder component. This flaw can be triggered via a remote attack. While the documents confirm that an exploit i...
CVE-2026-100889 Trusted Domain Project OpenDKIM Decoder util.c dkim_qp_decode off-by-one
A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkimqpdecode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor w...
BruteRatel-DetectionTools
BruteRatel-DetectionTools 一个用于解码 Brute Ratel C4 badger 的工具和规则集合 所有工具和规则均基于 PaloAlto 在其报告 https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ 中识别的样本 Yara 规则 该 Yara 规则已针对 Unit42 报告中包含的样本以及由该规则识别出的其他样本进行了测试 ❯ yara rule.yar BruteRatel ./hacker.exe BruteRatel ./badgerx64.exe BruteRatel...
cve-2026-49975-http2bomb_reproduction
CVE-2026-49975 HTTP/2 Bomb Complete Reproduction Guide Based on QiAnXin CERT Advisory + Calif Original Research ================================================================ I. Vulnerability Overview CVE-2026-49975 is a critical denial-of-service DoS vulnerability in HTTP/2 server and proxy...
web3-decoder
Web3 Decoder Web3 Decoder 是一款 Burp Suite 扩展，用于分析区块链操作和智能合约交互。它处理针对以太坊及兼容网络（包括 Polygon、Arbitrum、BSC 等）的 JSON-RPC 调用。 区块浏览器 API 密钥 大多数受支持的区块浏览器（如 etherscan.io）都要求提供 API 密钥，以允许每 5 秒超过 1 次请求。 要添加您的 API 密钥，您有 2 种选择： 您可以通过修改 .apikeys.json 文件来添加 API 密钥 您可以添加与 APIKEYS.json 文件中同名的环境变量 例如：export...
CVE-2026-36834
摘要 在 src/decoders/pana8.cpp 中存在数组越界读取。当未找到 Huffman 表匹配时，函数 GetDBit 可能返回值 17，但 huffcoeff 仅声明了 17 个元素（有效索引为 0-16）。这会导致访问 huffcoeff17，触发未定义行为，已通过 UBSan 和 AddressSanitizer 确认。 影响 处理用户提供的 RW2 文件的应用程序（例如使用 LibRaw 的图像编辑器或照片管理工具）在打开恶意文件时，可能会崩溃或泄露进程内存。 CWE: CWE-125（越界读取），CWE-129（数组索引验证不当） CVSS v3.1:...
CVE-2026-100661
A flaw was found in Netty's HTTP/3 codec. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a specially crafted stream of data to the QPACK integer decoder. Because the decoder fails to limit incoming continuation bytes, data accumulates indefinitely in memory while...
[SECURITY] Fedora 44 Update: libheif-1.23.5-3.fc44
libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...
DEBIAN-CVE-2026-91765
cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...
CVE-2026-91765
cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...
UBUNTU-CVE-2026-91765
cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...
CVE-2026-91765
cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...
CVE-2026-91765
cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...