CVE-2026-26447

A flaw was found in Stomper. An unauthenticated client can exploit a use-after-free vulnerability by repeatedly issuing SUBSCRIBE commands for the same destination over a single connection and then closing that connection. This leads to incorrect cleanup of internal subscription structures,...

CVE-2026-26445

A flaw was found in stomper. A remote attacker can exploit this by sending partial STOMP Streaming Text Oriented Messaging Protocol frames. This action can cause the broker's sockets to enter a permanent half-read state. Consequently, the broker stops processing new messages, leading to a Denial ...

CVE-2026-51684

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-80609

A flaw was found in the qede driver of the Linux kernel. An out-of-bounds read vulnerability exists due to an incorrect index check for cqe-lenlist before element access. This flaw could potentially allow an attacker to cause a denial of service or disclose sensitive information...

CVE-2026-80601

A flaw was found in the batman-adv Better Approach To Mobile Ad-hoc Networking - Advanced module of the Linux kernel. When the pskbmaypull function is called by batadvgetvid, it can reallocate the buffer, causing variables to point to a freed memory region. This use-after-free vulnerability could...

CVE-2026-80679

A flaw was found in the Linux kernel. Specifically, within the s390/dasd component, the dasdreleasespace function incorrectly checks a function pointer by using a logical AND operator instead of a logical OR operator. This error can lead to a NULL pointer dereference, which may cause a system cra...

CVE-2026-80669

A flaw was found in the Linux kernel. A local attacker with the ability to load BPF Berkeley Packet Filter LSM Linux Security Module programs could exploit a vulnerability in the xfrmdecodesession hook. This could lead to a system panic, resulting in a Denial of Service DoS...

CVE-2026-80640

A flaw was found in the Linux kernel's CXL subsystem firmware control cxl/fwctl. A buffer overflow vulnerability exists in the cxlctlgetsupportedfeatures function due to improper initialization of an array size. This could lead to a system crash, resulting in a denial of service DoS...

CVE-2026-80722

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. A remote attacker sending a specially crafted S1G TWT setup frame could cause the system to process an incomplete parameters block. This incomplete processing can lead to memory corruption or a system crash, resulting in a Denial of...

CVE-2026-80691

A flaw was found in the Linux kernel's SCSI target iblock module. A missing null pointer check in the iblockexecuteprout function, specifically for the ops-prclear callback during PREEMPT and RELEASE operations, allows unimplemented hooks to be called. This can lead to dereferencing a null functi...

CVE-2026-80656

A flaw was found in the Linux kernel's hfsplus filesystem. A local attacker could provide a specially crafted and corrupted HFS+ image. When attempting to mount this image, a malformed btree node size value could lead to the use of an uninitialized value within the kernel. This could result in a...

CVE-2026-80645

A flaw was found in the Linux kernel's rapidio/tsi721 component. This vulnerability arises from incorrect handling of a variable within a specific loop in the tsi721dbdpc function. If a particular item is not found, the system attempts to access invalid memory. This could allow a local attacker t...

nhi-zero-trust-bypass

프로젝트: 프로토콜 취약점을 악용하여 NHI 비밀 조작 및 제로 트러스트 정책 우회 스크린샷 아래는 데모의 실제 스크린샷입니다. 더 많은 내용은 screenshots/README.md를 참조하세요. 1. DNS 익스플로잇 BIND 충돌 A. 익스플로잇 패킷 전송 Scapy가 변조된 TSIG DNS 패킷을 BIND로 전송합니다 dnsexploit.py 참조. B. 컨테이너 충돌 확인 docker ps -a는 익스플로잇 후 BIND 컨테이너가 종료되었음을 보여줍니다. C. 충돌 로그 증거...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders

A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP...

libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write

A flaw was found in the libXfont2 font-server client. A remote attacker, by operating a malicious font server, could exploit an out-of-bounds read/write vulnerability. This occurs because the client incorrectly handles font data, leading to an out-of-bounds memory access. This can lead to privile...

libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client

A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fsreadglyphs function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the...