CVE-2026-123614

imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted datasize value. Attackers can submit a crafted ICO image whose datasize wraps the allocation in vips/icoload.c, corrupting heap memory to...

CVE-2026-123614

The imgproxy software (versions 4.0.0 to 4.0.16) is vulnerable to a heap buffer overflow caused by an integer overflow within the ICO loader component. A remote attacker can trigger this vulnerability by submitting a specially crafted ICO image with a manipulated data_size value. This overflow oc...

EUVD-2026-119373

imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted datasize value. Attackers can submit a crafted ICO image whose datasize wraps the allocation in vips/icoload.c, corrupting heap memory to...

CVE-2026-123614: imgproxy: imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to…

imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted datasize value. Attackers can submit a crafted ICO image whose datasize wraps the allocation in vips/icoload.c, corrupting heap memory to...

PT-2026-139895

imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data size value. Attackers can submit a crafted ICO image whose data size wraps the allocation in vips/icoload.c, corrupting heap memory to...

nginx-rift-private-lab

NGINX Rift RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This fork extends the original PoC with an ASLR-bypass...

CVE-2025-50360

Heap Buffer Overflow in Pepper Language Pepper Language is a fast interpreted programming language for simplicity and verbosity. It is dynamically typed and supports garbage collection. Affected Version: Version 0.1.1 and before, Commit 961a5d9988c5986d563310275adad3fd181b2bb7 and before. Status:...

CVE-2026-40369

🚨 CVE-2026-40369 - Windows Kernel Elevation of Privilege Vulnerability Windows Kernel Heap-Based Buffer Overflow allowing local attackers to elevate privileges toNT AUTHORITY\SYSTEM. 📖 Overview CVE-2026-40369 is a High Severity privilege escalation vulnerability affecting Microsoft Windows Kernel...

CVE-2026-9256-Poc

nginx ngxhttprewritemodule Heap Buffer Overflow Description nginx Plus and nginx Open Source ngxhttprewritemodule contains a heap buffer overflow vulnerability. When a rewrite directive uses a regex with multiple overlapping PCRE capture groups e.g. ^/.$ and a replacement referencing multiple...

ai-vuln-rediscovery-nginx-cve-2026-42945

AI-Assisted Rediscovery of CVE-2026-42945 in nginx This repository documents a reproducible AI-assisted vulnerability rediscovery experiment against nginx ngxhttprewritemodule, later associated with CVE-2026-42945. The experiment is intentionally narrow. The vulnerable file,...

CVE-2026-42945

🛡️ CVE-2026-42945 - NGINX Rift Critical Heap-Based Buffer Overflow in NGINX 📌 Overview CVE-2026-42945 also known as NGINX Rift is a critical security vulnerability in the ngxhttprewritemodule of NGINX. Type : Heap-based Buffer Overflow CWE-122 Discovered : May 2026 Existed For : 18 years...

CVE-2026-9256-POC

CVE-2026-9256-POC CVE-2026-9256 Nginx heap buffer overflow POC...

ripple20-digi-connect-exploit

Ripple20 Exploit: Digi Connect ME 9210 Authors: Moshe Kol, Shlomi Oberman This repository contains a PoC exploit for CVE-2020-11896, a critical heap-based buffer overflow vulnerability in the Track TCP/IP stack part of the Ripple20 vulnerability suite. The exploit achieves remote code execution R...

CVE-2023-27997-check

CVE-2023-27997 Vulnerability Assessment Tool Safely detect whether a FortiGate SSL VPN instance is vulnerable to CVE-2023-27997 based on response timing. See the full write-up at the Bishop Fox blog, including a complete walkthrough of the methodology behind this tool. Description CVE-2023-27997 ...

CVE-2023-21716-Analysis-ICT287

CVE-2023-21716 Analysis-ICT287: Microsoft Word Remote Code Execution Overview This repository documents the analysis and reproduction of CVE-2023-21716, a heap-based buffer overflow vulnerability in Microsoft Word's RTF parser with a CVSS score of 9.8 Critical. What's Inside File| Description...

CVE-2026-42533-Config-Scanner

nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...

CVE-2026-120438

QuickJS-NG before 0.16.0 contains an integer overflow in jsproxygetownpropertynames in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potentia...

CVE-2026-120439

QuickJS-NG before 0.16.0 contains an integer overflow in jstypedarraysort in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the...

CVE-2026-76181

LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entri...

CVE-2026-121997

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to writ...