CVE-2026-86138

A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the xmlDictAddQString function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its...

CVE-2023-21716-POC

Historia En febrero de 2023, Microsoft parcheó una vulnerabilidad crítica en Microsoft Word, identificada como CVE-2023-21716 con una puntuación CVSS de 9.8, que podría permitir a atacantes ejecutar código remoto sin autenticación. Esta vulnerabilidad también afectaba al Panel de Vista Previa de...

CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

CVE-2026-18355

A heap buffer overflow was found in the SASL I/O layer of 389 Directory Server (389-ds-base) . In sasl_io_start_packet(), the wrapped-record length is validated only against an upper bound; a small wire length (0, 1, or 2) causes an unsigned subtraction underflow in sasl_io_read_packet(), request...

EUVD-2026-72455

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

CVE-2026-18355

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

CVE-2026-18355

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

ripple20-digi-connect-exploit

Ripple20 Exploit: Digi Connect ME 9210 Authors: Moshe Kol, Shlomi Oberman This repository contains a PoC exploit for CVE-2020-11896, a critical heap-based buffer overflow vulnerability in the Track TCP/IP stack part of the Ripple20 vulnerability suite. The exploit achieves remote code execution R...

CVE-2026-42533-Config-Scanner

nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...

nginx-rift-scanner

nginx-rift-scanner Escáner Python 3 sin dependencias para CVE-2026-42945 "NGINX Rift" — un desbordamiento de búfer en montículo CWE-122 CRÍTICO 9.2 en CVSS v4.0 en ngxhttprewritemodule. Lo que detecta Se ejecutan dos comprobaciones independientes en cada invocación:...

CVE-2026-40369

🚨 CVE-2026-40369 - Windows Kernel Elevation of Privilege Vulnerability Windows Kernel Heap-Based Buffer Overflow allowing local attackers to elevate privileges toNT AUTHORITY\SYSTEM. 📖 Overview CVE-2026-40369 is a High Severity privilege escalation vulnerability affecting Microsoft Windows Kernel...

CVE-2019-18634

CVE-2019-18634 ⚠️ Este código solo ha sido probado en sudo 1.8.25. El bug afecta a versiones 1.8.30, pero existen diferencias en el manejo de caracteres que impiden que este PoC se ejecute esto no mitiga la explotabilidad del bug. Ver 1 ⚠️ Exploit funcional para CVE-2019-18634, un desbordamiento de...

CVE-2026-42945-nginx-rift-poc

NGINX Rift — CVE-2026-42945 Prueba de concepto de RCE para CVE-2026-42945 , un desbordamiento crítico de búfer en el montón heap en el ngxhttprewritemodule de NGINX introducido en 2008. Permite la ejecución remota de código no autenticada contra servidores que usan combinaciones de captura rewrit...

CVE-2026-42945

CVE-2026-42945 Nginx Rift - Kit de Prueba de Concepto PoC Un kit completo de prueba de concepto para CVE-2026-42945 Nginx Rift, una vulnerabilidad crítica de desbordamiento de búfer en el montón en el módulo ngxhttprewritemodule de Nginx. Resumen de la Vulnerabilidad Campo| Detalles ---|--- ID CV...

lab-cve-2023-4863

CVE-2023-4863 — libwebp 익스플로잇 연구소 완전히 격리되고 자동화된 Docker 환경에서 CVE-2023-4863libwebp의 힙 버퍼 오버플로을 재현합니다. CEFIRE의 윤리적 해킹 모듈 실습을 기반으로 합니다. 이 연구소가 하는 일 사설 네트워크에 8개의 컨테이너를 띄웁니다:...

Security update for libvirt

This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...

Security update for libvirt

This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...

Security update for libvirt

This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...

CVE-2023-21716-Analysis-ICT287

CVE-2023-21716 Análisis-ICT287: Ejecución Remota de Código en Microsoft Word Resumen Este repositorio documenta el análisis y la reproducción de CVE-2023-21716, una vulnerabilidad de desbordamiento de búfer basada en heap en el analizador RTF de Microsoft Word con una puntuación CVSS de 9.8...