CVE-2026-88362

A flaw was found in MuJS. An attacker can trigger a Denial of Service DoS by providing specially crafted JavaScript input containing an excessively large array index. This flaw causes an out-of-range numeric value to be converted to an integer without proper validation, leading to undefined...

Chrome-Skia-CVE-2024-8636

Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop10.html Steps to reproduce: 1. Apply the chromium.diff patch to chromium. 2. Run genskpic.py to generate drawablepicture.skp.hh, then move the generated file to src/gpu/commandbuffer/client. 3...

Chrome-Skia-CVE-2024-8198

Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop28.html Steps to reproduce: 1. Apply the chromium.diff patch to chromium. 2. Run genskpic.py to generate drawablepicture.skp.hh, then move the generated file to src/gpu/commandbuffer/client. 3...

Chrome-Skia-CVE-2024-7966

Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop21.html Steps to reproduce: root@kitploit: Apply the chromium.diff patch to chromium. Run genskpic.py to generate drawablepicture.skp.hh, then move the generated file to...

CVE-2023-21554

CVE-2023-21554-PoC CVE-2023-21554 Windows MessageQueuing PoC， The sign of Poc success is the crash of the mqsvc.exe process, and there is no pop-up message, which needs to be seen in a process monitor-like program Execute command in windows terminal or command prompt python poc.py Enter IP addres...

CVE-2025-1218: Heap-based Buffer Overflow

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and c...

CVE-2023-21554-PoC

CVE-2023-21554-PoC CVE-2023-21554 Windows MessageQueuing PoC, analysis at https://www.zoemurmure.top/posts/cve202321554/ Before executing the PoC file, modify the target machine IP address manually. The sign of a successful PoC is the crash of the mqsvc.exe process. There is no pop-up information...

NPM: request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

NPM: request-filtering-agent: Synchronous throw from createConnection for literal private-IP hosts bypasses req.on'error', crashing the Node.js process vulnerability discovered by ? in WordPress Npm request-filtering-agent versions 3.2.1...

EUVD-2026-84289

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encodepunycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation delta += m-n h+1 has no overflow check, so...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-000283)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000283 advisory. A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory location beyond the header value sent. This cou...

CVE-2026-50572

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the...

CVE-2026-73512

CVE-2026-73512 is a use-after-free in Envoy Proxy 's HttpDatagramHandler (QUIC/HTTP3 datagram handling). When Capsule Protocol is enabled, the handler caches the current RequestDecoder pointer. During stream recreation—such as an internal redirect —the ActiveStream is replaced and EnvoyQuicServer...

CVE-2026-73512 Envoy: use-after-free in QUIC on internal redirects

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the...

CVE-2026-73512 Envoy: use-after-free in QUIC on internal redirects

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the...

CVE-2026-73512 Envoy: use-after-free in QUIC on internal redirects

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the...

EUVD-2026-84110

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's extauthz filter assumes that a request contains a :path pseudoheader when applying queryparameterstoset or queryparameterstoremove from an authorization...

CVE-2026-73513

CVE-2026-73513 is a heap use-after-free in Envoy's optional oghttp2 upstream HTTP/2 codec. When an untrusted upstream sends a response trailer HEADERS frame without the END_STREAM flag, Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving a dangling ...

CVE-2026-73513 Envoy: oghttp2 upstream trailers incorrect handling

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest...

CVE-2026-73513 Envoy: oghttp2 upstream trailers incorrect handling

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest...

CVE-2026-50572 Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the...