linux_screenshot_xwindows

Intro The goal of this volatility plugin is to extract a screenshot of all open X windows from a memory dump. Previous work The volatility plugin linuxxwindows realised by Adam Bridge https://github.com/bridgeythegeek/linuxxwindows extracts various metadata from the window objects registered to X...

CVE-2025-5777

CVE-2025-5777 Citrix NetScaler Memory Leak Exploit !WARNING This script is intended for educational and research purposes only. Do not use it against systems without explicit permission. Unauthorized access or testing is illegal and unethical. Read the full DISCLAIMER before using this script...

MemoryMapper

Memory Mapper Memory Mapper is a lightweight library which allows the ability to map both native and managed assemblies into memory by either using process injection of a process specified by the user or self-injection; the technique of injecting an assembly into the currently running process...

CVE-2026-73130

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can...

CVE-2026-73273

Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This...

CVE-2026-60018

Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or...

CVE-2026-63021

Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing...

CVE-2026-62925

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionatel...

CVE-2026-110602

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajdopen in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an...

CVE-2026-110604

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxmlstrtod when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the...

CVE-2026-110595

BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in readupload that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and...

CVE-2026-110262

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in...

CVE-2026-110270

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O2^n memory allocation, causing an...

CVE-2026-110257

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute that sizes an int array from numbootstrapmethods without validating attributelength. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB...

CVE-2026-110258

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...

CVE-2026-110260

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal and computeAllFrames when using COMPUTEMAXS or COMPUTEFRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge...

DEBIAN-CVE-2026-101025

Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with...

CVE-2026-101025

Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with...

CVE-2026-101896

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty...

ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the /ipa/i18nmessages endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial o...