CVE-2026-104182

The stream-json micro-library is vulnerable to a Denial of Service (DoS) via a flaw in its JSONC parser (specifically at stream-json/jsonc/parser.js and stream-json/jsonc/verifier.js). Prior to version 3.6.0 , the parser restarts comment-terminator scanning from the opening slash whenever a block...

CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

CVE-2025-9784

CVE-2025-9784 MadeYouReset HTTP/2 漏洞测试 概述 本仓库包含一个简单实用的 Bash 脚本，用于测试 Undertow HTTP/2 服务器实现中的 CVE-2025-9784 漏洞（即“MadeYouReset”HTTP/2 拒绝服务（DoS）攻击）。该漏洞允许攻击者通过反复触发服务器端的流重置，导致服务器工作负载过高，进而可能引发服务中断。 特性 检测目标服务器是否支持 HTTP/2 协议。 测量基准响应时间。 模拟快速并发创建 HTTP/2 流以触发重置。 分析服务器在负载下的响应行为。 提供直观的漏洞评估报告。 开始使用 前提条件 Bash...

CVE-2026-102514 Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive

Out-of-bounds Write CWE-787 in the PEA archive extraction routine pea.pas, unpeaprocedure of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While...

CVE-2026-102667 Joyland AI WebView command injection

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

EUVD-2026-91025

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-102667

The Joyland AI app is vulnerable to a JavaScript injection flaw in its WebView component, exploitable by an attacker with shared network access . The root cause allows unauthorized access to the clipboard , app-internal storage , and the ability to make arbitrary HTTP requests via the Weex 'strea...

CVE-2026-30741

安全公告：CVE-2026-30741 产品：OpenClaw Agent 平台 受影响版本：v2026.2.6 及更早版本 漏洞类型：通过请求侧提示注入实现的远程代码执行（RCE） 描述：对上游 API 请求缺乏完整性验证，导致请求流被污染。这会诱导高性能模型生成未经人工确认的、通过 MCP 工具执行的未授权终端命令。 📺 概念验证（PoC） 您的浏览器不支持视频标签。 图 1：通过请求侧提示注入实现 RCE 的演示 外部镜像 ：哔哩哔哩（BV1LoFazeEBM） 致谢 ：Namedless 参考编号 ：CNVD-2026-11444...

pypdf: Possible long runtimes when generating appearance streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation. PatchesThis has been fixed in pypdf==6.19.0. WorkaroundsIf you cannot upgrade yet, consider...

PYSEC-2026-4177 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

Impact urllib3's streaming API is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When decoding a chunked-transfer-encoded response, this API reads each chunk's size field by buffering until...

CVE-2026-33657

CVE-2026-33657 - EspoCRM 9.3.3 邮件通知中的存储型 HTML 注入 针对 EspoCRM 9.3.3 邮件通知中存储型 HTML 注入的已认证概念验证。 概述 EspoCRM 9.3.3 在渲染流动态通知邮件时，会通过 Markdown 转换动态正文，并将生成的 HTML 使用三重大括号（post）插入到邮件模板中。能够创建流动态帖子并触发通知的已认证用户，可以存储攻击者控制的 HTML，该 HTML 随后会在生成的邮件正文中被渲染。 该漏洞利用执行了攻击者控制的远程部分流程： 1. 向 EspoCRM 进行身份验证。 2. 可选地通过...

Zapscape-Fix

Zapscape-Fix — CVE-2026-64561 KVM 内核热补丁 English | 简体中文 给 CentOS Stream 8 / RHEL 8 （4.18.0 全系列内核）的 KVM 宿主机修复 CVE-2026-64561（Zapscape） 漏洞的内核热补丁 ： 不打补丁的风险 ：租户虚拟机（guest）可以仅凭自身操作逃逸到宿主机，以宿主 内核 root 权限执行代码——击穿整台物理机及其上所有虚拟机。 本项目的补丁 ：基于 Linux 上游官方修复（2abd5287f083）backport 而来， 通过内核 livepatch 机制在线生效 ： ✅ 不重启宿...

CVE-2026-22019-libcurl-HTTP-2-CONNECT-Tunnel-Mixup

CVE-2026-22019 – libcurl HTTP/2 CONNECT 隧道混淆 程序代码（C 模拟） // curlhttp2tunnelmixup.c - Simulated libcurl handling CONNECT over HTTP/2 include void handlehttp2streamint streamid // Vulnerability: after CONNECT, the proxy mixes streams with the tunneled data if streamid == 0 printf"CONNECT to target\n...

EUVD-2026-81601

vm2: Incomplete nodejs. symbol filtering lets sandbox override host WebStream state checks...

EUVD-2026-90384

pypdf: Possible long runtimes when generating appearance streams...

CVE-2021-3007-docker-poc

CVE-2021-3007 — Laminas/Zend HTTP 反序列化远程代码执行 本仓库包含 CVE-2021-3007 的完整可复现概念验证（PoC）及 Nuclei 利用模板。该漏洞是 Zend\Http\Response\Stream（laminas-http Nuclei 利用模板 ├── docker-compose.yml - 脆弱测试环境 ├── Dockerfile ├── vulnerable-app/ │ ├── index.php - unserialize 脆弱端点 │ └── composer.json - 脆弱依赖 ├── exploit.php -...

USN-8861-1 openssl vulnerabilities

It was discovered that OpenSSL had an inefficient algorithm in its QUIC stream reassembly implementation. A remote attacker could possibly use this issue to cause OpenSSL to use excessive CPU resources, leading to a denial of service. CVE-2026-42772 It was discovered that OpenSSL did not properly...

tomcat-embed-core-9.0.31-CVE-2020-11996

请参见 TestHttp2Section51.java 的 testImplicitCloseLargeId 单元测试中的 PoC：https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996/blob/master/test/org/apache/coyote/http2/TestHttp2Section51.java...

BIT-PHP-MIN-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

BIT-PHP-MIN-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...