cve-2025-2082-POV

CVE-2025-2082 – Function Pointer Overwrite PoV VCSEC-style This repository demonstrates a Proof of Vulnerability PoV simulating a critical memory corruption flaw inspired by CVE-2025-2082, discovered in Tesla's VCSEC Vehicle Controller Security component. The vulnerability allows an attacker to...

cve-2022-49186-research

CVE-2022-49186: Linux Kernel Privilege Escalation Research Overview Security research and proof-of-concept exploit for CVE-2022-49186, a Linux kernel vulnerability in the Visconti clock driver that enables local privilege escalation through array overflow. Vulnerability Details Type : Array...

CVE-2026-101937

A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic...

CVE-2026-101937 Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used

A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic...

EUVD-2026-101489

A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic...

PT-2026-113792

A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic...

CVE-2026-101937: Signed to Unsigned Conversion Error

A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic...

Signed to Unsigned Conversion Error

Overview Affected versions of this package are vulnerable to Signed to Unsigned Conversion Error due to unsigned leafindex values being compared as signed integers in GroupKeySet.SecretTree.hasLeaf and Group.validateRemove. An attacker can exhaust heap memory and crash the JVM by sending a small...

Signed to Unsigned Conversion Error

Overview Affected versions of this package are vulnerable to Signed to Unsigned Conversion Error due to unsigned leafindex values being compared as signed integers in GroupKeySet.SecretTree.hasLeaf and Group.validateRemove. An attacker can exhaust heap memory and crash the JVM by sending a small...

CVE-2026-17507: Signed to Unsigned Conversion Error

In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...

AZL-99918 CVE-2026-85769 affecting package libtpms for versions less than 0.9.6-9

A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...

Exploit for CVE-2026-85769

CVE-2026-85769 Heap out-of-bounds read in libtpms TPM 2.0...

CVE-2026-85769

A heap out-of-bounds read in libtpms (software TPM 2.0 emulation, commonly deployed via swtpm in virtual machines) occurs during TPM 2.0 volatile-state restoration. An attacker-controlled oversized skip-block length in block_skip_read() drives a signed size counter negative; a subsequent signed-t...

CVE-2026-85769

A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...

AZL-94208 CVE-2026-55737 affecting package erlang for versions less than 26.2.5.21-4

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format ETF binary to binarytoterm/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGETUPLEEXT term, the...

CVE-2026-55737

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format ETF binary to binarytoterm/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGETUPLEEXT term, the...

PT-2026-64987

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 25.0 through 27.3.4.14 Erlang OTP versions 28.0 through 28.5.0.3 Erlang OTP versions 29.0 through 29.0.3 Description A signed to unsigned conversion error leads to an out-of-bounds write when the system processes a crafted...

Signed to Unsigned Conversion Error

Overview Affected versions of this package are vulnerable to Signed to Unsigned Conversion Error via the istreamnonparallelread function in ImfContextInit.cpp when parsing a malformed EXR file through a memory-mapped IStream. An attacker can cause a heap buffer overflow by supplying a specially...

EUVD-2014-9729

Malware in sbrugna...

CVE-2025-30646

A Signed to Unsigned Conversion Error vulnerability in the Layer 2 Control Protocol daemon l2cpd of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated adjacent attacker sending a specifically malformed LLDP TLV to cause the l2cpd process to crash and restart...