CVE-2026-125220

FFmpeg through 9.0.2 contains a deadlock vulnerability in mimicdecodeframe in libavcodec/mimic.c that fails to report frame progress when initgetbits8 fails. Attackers can supply a crafted file with an oversized Mimic intra frame followed by inter frames to hang frame-threaded decoding indefinite...

CVE-2026-125220

FFmpeg versions through 9.0.2 are affected by a deadlock vulnerability in the mimic_decode_frame() function located in libavcodec/mimic.c. The root cause is a failure to report frame progress when init_get_bits8() fails. An attacker can trigger this by providing a crafted file containing an overs...

EUVD-2026-120309

FFmpeg through 9.0.2 contains a deadlock vulnerability in mimicdecodeframe in libavcodec/mimic.c that fails to report frame progress when initgetbits8 fails. Attackers can supply a crafted file with an oversized Mimic intra frame followed by inter frames to hang frame-threaded decoding indefinite...

uxss-poc

Universal Cross Site Scripting PoC This is a PoC for CVE-2015-0072 for sequentialy get the targeted websites cookies. Disclaimer This Proof of Concept is for educational purpose only. Please do not use it against any system without prior permission. You are responsible for yourself for what you d...

oregami

Oregami """ What is this register used for? Hmm.. I'll just rename it to veryuniquename, do a textual search, and find all references! Ok.. Waiting for the search to end.. any minute now.. Done! Now I just need to understand which of the search result is relevant to the current usage frame of the...

CVE-2026-53753-Crawl4AI-RCE

CVE-2026-53753 — Crawl4AI Unauthenticated Remote Code Execution AST Sandbox Escape Pre-authentication RCE in Crawl4AI.read — returning the command's output in-band in the JSON response. | ---|--- CVE| CVE-2026-53753 Advisory| GHSA-qxjp-w3pj-48m7 Affected| Crawl4AI Deep dive: see ANALYSIS.md for a...

rtl8812au

RTL8812AU/21AU and RTL8814AU linux driver with monitor mode and frame injection The master branch is based on https://github.com/ulli-kroll/rtl8821au branch v4.3.22-beta/rework. According to rtwversion.c the real driver version is 4.3.20. The branch v4.3.21 may be built for RTL8814AU or...

hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install $ pip install hsecscan Usage $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POST data' -x PROX...

cve-2023-44487

CVE-2023-44487 HTTP/2 Rapid Reset There are some examples in this repo which are not tested completely to analyse the impact, but I just wanted to perform the concept of this attack starting many streams and immediately sending RSTSTREAM frame to avoid reaching MAXCONCURRENTSTREAMS. H2SpaceX I us...

quickjack

Quickjack Quickjack is an intuitive, point-and-click tool for performing advanced and covert clickjacking and frame slicing attacks. Use the Quickjack tool directly at http://samy.pl/quickjack/quickjack.html by @SamyKamkar // [email protected] // http://samy.pl // Dec 22, 2014 Code available...

CVE2026-42926

CVE-2026-42926 NGINX HTTP/2 Frame Injection Lab A controlled cybersecurity lab for validating and comparing behavior related to CVE-2026-42926 , an HTTP/2 frame injection issue affecting specific NGINX versions when a vulnerable proxy configuration is used. This repository is intended for defensi...

http2-rst-stream-attacker

CVE-2023-44487 and http2-rst-stream-attacker CVE-2023-44487 CVE-2023-44487 is an exploit against the HTTP2 protocol itself. In HTTP2, requests for data are initiated by sending a HEADERS frame. After receiving this frame, a server will start processing your request, subsequently sending DATA fram...

lacuna-rs

lacuna-rs Ghost-frame call-stack spoofing + runtime indirect syscalls for Windows x64 — ported to Rust. Ported from LACUNA Chain lacunachain.c by Mohamed Alzhrani 0xmaz. lacuna-rs is a reusable Rust crate that provides the same primitives as the original C TTP, structured so it can be dropped int...

CVE-2026-124040 CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State

CivetWeb through 1.16, when built with USEHTTP2 and enablehttp2 on, contains a use-after-free vulnerability in handlehttp2 that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or pa...

CVE-2026-87045

A NULL pointer dereference exists in the Zephyr HTTP/2 server within subsys/net/lib/http/http_server_http2.c. The vulnerability occurs because handle_http_frame_header() unconditionally sets client->current_stream = NULL, but CONTINUATION frames do not re-bind the stream. This leads to a NULL ...

CVE-2026-87045 NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame

The HTTP/2 server in subsys/net/lib/http/httpserverhttp2.c clears the connection's stream binding at the start of every frame. handlehttpframeheader executed client-currentstream = NULL unconditionally, but a CONTINUATION frame does not open a new stream and enterhttpframecontinuationstate never...

CVE-2026-87045 NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame

The HTTP/2 server in subsys/net/lib/http/httpserverhttp2.c clears the connection's stream binding at the start of every frame. handlehttpframeheader executed client-currentstream = NULL unconditionally, but a CONTINUATION frame does not open a new stream and enterhttpframecontinuationstate never...

CVE-2026-122330

A flaw was found in c-blosc2. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a specially crafted compressed data frame containing zero chunk or block size values. When an application attempts to read a data slice from the malicious frame, an unhandled...

CVE-2026-103582

A flaw was found in Apache NMS ActiveMQ. The OpenWire protocol parsing component does not properly validate incoming frame sizes or verify that decoded length fields fit within the received frame. A malicious or compromised broker, or an attacker capable of modifying unencrypted network traffic,...

CVE-2026-119434 Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer

Improper Handling of Highly Compressed Data Data Amplification vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompressusingddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size...