EUVD-2026-101114

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...

CVE-2026-97205

A Use-After-Free (UAF) vulnerability exists in the ngx_http_core_module of NGINX Plus and NGINX Open Source. When asynchronous file I/O (AIO) is enabled, processing a Server Side Includes (SSI) page with include virtual commands can trigger memory corruption or a worker process crash. This is a d...

CVE-2026-93479 NGINX map directive and regex matching vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...

CVE-2026-15176 NGINX ngx_http_core_module vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the $requestfilename variable...

CVE-2026-15176

A heap buffer overflow vulnerability exists in the ngx_http_core_module of NGINX Plus and NGINX Open Source . The flaw is triggered when a location is configured using the alias directive with rewrite , set , or return directives referencing the $request_filename variable, or alternatively, when ...

CitrixBleed-2-CVE-2025-5777-PoC-

CitrixBleed 2 CVE-2025-5777 Ultimate Analysis An Out-of-Bounds Memory Read in NetScaler ADC / Gateway — A Comprehensive Guide from Root Cause to Offensive and Defensive Exercises poc usage: python3 poc.py https://gateway.example.com exp usage: python3 exp.py https://gateway.example.com admin...

CVE-2025-55182

CVE-2025-55182 POC This repository contains a proof of concept POC for CVE-2025-55182, demonstrating the vulnerability and its exploitation. Weak server "dependencies": "next": "16.0.6", "react": "19.2.0", "react-dom": "19.2.0" , Weak server 2 "dependencies": "next": "^15.0.0", "react": "^19.0.0"...

CVE-2026-84471

A use-after-free vulnerability exists in OpenVPN versions 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 . The flaw resides in the TLS session handling and stems from an incomplete fix for CVE-2026-12996. It allows remote authenticated peers to trigger a denial of service (causing the applicat...

CVE-2026-84471

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

CVE-2026-62925

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionatel...

CVE-2026-60021

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...

CVE-2026-60021 Gitea GitLab migration denial of service

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...

CVE-2026-60021

The Gitea GitLab migration downloader is vulnerable to a Denial of Service (DoS) attack because it uses an HTTP client for version probes without a timeout and fails to attach the migration task's cancellation context . An authenticated user capable of starting migrations can trigger a request to...

CVE-2026-60021 Gitea GitLab migration denial of service

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...

CVE-2026-60018

Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or...

CVE-2026-60018 Gitea OneDev migration denial of service

Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or...

CVE-2026-60018 Gitea OneDev migration denial of service

Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or...

CVE-2026-60018

The Gitea OneDev migration downloader is vulnerable to a denial of service because it reads the entire remote version response into memory without a size limit and utilizes an HTTP client lacking a timeout. An authenticated user capable of starting a repository migration can point the process to ...

Exploit for CVE-2026-74580

Vghost — CVE-2026-74580 Original code and readme file from: h...

CVE-2026-98419

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...