CVE-2024-5243-pwn2own-toronto-2023

CVE-2024-5243-pwn2own-toronto-2023 TP-Link ER605 Pre-Auth RCE CVE-2024-5242 / CVE-2024-5243 / CVE-2024-5244 Proof-of-Concept PoC exploit chain targeting the TP-Link Omada ER605 DDNS client daemon cmxddnsd when the device is configured to use the Comexe DDNS service. ⚠️ Legal / Ethics : This...

CVE-2026-85983

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the...

CVE-2026-82001

Acrobat Reader is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue requires...

CVE-2026-86994 n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast ...

CVE-2026-77827

Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalation for a standard user account via improper write privileges in 'C:\ProgramData\Maono'. Fixed in 4.0.80...

CVE-2026-80863

A flaw was found in the Linux kernel's RDMA/rxe component. A local user could exploit a memory corruption vulnerability in the freerdatomicresources function by updating the maxdestrdatomic value before the old array is properly freed, leading to an out-of-bounds write. This issue can cause a...

CVE-2026-3333-DNS-Rebinding-to-Steal-Cloud-Metadata

CVE-2026-3333 – DNS Rebinding to Steal Cloud Metadata Program Code Python attacker server + vulnerable app root@kitploit: !/usr/bin/env python3 dnsrebindingserver.py - Malicious DNS server that alternates between attacker IP and 169.254.169.254 import socket, threading, time This simple server...

CVE-2020-28488

CVE-2020-28488 Denial of Service DoS - jQuery UI 1.12.1 - Exploit Payload root@kitploit: for var i = 0; i DoS - jQuery UI 1.12.1 DoS - jQuery UI 1.12.1 Exploit PoC by Rafael Cintra Lopes function exploit for var i = 0; i...

EUVD-2026-69231

xmldom: Quadratic-time attribute deduplication...

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

Summary On the @xmldom/xmldom 0.8.x line, parsing an XML end tag whose name is followed by a long run of whitespace and then a non-whitespace character triggers quadratic-time regular-expression backtracking ReDoS, so a single small crafted end tag stalls the Node.js event loop. It is reachable...

EUVD-2026-69236

xmldom: Quadratic-memory consumption...

xmldom: Quadratic-memory consumption

Summary When an element declares a namespace prefix, xmldom copies the entire in-scope namespace map into a fresh object and keeps that copy on the element while it is open on the parse stack. A crafted document that nests N elements, each declaring one unique prefix, therefore drives the parser ...

EUVD-2026-69234

xmldom: Quadratic-time parsing via the malformed-input recovery path — parseElementStartPart re-scan and normalize adjacent-text merge...

xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

Summary xmldom's malformed-input error-recovery path has two quadratic-time On² behaviors that a single crafted input triggers together, so a tiny, highly compressible document tens of KB stalls the Node.js event loop for multiple seconds. It is reachable from DOMParser.parseFromString under...

EUVD-2026-69227

xmldom: HTML raw-text closing-tag case mismatch causes output amplification...

xmldom: HTML raw-text closing-tag case mismatch causes output amplification

Summary In HTML mode text/html, a raw-text element script, style, textarea, title whose closing tag differs in case from its opening tag e.g. for is mishandled by the parser, producing quadratic On² output growth — a small crafted document parses and serializes into output orders of magnitude...

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

Summary An improper CRLF neutralization flaw in Predis' pipeline handling on aggregate connections lets an unauthenticated attacker who can influence any pipelined argument — a value or a key, e.g. a URL slug used as a cache key — smuggle arbitrary Redis commands into the connection. - On cluster...

CVE-2006-20001

CVE-2006-20001 A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier. authentication| complexity|...

Colord: Slow rejection of oversized malformed color strings

Impact colord's CSS color string matchers described a number as +-?\d.?\d+. In that form \d and \d+ can match the same digits, so a run of n digits can be divided between them in On² ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long...

CVE-2024-21413-POC

CVE-2024-21413 - POC Usage: python CVE-2024-21413.py -host example.com -port 25 -from [email protected] -recipient [email protected] -url xx.xx.xx.xx/path/to/shared/file/r0tb1t.rtf !NOTE r00tb1t : is the shared test file word in this case from the attacker machine xx.xx.xx.xx. To ensure...