EUVD-2026-74791

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashe...

CVE-2026-87795 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashe...

CVE-2026-87795

zstd-jni versions before 1.5.7-14 contain an out-of-bounds read vulnerability in the ZstdDictCompress constructor. The library fails to validate offset and length parameters, allowing an attacker to supply untrusted values that cause reads of native heap memory into the compression dictionary. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-87795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads...

cve-2021-44228-qingteng-patch

QingTeng log4j2-patch https://github.com/qingtengyun/cve-2021-44228-qingteng-patch Corrige el CVE-2021-44228 de log4j2, utilizando la API de Instrumentation proporcionada por la JVM para modificar el bytecode existente cargado en la JVM. Sin reiniciar el proceso de Java, modifica el método lookup...

Linux Distros Unpatched Vulnerability : CVE-2026-19204

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and...

CVE-2026-56740

A flaw was found in the JLine3 Telnet server remote-telnet module. An unauthenticated remote attacker can exploit this vulnerability by injecting an excessive number of environment variables through the Telnet NEW-ENVIRON option. This action causes the server to store numerous variable pairs,...

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

CVE-2026-19204

Eclipse Jetty is vulnerable in its WebSocket component when auto-fragmentation is enabled. A remote, unauthenticated client can send a WebSocket frame with an unknown opcode and a very large declared payload length. Because unknown opcodes bypass the normal maximum frame size handling and payload...

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

EUVD-2026-72335

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

PT-2026-86673

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

log4j-remediation-tools

log4j-remediation-tools 用于发现和复现 CVE-2021-44228 log4j2 漏洞的工具 工具 find-vulnerabilities: 启发式地判断正在运行的 JVM 是否易受攻击 confirm-vulnerabilities: 以 100% 准确率确定正在运行的 JVM 是否易受攻击 使用方法 这两种工具都扫描机器上所有正在运行的 JVM 进程，并生成一个 CSV 报告，列出哪些进程可能/已经易受攻击。 请查看对应的 README 文件： find-vulnerabilities/ 和 confirm-vulnerabilities/ 以获取使用详情...

graylog-cve-2024-24824-exploit

在 JVM 上利用任意类加载 本仓库包含我在演讲中展示的概念验证漏洞利用： 在 JVM 上利用任意类加载 如果你感兴趣，可以在这里观看：Youtube 该漏洞利用针对 CVE-2024-24824 （幻灯片中有一处小拼写错误），这是一个影响 Graylog 2.0.0 至 5.2.3 版本的任意类加载漏洞。 这项研究没有将任意类加载视为最终目标，而是通过分析可用的 JVM 类路径，探讨如何滥用该原语来发现并构建越来越强大的漏洞利用技术。 Overview 如果能够使用攻击者控制的数据实例化任意类，那么挑战就变成了： 我们到底能用它做什么？ 答案完全取决于目标应用程序类路径中存在哪些类。...

SerialKillerBypassGadgetCollection

SerialKiller: 绕过 Gadget 集合 描述 一系列可用于 JVM 反序列化 Gadget 链的绕过 Gadget，用于绕过“Look-Ahead ObjectInputStreams”防御性反序列化。 作为 RSA 2016 演讲“SerialKiller: Silently Pwning Your Java Endpoints”的一部分发布，演讲者为 Alvaro Muñoz @pwntester 和 Christian Schneider @cschneider4711。 有关绕过 gadget 技术的详细信息，请参见以下资源： “论文” “幻灯片” “OWASP...

CVE-2026-79675

A flaw was found in NLTK. When processing untrusted input for its per-call options parameter in the java function, NLTK fails to validate Java Virtual Machine JVM options. A remote attacker could exploit this by injecting dangerous JVM flags, such as -agentpath or -javaagent, to achieve arbitrary...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

GHSA-M4RF-3FR8-XWX3 NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Vulnerability The fix for CVE-2026-12841 CWE-88, JVM argument injection added validatejavaoptions to block dangerous JVM flags such as -agentlib, -agentpath, -javaagent, -Xrunjdwp, and @argfile references. However, the validation is only applied when setting global options via configjava. The jav...

EUVD-2026-65525

NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers incomplete fix of CVE-2026-12841...

CVE-2026-55673 PowSyBl: Command Injection in LocalCommandExecutor-s

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...