CVE-2026-87794

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands...

DEBIAN-CVE-2026-86776

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consu...

CVE-2026-86776

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consu...

CVE-2026-23918-test

CVE-2026-23918-test This repository contains a Proof of Concept PoC demonstrating the Double Free vulnerability CVE-2026-23918 in Apache HTTP Server 2.4.66 modhttp2. The vulnerability stems from a race condition during early RSTSTREAM frame processing. I focused on the timing window where the...

CVEs-for-picoc-3.2.2

CVEs-for-picoc-3.2.2 Reproduction files for CVE-2022-44312 through CVE-2022-44321 CVE Reference PicoC v3.2.2 Heap Overflow in the ExpressionCoerceInteger function in expression.c CVE-2022-44312 PicoC v3.2.2 Heap Overflow in the ExpressionCoerceUnsignedInteger function in expression.c CVE-2022-443...

CVE-2026-11838

Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation. This issue affects Library Reservation System: before v22.2...

CVE-2022-44318

Description of CVE-2022-44318 PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from ExpressionParseFunctionCall. Any project or library that uses Picoc also suffers from this issue. An example of this would be...

CVE-2022-43343

Description for CVE-2022-43343 N-Prolog v1.91 was discovered to contain a global buffer overflow vulnerability in the function gettoken at Main.c Reproduction To reproduce the vulnerability, download a vulnerable version of N-Prolog v1.91 and compile the project: root@kitploit: git clone...

CVE-2022-36752

Description for CVE-2022-36752 png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitable via a crafted webp file when reversing the format back to png. Reproduction To reproduce the vulnerability, download the vulnerable version of...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-87794 bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands...

EUVD-2026-74790

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands...

CVE-2026-87794

bestzip (Node.js package node-bestzip) versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function. Attackers can inject arbitrary arguments to the Info-ZIP backend by supplying a malicious destination path combined with crafted source entries, leading to arbitr...

CVE-2026-87794 bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands...

CVE-2026-86776

KeePass versions 2.35 through 2.61.1 are affected by a memory exhaustion vulnerability in the ReadHeaderField function. The root cause is a failure to validate KDBX header field sizes before performing memory allocation. An attacker can craft a malicious KDBX file declaring excessive header field...

CVE-2026-86776 KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field Size

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consu...

CVE-2026-86776 KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field Size

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consu...

EUVD-2026-74788

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consu...

CVE-2026-86776

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consu...

firefox-rce-nssmil

Firefox RCE CVE-2016-9079 – Adaptación JavaScript Educativa Implementación educativa del exploit público para CVE-2016-9079, adaptada del módulo original de Exploit-DB/Metasploit para uso independiente. Aviso legal Este repositorio se proporciona estrictamente con fines educativos y de...