128151 matches found
CVE-2021-3129-Lab
CVE-2021-3129: Laravel Debug Mode RCE Lab Hands-on lab for exploiting CVE-2021-3129 - a critical Laravel vulnerability allowing unauthenticated file read and potential RCE. Quick Start root@kitploit: Clone git clone https://github.com/theNareshofficial/CVE-2021-3129-Lab.git cd CVE-2021-3129-Lab...
CVE-2026-84828 Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
CVE-2026-84828
A local privilege escalation and information disclosure flaw in PCS (Pacemaker Configuration System) allows a user with membership in the haclient group to read arbitrary files on the filesystem via the pcs host auth --token command. The pcsd daemon reads file contents with root privileges , and ...
CVE-2026-84828 Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
EUVD-2026-75396
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
CVE-2026-84828
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
CVE-2026-84828
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
CVE-2025-62821
Microsoft HEIF Image Extensions msheifstore.dll: Source-buffer under-allocation in CopyPixels path leads to out-of-bounds read and Access Violation DoS When decoding a crafted HEIF image through WIC, the msheif codec allocates a 1-byte source buffer but later attempts to copy a very large amount ...
CVE-2026-87961
ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...
Elysium-Vanguard-Sentinel-Audit
SENTINEL-ROOT-AUDIT: Honor Magic V2 Hypervisor Detection Suite ➲ Project Overview SENTINEL-ROOT-AUDIT is a professional-grade security suite designed to audit kernel integrity and detect hypervisor-level interventions on the Honor Magic V2 SM8550. While the core vulnerability CVE-2025-38352 allow...
EUVD-2026-75388
ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...
CVE-2026-87961
ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read in the read_ID3_Header function, caused by a shadowed length parameter during ID3 synchronized-lyrics processing. An attacker can craft malicious MP3 files or HTTP audio streams with oversized frame size declarati...
CVE-2026-87961 ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header
ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...
CVE-2026-87961 ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header
ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...
CVE-2026-59985
A flaw was found in OpenEXR. A remote attacker could provide a specially crafted RLE-compressed EXR image, which causes a 64-bit unpacked size to truncate before memory allocation. This leads to a heap out-of-bounds read when unpack32bit attempts to read beyond the allocated buffer. Successful...
mongobleed
mongobleed CVE-2025-14847 exploit for MongoDB heap memory disclosure via OPCOMPRESSED buffer over-read. Usage root@kitploit: $ bundle exec ruby mongobleed.rb --help Usage: mongobleed.rb options --host HOST Target host default: localhost --port PORT Target port default: 27017 --min-offset MIN Min...
CVE-2026-87823
A flaw was found in zstd-jni. This vulnerability arises from insufficient bounds checks in direct-ByteBuffer frame-size native methods, which allows attackers to provide negative or overflowing offsets. A remote attacker can exploit this by supplying specially crafted negative offset values,...
PYSEC-2026-3940 weasyprint Has Server-Side Request Forgery (SSRF)
Summary urlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...
weasyprint Has Server-Side Request Forgery (SSRF)
Summaryurlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input.Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...