CVE-2026-85664

Chroma 1.5.9 , a vector database, fails to enforce maximum bounds on the HNSW index parameters max_neighbors , ef_construction , and ef_search when processing collection-create requests. Because no upper limit is validated, unauthenticated attackers over the network can supply arbitrarily large v...

CVE-2026-85664 Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustion

Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters maxneighbors, efconstruction, and efsearch in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction...

EUVD-2026-71120

Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters maxneighbors, efconstruction, and efsearch in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction...

CVE-2026-82728 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decodestatusline/4...

CVE-2026-82728

Mint (the Elixir HTTP client library, elixir-mint/mint) suffers from unbounded buffering in its HTTP/1 response parser. In lib/mint/http1.ex, decode_status_line/4 and decode_body/5 accumulate unconsumed server data in conn.buffer without any size cap, because the :max_header_list_size budget is o...

CVE-2026-82728 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decodestatusline/4...

EUVD-2026-71220

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decodestatusline/4...

EEF-CVE-2026-82728 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex,...

EUVD-2026-71219

Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parsehexprefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision...

CVE-2026-82729

CVE-2026-82729 is an inefficient algorithmic complexity vulnerability in elixir-mint/mint , an Elixir HTTP client library. The root cause is in parse_hex_prefix/2 (in lib/mint/http1/parse.ex), which folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumula...

CVE-2026-82729 Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS

Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parsehexprefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision...

EEF-CVE-2026-82729 Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS

Summary Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parsehexprefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an...

CVE-2026-71979

A flaw was found in INDI indiserver. An unauthenticated remote attacker can exploit a stack buffer overflow vulnerability by sending specially crafted XML with oversized, mismatched tags. This can lead to an unbounded write operation, causing the daemon to crash and disrupting all active client a...

PoC-CVE-2025-69421

CVE-2025-69421 crash-only reproducer This repository contains a minimal malformed PKCS12 file that reproduces CVE-2025-69421 in an isolated laboratory environment. The generated PFX contains EncryptedData whose EncryptedContentInfo omits the optional encryptedContent field. Vulnerable OpenSSL...

rugmuncher-backend

RMI Backend Repo: git.rugmunch.io/RugMunchMedia/rmi-backend Deploy: /root/backend/ on Talos Container: rmi-backend Health: http://127.0.0.1:8000/health currently unhealthy — Redis host not resolving What it is FastAPI backend for the RMI platform. Serves token risk scans, wallet forensics, market...

SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit

SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit Proof-of-concept exploit chain I have discovered assigned as CVE-2026-47301 for Microsoft Configuration Manager SCCM, combining broken access control, CAB extraction-path traversal arbitrary file write, certificate verification bypass, and DLL...

CVE-2026-82309 Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries. checkdns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and...

CVE-2026-82309

Robots::Validate (Perl CPAN module), versions 0.3.2 through 0.3.10 , is vulnerable to unbounded outbound DNS queries via its _check_dns function. The forward-confirmation loop issues a PTR query for the client address and then a forward query for each returned name, with no cap on the list length...

CVE-2026-82309 Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries. checkdns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and...

CVE-2026-85612

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata...