CVE-2021-31805

CVE-2021-31805 PoC for CVE-2021-31805 Apache Struts2 CVE-2021-31805の解説記事で使用したアプリケーションです。 セットアップ $ docker-compose build $ docker-compose up -d 動作確認 http://localhost:8080/struts2-showcase-2.5.29/index.html にアクセスしWelcomeページが表示されることを確認します。 Exploit $ curl -I...

OpenCVE: Server-Side Request Forgery (SSRF) in notifications

ImpactOpenCVE contains a Server-Side Request Forgery SSRF vulnerability in the notification testing functionality for both Webhook and Slack integrations.An authenticated user with permission to configure notification channels can trigger test requests to arbitrary HTTPS endpoints. Insufficient...

Allocation of Resources Without Limits or Throttling

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via number2uppercaseletter and its lowercase counterpart in pagelabels.py whe...

CVE-2021-26855-PoC

CVE-2021-26855-PoC CVE-2021-26855에 대한 PoC 익스플로잇 코드입니다. 원본 코드는 https://github.com/GreyOrder에서 개발되었습니다. CVE-2021-26855 SSRF를 golang으로 간단히 구현한 연습 영향받는 버전 Exchange Server 2013 CU23 미만 Exchange Server 2016 CU18 미만 Exchange Server 2019 CU7 미만 사용 조건 이 취약점은 이전 Exchange 취약점과 다릅니다. 이 취약점은 로그인 가능한 사용자 ID가...

USN-8861-1: OpenSSL vulnerabilities

It was discovered that OpenSSL had an inefficient algorithm in its QUIC stream reassembly implementation. A remote attacker could possibly use this issue to cause OpenSSL to use excessive CPU resources, leading to a denial of service. CVE-2026-42772 It was discovered that OpenSSL did not properly...

PT-2026-103955

Name of the Vulnerable Software and Affected Versions KaTeX versions 0.11.0 through 0.18.1 Description KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration. This allows...

AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788279341)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788279341 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

ROS-20260930-73-0096

The vulnerability in the kernel-lt is related to insufficient control of resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

AlmaLinux 9.6 [TuxCare] Security Update: mod_md (ALMALINUX9.6:CLSA-2026:1782919559)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782919559 advisory. - Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's modmd via OCSP response data. This issue affects...

CVE-2026-100508: Allocation of Resources Without Limits or Throttling

Unauthenticated Denial of Service Attack in Two Factor = 0.16.0 versions...

PT-2026-103516

Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1 Description The gateway WebSocket transport contains an allocation of resources without limits. This allows connected gateways to exhaust node memory by sending an unending sequence of WebSocket...

ROS-20260930-73-0094

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260930-73-0097

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260930-73-0095

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-95290

A missing authorization flaw was found in the NFC component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/536161355...

CVE-2026-75804: Allocation of Resources Without Limits or Throttling

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804: Allocation of Resources Without Limits or Throttling

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

Allocation of Resources Without Limits or Throttling

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Address6.isValid method and the Address4 constructor when parsing an oversized input...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Address6.isValid method and the Address4 constructor when parsing an...