ktor-xxe-poc

CVE-2023-45612: JetBrains Ktor XXE Proof of Concept This repository contains a vulnerable Ktor server to demonstrate the XML External Entity XXE injection vulnerability identified in CVE-2023-45612. The vulnerability exists in Ktor versions before 2.3.5 when the ContentNegotiation plugin is used...

CVE-2021-40865

CVE-2021-40865 CVE-2021-40865 POC/exploit-poc import org.apache.commons.io.IOUtils; import org.apache.storm.serialization.KryoValuesSerializer; import ysoserial.payloads.ObjectPayload; import ysoserial.payloads.URLDNS; import java.io.; import java.math.BigInteger; import java.net.; import...

[SECURITY] [DLA-4803-1] ruby-oj security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4803-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley September 30, 2026 https://wiki.debian.org/LTS -...

Fedora 45 : perl-Dancer2 (2026-5e3eab9a07)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5e3eab9a07 advisory. Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrar...

Fedora 44 : perl-Dancer2 (2026-3b893ccf2d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3b893ccf2d advisory. Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrar...

SUSE CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

DEBIAN-CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue within the DNS dissector and serializer deserialization code . The root cause is that specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly dereferenced without alignme...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

PT-2026-97864

Name of the Vulnerable Software and Affected Versions nDPI version 5.1.0 Description A memory access issue exists in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16 t or wider integer pointe...

EUVD-2026-86285

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-96758

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-96758

The orval @orval/core package, prior to version 8.28.0 , is vulnerable to a code injection flaw in its form-data serializer . The root cause is a failure to escape multipart property names within generated template literals. This allows an attacker to inject ${...} expressions into OpenAPI schema...

EUVD-2026-85408

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...