CVE-2025-9784

CVE-2025-9784 MadeYouReset HTTP/2 漏洞测试 概述 本仓库包含一个简单实用的 Bash 脚本，用于测试 Undertow HTTP/2 服务器实现中的 CVE-2025-9784 漏洞（即“MadeYouReset”HTTP/2 拒绝服务（DoS）攻击）。该漏洞允许攻击者通过反复触发服务器端的流重置，导致服务器工作负载过高，进而可能引发服务中断。 特性 检测目标服务器是否支持 HTTP/2 协议。 测量基准响应时间。 模拟快速并发创建 HTTP/2 流以触发重置。 分析服务器在负载下的响应行为。 提供直观的漏洞评估报告。 开始使用 前提条件 Bash...

CVE-2026-92230

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle...

caldera-agent

Agente CALDERA La carpeta calderaagent contiene el código fuente del agente CALDERA o cagent , un servicio de Windows que facilita la comunicación entre el servidor CALDERA y los CALDERA Rats. El programa cagent debe instalarse en cada computadora que participe en la operación de emulación de...

NINJA-PingU

NINJA PingU NINJA-PingU No es Solo una Utilidad de Ping es una herramienta gratuita de escaneo de red de alto rendimiento y código abierto para análisis a gran escala. Ha sido diseñado con el rendimiento como su objetivo principal y desarrollado como un marco para permitir la creación fácil de...

CVE-2026-92230

Apache Karaf is vulnerable due to improper release of ClassLoader references in its XmlUtils component. XML parser and transformer factories are cached in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bund...

CVE-2026-54571

ESPAsyncWebServer (an asynchronous HTTP/WebSocket server library for ESP32, ESP8266, RP2040, and RP2350) contains an integer overflow in its multipart/form-data parser (src/WebRequest.cpp). Prior to version 3.11.1, the _boundaryPosition variable is stored as an 8-bit value ; a remote request with...

CVE-2026-54451 Elixir protobuf: Unbounded recursion depth in embedded-message decoding

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex,...

Moderate: Red Hat Security Advisory: rrdtool security update

An update for rrdtool is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

BlockGuard

🛡️ BlockGuard — 基于进程的文件访问安全代理 BlockGuard 是一款 Windows 数据丢失防护 DLP 代理，可在进程级别拦截并控制文件访问。它确保只有授权进程 （通过可执行文件路径、加密哈希、验证码签名和完整性级别识别）才能读取受保护文件。所有其他进程默认通过 NTFS ACL 在操作系统内核级别被拒绝访问 。 📑 目录 功能特性 架构 UI 管理界面 先决条件 快速开始 配置 运行代理 验证运行效果 项目结构 工作原理 故障排除 安全考量 贡献 ✨ 功能特性 🏗️ 架构 BlockGuard 采用三层模块化架构 ：...

CVE-2026-52836 OpenDDS: out-of-bounds `rd_ptr` dereference in `RtpsSampleHeader::init` — triggered by malformed RTPS submessage, remotely exploitable denial of service

OpenDDS is an open source C++ implementation of the Object Management Group OMG Data Distribution Service DDS. Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes...

Important: Red Hat Security Advisory: perl-XML-LibXML security update

An update for perl-XML-LibXML is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names

A flaw was found in XML::LibXML for Perl. A remote attacker could exploit this vulnerability when processing specially crafted XML node names containing incomplete UTF-8 character sequences. This can lead to an out-of-bounds read in heap memory, potentially causing the application to crash and...

CVE-2026-44235

rabbitmq-c (a C-language AMQP client library) prior to 0.16.0 contains an unsigned size_t underflow in amqp_handle_input() (librabbitmq/amqp_connection.c). A malicious AMQP server can send an undersized HEADER or METHOD frame during client login, causing the computed encoded.len to wrap to 0xffff...

CVE-2026-44235 rabbitmq-c: size_t underflow in AMQP frame length computation leads to out-of-bounds read

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned sizet underflow in amqphandleinput in librabbitmq/amqpconnection.c. The parser subtracts HEADERSIZE, fixed...

CVE-2026-44236 rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.framemax value during amqplogin, and rabbitmq-c accepts the value in amqplogininner in librabbitmq/amqpsocket.c. amqptuneconnection in...

CVE-2026-21986-VirtualBox-DoS

CVE-2026-21986 - Agotamiento de Memoria del Kernel en Carpetas Compartidas de VirtualBox DoS Resumen Este repositorio contiene una prueba de concepto y un informe técnico sobre CVE-2026-21986, una vulnerabilidad de denegación de servicio en Oracle VM VirtualBox. El problema existe en la interfaz...

CVE-2026-54580 mport index decompression can leave partial or corrupt index data after zstd failures

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mportdecompresszstd, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply...

CVE-2026-54580

mport , the MidnightBSD Package Manager, is vulnerable prior to version 2.7.8 in its zstd decompression handling. In libmport/util.c , the function mport_decompress_zstd() did not make every truncated, corrupt, or failed zstd stream fatal, and libmport/fetch.c did not consistently propagate those...

CVE-2026-92063

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Audio/Video component...

CVE-2026-81516

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A...