EUVD-2026-109269

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating...

hacks

Hacks Hacky one-off scripts, tests etc...

CVE-2019-13288-POC

CVE-2019-13288-POC xpdf/install/bin/pdftotext ./poc.pdf In Xpdf 4.01.01, the Parser::getObj function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646...

xcrawl3r

xcrawl3r xcrawl3r is a command-line utility designed to recursively spider webpages for URLs. It works by actively traversing websites - following links embedded in webpages, and parsing files including sitemaps & robots.txt - to uncover every URL. Unlike xurlfind3r that doesn't interact directly...

golddigger

Gold Digger Search files for gold Gold Digger is a simple tool used to help quickly discover sensitive information in files recursively. Originally written to assist in rapidly searching files obtained during a penetration test. Installation Gold Digger requires Python3. virtualenv -p python3...

CVE-2026-34308

CVE-2026-34308: MySQL Server JSON component denial of service Official vendor bulletin: Oracle Critical Patch Update Advisory — April 2026. Summary from published CVE Vulnerability in Oracle MySQL Server component: Server: JSON. Supported affected versions: 8.0.0–8.0.45 , 8.4.0–8.4.8 , and...

CVE-2019-13288

CVE-2019-13288 – Infinite Recursion in Xpdf's Parser::getObj Overview CVE-2019-13288 is a vulnerability identified in Xpdf version 4.01.01 , specifically within the Parser::getObj function in Parser.cc. This flaw can lead to infinite recursion when processing a specially crafted PDF file, resulti...

CVE-2026-40345

deepmerge-ts mergeleft.self, right.self - mergeleft.self, right.self - mergeleft.self, right.self...

zirgen

Zirgen Circuit Compiler Zirgen is a compiler for a domain-specific language, also called "zirgen", which creates arithmetic circuits for the RISC Zero proof system. For the most part, users of RISC Zero should be writing their zkApps in Rust and using our RISC-V zkVM rather than building them...

punk.py

punk.py unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to help network pivoting from a compromised unix box. It collect usernames, ssh keys and known hosts from a unix system, then it tries to connect via ssh to all the combinations found. punk.py is...

CVE-2026-18464

CVE-2026-18464 — WP Maps Pro This repository is intended as a technical reference for an already disclosed vulnerability. It does not include a weaponized denial-of-service script. Overview Item| Details ---|--- CVE| CVE-2026-18464 Product| WP MAPS PRO Affected versions| 6.1.3 Fixed version| 6.1....

upb-any-recursion-audit

upb Any-recursion audit Ruby / PHP / C bindings Status: Complete. Six recursion-guard checks across three independent implementations Ruby/PHP shared upb core, C's separate managed implementation, all falsified except the one already-public, already-patched Python CVE this audit was checking...

CVE-2026-8168

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG mo...

dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-26903-PoC

CVE-2026-26903 PoC Denial-of-service via unbounded recursion in TanStack Query'sreplaceEqualDeep function A single crafted query update with deeply nested objects can freeze the JavaScript thread indefinitely , causing complete application unresponsiveness. No authentication or special permission...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2025-61301

CVE-2025-61301 - CAPEv2: Denial-Of-Analysis via Recursive Process Forking Description A High-Severity Denial-of-analysis vulnerability affects reporting/mongodb.py and reporting/jsondump.py in CAPEv2 commit 52e4b43, on 2025-05-17 allows attackers who can submit samples to cause incomplete or...