CVE-2019-11043-Docker

A docker image with a vulnerable version of PHP-FPM CVE-2019-11043 and nginx. Run docker run --rm -p8080:80 akamajoris/cve-2019-11043 You should be able to access the web application at http://your-ip:8080/. Exploitation Build a binary from https://github.com/neex/phuip-fpizdam, then...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...

CLEANSTART-2026-WA80249 NewNTUnicodeString does not check for string length overflow

CVE-2026-39824 affects multiple packages. NewNTUnicodeString does not check for string length overflow. See references for individual vulnerability details...

CLEANSTART-2026-OE38075 NewNTUnicodeString does not check for string length overflow

CVE-2026-39824 affects multiple packages. NewNTUnicodeString does not check for string length overflow. See references for individual vulnerability details...

CLEANSTART-2026-NY92907 NewNTUnicodeString does not check for string length overflow

CVE-2026-39824 affects multiple packages. NewNTUnicodeString does not check for string length overflow. See references for individual vulnerability details...

CLEANSTART-2026-NM66385 NewNTUnicodeString does not check for string length overflow

CVE-2026-39824 affects multiple packages. NewNTUnicodeString does not check for string length overflow. See references for individual vulnerability details...

CVE-2026-104016 jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr +...

CLEANSTART-2026-JU41154 NewNTUnicodeString does not check for string length overflow

Security vulnerability affects the gatekeeper-fips package. NewNTUnicodeString does not check for string length overflow...

PT-2026-132959

Security vulnerability affects the gatekeeper-fips package. NewNTUnicodeString does not check for string length overflow...

CLEANSTART-2026-ST70744 NewNTUnicodeString does not check for string length overflow

CVE-2026-39824 affects multiple packages. NewNTUnicodeString does not check for string length overflow. See references for individual vulnerability details...

BIT-THRIFT-2026-94634 Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default

Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CLEANSTART-2026-SV16183 NewNTUnicodeString does not check for string length overflow

CVE-2026-39824 affects multiple packages. NewNTUnicodeString does not check for string length overflow. See references for individual vulnerability details...

CVE-2026-106432 Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...

CVE-2026-106432

A heap buffer overflow exists in the MongoDB PHP Driver due to the BSON encoder converting string lengths to 32-bit values without validation. When an application encodes a string near 4 GiB , the allocation size can wrap while the copy operation uses the original length, potentially corrupting p...

CVE-2026-106432 Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...

CLEANSTART-2026-SU76745 NewNTUnicodeString does not check for string length overflow

CVE-2026-39824 affects multiple packages. NewNTUnicodeString does not check for string length overflow. See references for individual vulnerability details...

CVE-2026-94634 Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default

Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CLEANSTART-2026-SN04687 NewNTUnicodeString does not check for string length overflow

Security vulnerability affects the cri-tools package. NewNTUnicodeString does not check for string length overflow...

CLEANSTART-2026-SF11650 NewNTUnicodeString does not check for string length overflow

Security vulnerability affects the kube-state-metrics-fips package. NewNTUnicodeString does not check for string length overflow...

CLEANSTART-2026-UH45267 NewNTUnicodeString does not check for string length overflow

Security vulnerability affects the crane package. NewNTUnicodeString does not check for string length overflow...