Linux Distros Unpatched Vulnerability : CVE-2026-80903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe/oa: Fix sync entry leak on OA config emit failure xeoaemitoaconfig releases the sync entries and the syncs array only on its success path. When it fails...

Linux Distros Unpatched Vulnerability : CVE-2026-80811

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept...

PT-2026-86787

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-86421

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper...

citrix_bleed_2

Citrix Bleed 2 PoC 扫描器 CVE-2025-5777 此脚本是针对假设性漏洞“Citrix Bleed 2”CVE-2025-5777的概念验证PoC扫描器。它旨在通过发送超大型请求并分析响应中是否包含敏感信息，来检测 Citrix ADC 设备潜在的内存泄漏。 功能 多种测试方法 ：支持 oversized-headers、oversized-body 和 randomized 测试方法。 差异分析 ：将测试响应与基线进行对比，以识别泄露的数据。 高置信度令牌提取 ：使用正则表达式和熵分析来查找潜在的令牌（例如会话 cookie、JWT）。 多种导出格式...

Linux-Kernel-local-DoS

Linux-Kernel-local-DoS 基于无特权用户的内存泄漏（memleak）的本地 Linux 内核 DoS，只需首先执行 PRTIMERCREATERESTOREIDSON prctl 操作，依据 https://x.com/spendergrsec/status/1990887509664928062...

CVE-2025-50422

Poppler 25.04.0 版本之前 当 pdftocairo 渲染恶意 PDF 并在退出时调用 cairodebugresetstaticdata 时，包含 PDF 对象流的堆内存未被正确清除。具有本地访问权限的攻击者可以转储进程内存并恢复明文 PDF 内容（例如 /stream /endstream 块）。 具体的漏洞复现过程（漏洞原因.pdf）和 POC 文件（poppler-pdftocairo-poc）已附上。 供应商（freedesktop，Poppler 的维护者）已确认此问题并修复了该漏洞。修复程序已提交到其官方代码库。 以下是供应商提供的补丁/提交的公开链接：...

MongoBLEED---CVE-2025-14847-POC-

MongoBLEED---CVE-2025-14847-POC- 此仓库包含我的 CVE-2025-14847 MongoBleed 的 Python 脚本版本。 描述 该脚本通过发送伪造的解压缩大小字段来模拟恶意请求。如果服务器存在漏洞，它将返回堆内存中的相邻数据。 前提条件 Python 3.x 能够通过网络访问目标主机的 27017 端口。 使用方法 编辑脚本顶部的 HOST、PORT 和 SIZE 变量，或通过命令行执行（如果已实现）。 在您的 IDE 中运行脚本 此脚本是一个概念验证（PoC），用于通过 OPCOMPRESSED 数据包诊断 MongoDB 实例中的堆内存泄漏漏...

HeartbleedAttack

Heartbleed 攻击：基于 Java 的攻击演示 概述 本仓库包含 Heartbleed.java，这是一个基于 Java 的自定义漏洞利用程序，旨在通过从运行 Apache（端口 443）和 Postfix（端口 465）的易受攻击服务器（IP：192.168.1.132）中提取敏感数据，来演示 Heartbleed 漏洞（CVE-2014-0160）。该漏洞利用程序发送畸形的 TLS 心跳请求，利用未修补的 OpenSSL 版本（1.0.1 至 1.0.1f）中的漏洞，每次请求最多可泄漏 64KB 内存。配套的 Bash 脚本（apachememload.sh 和...

CVE-2026-36834

概要 src/decoders/pana8.cpp に範囲外配列読み取りが存在します。関数 GetDBit は、ハフマンテーブルに一致するものが見つからない場合に値 17 を返す可能性がありますが、huffcoeff は 17 個の要素（有効なインデックス 0～16）で宣言されています。その結果、huffcoeff17 にアクセスし、UBSan および AddressSanitizer によって確認された未定義動作を引き起こします。 影響 ユーザーから提供された RW2 ファイルを処理するアプリケーション（画像エディタや LibRaw...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053436)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053436 advisory. In the Linux kernel, the following vulnerability has been resolved: cifs: fix small mempool leak in SMB2negotiate In some cases of failure dialect mismatches in...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053242)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053242 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssxdecoptionarray The creds and oa-data need to be freed in the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053432)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053432 advisory. In the Linux kernel, the following vulnerability has been resolved: be2net: fix potential memory leak in bexmit The bexmit returns NETDEVTXOK without freeing skb in...

CVE-2025-14847

mongoExploit CVE-2025-14847 mongoExploit 是一个针对 CVE-2025-14847 的概念验证（PoC）利用工具，该漏洞是 MongoDB 中的一个内存泄漏漏洞。 该工具利用 zlib 解压缩中的缺陷，通过 BSON 字段名泄漏服务器内存。通过构造一个包含膨胀文档长度的 BSON 负载，它会强制服务器从泄漏的内存中读取字段名，直到遇到空字节为止。 ⚠️ 免责声明 此工具仅用于教育和授权的安全测试目的。 作者不对该工具的任何滥用行为负责。请勿对未经明确授权的系统使用此工具。 功能特性 扫描一段偏移范围以泄漏内存片段。 将泄漏的数据保存为二进制文件。...

AZL-99735 CVE-2026-18313 affecting package libpcap for versions less than 1.10.7-1

rpcapd can allocate up to 65536 bytes per each RPCAPMSGUPDATEFILTERREQ or RPCAPMSGSTARTCAPREQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster...

CVE-2026-18313

rpcapd can allocate up to 65536 bytes per each RPCAPMSGUPDATEFILTERREQ or RPCAPMSGSTARTCAPREQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster...

EUVD-2026-72020

rpcapd can allocate up to 65536 bytes per each RPCAPMSGUPDATEFILTERREQ or RPCAPMSGSTARTCAPREQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster...

CVE-2026-18313 rpcapd memory leak in libpcap before 1.10.7

rpcapd can allocate up to 65536 bytes per each RPCAPMSGUPDATEFILTERREQ or RPCAPMSGSTARTCAPREQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster...

CVE-2026-18313

CVE-2026-18313 is a memory leak in the rpcapd (remote capture daemon) component of libpcap versions before 1.10.7 . Each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message from a client causes an allocation of up to 65536 bytes that is never freed, leaking memory even under normal use. ...

CVE-2026-18313 rpcapd memory leak in libpcap before 1.10.7

rpcapd can allocate up to 65536 bytes per each RPCAPMSGUPDATEFILTERREQ or RPCAPMSGSTARTCAPREQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster...