multer vulnerable to Denial of Service via oversized array index in field names

Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...

EUVD-2026-67932

multer vulnerable to Denial of Service via oversized array index in field names...

CVE-2026-6666-XPC-Service-NSKeyedUnarchiver-Deserialization-Attack-macOS-iOS-simulation-

CVE-2026-6666 – XPC Service NSKeyedUnarchiver Deserialization Attack macOS/iOS simulation Program Code Python simulation root@kitploit: !/usr/bin/env python3 vulnerablexpcservice.py - Simulated XPC service using unsafe plist deserialization import plistlib, subprocess, socketserver, struct Mach...

CVE-2026-86078

n8n (open-source workflow automation platform) is affected by a prototype pollution vulnerability in the Instance AI workflow summary feature prior to versions 2.37.7 and 2.38.2 . The function summarizeWorkflowStructure (in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts) trea...

CVE-2026-86078 n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain proto or constructor, causing nested writes t...

CVE-2026-86078 n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain proto or constructor, causing nested writes t...

CVE-2014-7911_poc

CVE-2014-7911poc Local root exploit for Nexus5 Android 4.4.4KTU8P author: retme [email protected] @returnsme on twitter & @retme on weibo website: retme.net how to build Import the project into eclipse,and build. ./cve20147911/assets/msmattack is the binary file of CVE-2014-4322 exploit.You...

EUVD-2026-69712

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources...

G3-Loop-DoS

G3-Loop-DoS Python Script for Automated Vulnerability Detection of Loop DoS and CVE-2024-2169 Description: This Python script automates the process of scanning for systems potentially vulnerable to the Loop DoS attack and the hypothetical CVE-2024-2169 vulnerability. It focuses on scanning ports...

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED0 prefixes. Inline shortcode attributes use another unanchored greedy ke...

EUVD-2026-69611

Hono: Unbounded dot-notation nesting in parseBody can cause memory exhaustion...

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Summary When parseBody expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent...

CVE-2026-79602

A flaw was found in Xen. A malicious guest operating system, when configured with a PCI device that has a Base Address Register BAR mapped to the I/O port space, can trigger an internal error within the Xen hypervisor. This vulnerability could lead to a denial of service, causing the host system ...

CVE-2026-76905

A flaw was found in kin-openapi, a Go project for handling OpenAPI files. An unauthenticated client can exploit this vulnerability by sending a malformed non-string scalar field in a multipart/form-data request body. This can cause applications that render validation errors through specific...

CVE-2026-73502

A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a null-pointer dereference in the openapi3filter.ValidateRequest function. This occurs when validating a request against a content parameter whose application/json media type has no schema. Successful exploitation lea...

GHSA-2V4P-QF9Q-27WJ gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service DoS. Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This...

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service DoS. Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This...

CVE-2021-33690

CVE-2021-33690 CVE-2021-33690 Server Side Request Forgery vulnerability in SAP NetWeaver Development Infrastructure root@kitploit: Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver Development Infrastructure Component Build Service versions – 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

CVE-2024-5243-pwn2own-toronto-2023

CVE-2024-5243-pwn2own-toronto-2023 TP-Link ER605 Pre-Auth RCE CVE-2024-5242 / CVE-2024-5243 / CVE-2024-5244 Proof-of-Concept PoC exploit chain targeting the TP-Link Omada ER605 DDNS client daemon cmxddnsd when the device is configured to use the Comexe DDNS service. ⚠️ Legal / Ethics : This...

CVE-2026-85983

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the...