encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

vulnerable-nextjs-14-CVE-2025-29927

CVE-2025-29927 Authorization Bypass reproduction This repository is a reproduction of the CVE-2025-29927 vulnerability in the next package How to reproduce 1. Follow the steps below to clone, and run the Next.js application 2. Test authorization denies access to the /api/hello endpoint...

vulnerable-nextjs-14-CVE-2025-29927

CVE-2025-29927 Authorization Bypass reproduction This repository is a reproduction of the CVE-2025-29927 vulnerability in the next package How to reproduce 1. Follow the steps below to clone, and run the Next.js application 2. Test authorization denies access to the /api/hello endpoint...

CVE-2025-21574-Exploit

CVE-2025-21574-Exploit Key Features of this Black-Box Exploit: 1. Credential Brute-Forcing: Tests 12+ common default username/password combinations Checks 5 common system databases Automatically detects valid credentials 2. Anonymous Access Attempt: Tries connecting without any credentials Tests...

vulnerable-nextjs-14-CVE-2025-29927

CVE-2025-29927 Authorization Bypass reproduction This repository is a reproduction of the CVE-2025-29927 vulnerability in the next package How to reproduce 1. Follow the steps below to clone, and run the Next.js application 2. Test authorization denies access to the /api/hello endpoint...

CVE-2026-442_

CVE protobuf.js CVE-2026-44289、CVE-2026-44290、CVE-2026-44291、CVE-2026-44292、CVE-2026-44294、CVE-2026-44295 - protobuf.js ⚡ 簡単な使い方 このプロジェクトは、以下のような安全で許可された環境でのみ使用してください。 ローカル仮想マシン Docker コンテナ 分離されたラボ環境 許可された侵入テスト環境 セットアップ例: root@kitploit: git clone cd プロジェクトは Python を使用します。以下を参照してください。 仮想環境を作成 pyth...

jackson

Analysis and Remediation of Security Vulnerabilities in Jackson core 2.13.5 CVE-2025-52999 SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 GHSA-2m67-wjpj-xhg9 SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538 Sonatype-2022-6438 This branch...

CVE-2025-2995

CVE-2025-29927 Authorization Bypass reproduction This repository is a reproduction of the CVE-2025-29927 vulnerability in the next package How to reproduce 1. Follow the steps below to clone, and run the Next.js application 2. Test authorization denies access to the /api/hello endpoint...

toml-node: Uncontrolled Recursion

Summary toml.parse crashes with an uncaught RangeError: Maximum call stack size exceeded when parsing deeply nested arrays or inline tables. The parser is generated by Peggy 5.1.0 a PEG parser generator as a recursive-descent parser; the value rule mutually recurses with the array and inline-tabl...

stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

Description The path filters pick, ignore, filter, and replace — the library's headline "surgical extraction" feature — recompute the full path string from the nesting stack on every checkable token. Because the stack length equals the current nesting depth, and a checkable token is emitted at...

org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service...

CVE-2026-29000

CVE-2026-29000：pac4j-jwt 身份验证绕过 POC 本仓库包含针对 pac4j-jwt（CVE-2026-29000）中身份验证绕过漏洞的概念验证（POC）。该漏洞允许攻击者通过在 JWE（JSON Web 加密）容器中嵌套 PlainJWT（使用 alg: none）来绕过签名验证。 概述 该攻击利用服务器愿意解密使用其公钥加密的 JWE，并随后信任内部 JWT 而不验证其签名（前提是使用 none 算法）的特性。 前置条件 确保已安装 Python 3 以及所需依赖： root@kitploit: pip install requests jwcrypto 使用方...

CVE-2026-29000

Generador de Exploit CVE-2026-29000 Rust Este repositorio contiene una implementación especializada en Rust para explotar CVE-2026-29000, una vulnerabilidad de omisión de autenticación en pac4j-jwt. La vulnerabilidad se origina en una "Omisión de Validación de Firma" cuando un PlainJWT alg: none...

DEBIAN-CVE-2026-84310

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/doccommon.py getoutline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths becaus...

CVE-2026-84364

Hono is a JavaScript web application framework supporting any runtime. Prior to 4.13.5 , the parseBody() function, when dot-notation parsing is enabled, does not limit nesting depth or the number of intermediate objects created from dot-separated form field names. A single deeply dotted field nam...

CVE-2026-84364 Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...

CVE-2026-84310

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/doccommon.py getoutline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths becaus...

PT-2026-84462

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.16.1 Description An attacker can craft a PDF file that causes the get outline function in pypdf/ doc common.py to consume excessive memory and long runtimes. This occurs when retrieving document outlines that contain ...

CVE-2026-81724 NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed...

CVE-2026-67590

A flaw was found in Apache Qpid ProtonJ2. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the application to become unresponsive and resulting in a denial of service...