CVE-2026-82439

CVE-2026-82439 affects the DRPC server in Apache Storm . The root cause is an unbounded memory leak: the DRPC server maintained a map from client-supplied function names to request queues, but no code path ever removed an entry. Since function names are unconstrained by registered topologies, an ...

CVE-2026-82441

Apache Storm Nimbus accepts unvalidated dependency_jars and dependency_artifacts key lists from topology submissions, leading to two distinct issues. First, during topology cleanup Nimbus deletes the listed keys under its own subject (bypassing the blobstore ACL check), so a submitter can delete ...

CVE-2026-82441 Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...

EUVD-2026-77481

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

CVE-2026-86348

CVE-2026-86348 affects the MS Calendar plugin for Mattermost (versions ≤11.9, 11.0.9, 11.4.8, 11.7.7, and 10.22.11.0). The plugin fails to recover from handler panics triggered by a post-action request containing an unexpected field type , allowing an authenticated user to crash the plugin proces...

CVE-2026-86348 MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

EUVD-2026-77480

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.8, 10.11.x = 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service CPU resource exhaustion via a crafted post containing deeply nested...

Security Bulletin: IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection (CVE-2026-13265)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the Managed File Transfer component of the IBM MQ REST API Vulnerability Details CVEID:CVE-2026-13265 DESCRIPTION: IBM MQ could allow an authenticated attacker with MFT publish authority to obtain sensitive information or...

jfrog-CVE-2023-25136-OpenSSH_Double-Free

CVE-2023-25136 概念验证 概述 这是 OpenSSH 9.1p1 双重释放漏洞 CVE-2023-25136 的 DoS 概念验证。 它将触发双重释放并导致 abort 崩溃。 如需全面了解，请查看随附的博客文章以获取详细信息。 依赖项 Python 3.6+ paramiko Python 库 用法 1. 确认 paramiko 已安装： root@kitploit: pip install paramiko 2. 将 VICTIMIP 更改为与你的易受攻击的 OpenSSH 服务器 IP 匹配。 3. 运行 PoC： root@kitploit: python...

ConceptronicIPCam_MultipleVulnerabilities

Conceptronic IP摄像头 0.61.X Web固件的多个漏洞 在Conceptronic IP摄像头中发现了CSRF和拒绝服务漏洞。 CVE| 描述 ---|--- CVE-2018-6407| 未认证的远程拒绝服务漏洞 CVE-2018-6408| CSRF允许更改管理员用户凭据或创建新用户 0. 引言...

CVE-2026-89090

A flaw was found in the event stream header decoder of the Amazon AWS SDK for Go v2. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted event stream response frame. This frame, containing a header value type outside the valid range, would cause an...

CVE-2026-68497

A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service DoS by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar fields from JSON strings,...

libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server

A flaw was found in libgit2. A fixed-size string comparison in the setdata function within transports/smartpkt.c does not adequately verify the size of a network packet buffer. A remote attacker, operating a malicious Git server, can send a specially crafted packet-line capability buffer. This ca...

Important: Red Hat Security Advisory: rust security update

An update for rust is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-90949

A flaw was found in GIMP's PSP Paint Shop Pro file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting...

CVE-2026-90938

LangBot's plugin runtime pip package langbotplugin through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 /plugin/ws whose authentication is gated on plugindebugkey, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose which...

CVE-2026-90928

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust serv...

CVE-2026-90713

A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/hf/mod.rs of the component tiktoken vocab File Handler. The manipulation results in denial of service. The attack is only possib...

cve-2025-29384-poc

Exploit de Prueba de Concepto CVE-2025-29384 Descripción general Este repositorio contiene un exploit de prueba de concepto PoC avanzado para CVE-2025-29384 , una vulnerabilidad crítica de desbordamiento de búfer basado en pila descubierta en el router Tenda AC9 que ejecuta la versión de firmware...

CVE-2022-22274_CVE-2023-0656

SonicWall NGFW CVE-2022-22274 & CVE-2023-0656 2022年3月24日，SonicWall发布了一份安全公告，内容如下： SonicOS 中通过 HTTP 请求触发的基于栈的缓冲区溢出漏洞，允许远程未认证攻击者造成拒绝服务（DoS），甚至可能在防火墙上实现代码执行。 注意：此漏洞仅影响“网页管理”接口，SonicOS SSLVPN 接口不受影响。 2023年3月2日，SonicWall 发布了另一份类似的安全公告： SonicOS 中存在的基于栈的缓冲区溢出漏洞允许远程未认证攻击者造成拒绝服务（DoS），可能导致受影响的防火墙崩溃。...