GO-2026-6777 Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder in github.com/bishopfox/sliver

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTPS Listener PNG Decoder in github.com/bishopfox/sliver...

GO-2026-6720 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels in github.com/jhaals/yopass

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels in github.com/jhaals/yopass...

GO-2026-6689 Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize

Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize...

dyen

dyen dyen loads a Mach-O dylib in memory using stock macOS Python and calls an exported entry point without dlopen on that dylib. The aim is that the image is never a standalone file on the target and is never registered with dyld. by cenobyte [email protected] 2026...

CVE-2025-7771

CVE-2025-7771 A simple PoC demonstrating the vulnerability in the ThrottleStop.sys driver, showcasing arbitrary physical memory read and write capabilities, as well as virtual-to-physical address translation using Superfetch. ⚡ Usage: 1. Register a service: Launch cmd.exe with Administrator...

hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request

A flaw was found in hostapd. An unauthenticated attacker within wireless range can send a specially crafted management frame during Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing. This crafted frame, containing a malformed Multi-Link Element or Per-STA Profile...

CVE-2026-112782

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.maxpixels limit when system.images.urlactions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or...

memdumper

memdumper memdumper reads the memory of a running macOS process under another signed binary's debugger entitlement. The aim is that taskforpid and ptrace run as that entitled binary, so an EDR records it rather than memdumper. by cenobyte [email protected] 2026...

hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request

A flaw was found in hostapd. An unauthenticated attacker within wireless range can send a specially crafted management frame during Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing. This crafted frame, containing a malformed Multi-Link Element or Per-STA Profile...

CVE-2017-16995

CVE-2017-16995 CVE ID: CVE-2017-16995 Publish date: 2017-12-27T17:08:17.670 Base score CVSS 3.0/3.1: 7.8 Description: The checkaluop function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service memory corruption or possibly have unspecified oth...

Palimpsest

CVE-2026-74945 · Uninitialized heap disclosure through a crafted web font This directory holds an honest reproduction package for an uninitialized-memory disclosure in Firefox font handling. A crafted @font-face font walks the OTS output stream into an uninitialized-heap gap, and ordinary content...

CVE-2025-8061-Exploit

CVE-2025-8061 Exploit Overview Proof-of-Concept exploit for LnvMSRIO.sys Lenovo MSR I/O Driver, demonstrating arbitrary physical memory read/write and kernel memory access via Superfetch VA-to-PA translation. Driver Information Property| Value ---|--- Driver Name| LnvMSRIO.sys Device Name|...

CVE-2026-98533

A flaw was found in the Linux kernel's Integrity Policy Enforcement IPE subsystem. When dm-verity updates a root hash, the old hash can be freed while concurrent policy evaluation operations are still accessing it. A local attacker could exploit this use-after-free condition to trigger a Denial o...

CVE-2026-110685

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

CVE-2026-110676

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allowbignum. With allowbignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply...

CVE-2026-110677

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeysasarrayref in decodehv. With dupkeysasarrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every...

CVE-2026-110678

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...

CVE-2026-110680

Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encodehv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed...

CVE-2026-110684

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encodestringify. encodestringify writes a value in its string form under allowstringify, under convertblessed for objects without TOJSON, and under allowbignum...

CVE-2026-110672

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...