BIT-PILLOW-2026-112390 Pillow: Infinite loop in MIC n_frames when the embedded TIFF

Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek resets TIFF frame state, so an embedded TIFF...

K000163890: Linux kernel vulnerabilities CVE-2026-46136 and CVE-2026-46138

Security Advisory Description CVE-2026-46136 In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix a potential clc buffer length underflow The buflen is used to limit the iterations for retrieving the country power setting and may underflow under certain...

ForceAdmin

💪 ForceAdmin 💪 ForceAdmin is a c payload builder, creating infinate UAC pop-ups until the user allows the program to be ran. The inputted commands are ran via powershell calling cmd.exe and should be using the batch syntax. This attack will force them to run as admin using the old fasioned...

cve-2026-23989-opencloud-lab

CVE-2026-23989 — OpenCloud / ownCloud Infinite Scale public-link scope bypass A self-contained, one-command lab that reproduces CVE-2026-23989 and proves it fixed, using the official upstream Docker images. A public share link that is supposed to grant access to one folder can be abused to read...

dsa

A Summary of Go's crypto/dsa Vulnerability CVE-2016-3959 Alex Mullins April 9, 2016 Introduction Recently, there was a bug discovered in the Digital Signature Algorithm DSA crypto library for the Go programming language. In this article we'll go over the details of the bug and how an attacker cou...

CVE-2024-44337

CVE-2024-44337 The package "github.com/gomarkdown/markdown" is a Go library for parsing Markdown text and rendering it as HTML. In pseudo-version 'v0.0.0-20240729232818-a2a9c4f' corresponding to commit 'a2a9c4f76ef5a5c32108e36f7c47f8d310322252' and earlier, there is a logic issue in the paragraph...

CVE-2019-13288-POC

CVE-2019-13288-POC xpdf/install/bin/pdftotext ./poc.pdf In Xpdf 4.01.01, the Parser::getObj function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646...

CVE-2026-24688

CVE-2026-24688 - pypdf - Circular Reference DoS Vulnerability This repo includes proof of concept code for triggering CVE-2026-24688. Summary Critical Denial of Service vulnerability in pypdf's outline bookmark parsing logic. When processing a PDF with circular outline references, the parser ente...

CVE-2023-46442_POC

CVE-2023-46442POC Environment: Java 8 POC for CVE-2023-46442, Denial of Service vulnerability found within Soot before 4.4.1 under Java 8 When retrieving the body of a maliciously crafted method, a very small size class file or method can cause huge resource consumption and loop forever until a...

CVE-2026-78844

Summary javadelight delight-nashorn-sandbox 0.5.5 suffers from Uncontrolled Resource Consumption. The sandbox enforces maxCPUTime limits by statically injecting interruption checks into JavaScript loops, but the sandbox fails to disable dynamic code evaluation. An attacker can use these functions...

SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:4891-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4891-1 advisory. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272130. - CVE-2026-78669:...

CVE-2022-0778

CVE-2022-0778 Contributors Jeong Junsoo @jeongjunsoo Summary The CVE-2022-0778 vulnerability affects the BNmodsqrt function in OpenSSL that computes the modular square root of a prime number. When this function processes a maliciously crafted certificate that is not based on a prime number, an...

CVE-2018-10546

CVE-2018-10546 A user can create specially crafted data that, when processed using a stream filter with 'convert.iconv.', will cause the target application to enter an infinite loop and consume excessive CPU resources CVE-2018-10546. The specific impact of these vulnerabilities depends on the...

CVE-2023-30226

CVE-2023-30226 Rizin is a reverse engineering framework forked from radare2, a flaw was discovered in its ELF parser code that would allow for a crafted file to perform a denial of service. This would prevent a user from being able to load the file into rizin but still hold no impact on the...

CVE-2026-35333

CVE-2026-35333 strongSwan RADIUS attribute-iterator pre-auth infinite loop / remote DoS. Description attributeenumerate in src/libradius/radiusmessage.c:247-271 accepts RADIUS attributes whose length byte is smaller than sizeofrattrt 2. For length == 0: data-len = next-length - sizeofrattrt...

cve-2026-24688

CVE-2026-24688 - pypdf - Circular Reference DoS Vulnerability This repo includes proof of concept code for triggering CVE-2026-24688. Summary Critical Denial of Service vulnerability in pypdf's outline bookmark parsing logic. When processing a PDF with circular outline references, the parser ente...

jfrog-CVE-2023-43786-libX11_DoS

CVE-2023-43786 Proof-of-Concept Overview This is a DoS Proof-of-Concept of libX11 Denial of Service vulnerability CVE-2023-43786. It will trigger the integer overflow and cause an infinite loop. The vulnerable versions are: libX11 1.8.6 and below and libXpm 3.5.16. For a comprehensive...

cve-2021-45046

Although log4j RCE CVE-2021-44228 was patched in 2.15, a new vulnerability, CVE-2021-45046 causing DoS, has been discovered. Below are the test results. Test Environment log4j-2.15.0 api , core JRE-1.8.0 jdk1.8.0151 Eclipse IDE Maven Project 1. Log4j RCE CVE-2021-44228 syntax test - Not Vuln 2...

CVE-2025-55184_Testing

CVE-2025-55184Testing Python script for testing CVE-2025-55184 CVE-2025-55184 – React Server Components DoS Scanner A safe, security validation script designed to detect CVE-2025-55184 , a denial-of-service DoS vulnerability affecting React Server Components RSC. This tool is intended strictly fo...

CVE-2025-46206

There is a denial of service vulnerability in MuPDF 1.25.6 and earlier versions. When an attacker runs the "mutool clean poc /dev/null" command, the program will fall into an infinite recursion between the stripoutlines and stripoutline functions in pdf-clean-file.c until the stack is exhausted...