Windows Kerberos Elevation of Privilege Vulnerability

Numeric truncation error in Windows Kerberos allows an authorized attacker to elevate privileges locally...

Windows Kernel Elevation of Privilege Vulnerability

Numeric truncation error in Windows Kernel allows an authorized attacker to elevate privileges locally...

Windows Spaceport.sys Elevation of Privilege Vulnerability

Numeric truncation error in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally...

Microsoft Office Word Remote Code Execution Vulnerability

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-41096

CVE-2026-41096 - 崩溃 PoC DnsRawTruncateMessageForUdp（dnsapi.dll）中存在堆溢出。当截断逻辑错误计算目标指针时，带有 QDCOUNT=0 和大型 OPT 记录的特制 DNS 响应会导致 604 字节的堆溢出。 MSRC 公告： https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096 组件 File| Description ---|--- roguednsserver.py| 恶意 DNS 服务器（Python 3）。对每个查询都回复一个...

PT-2026-88629

Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-20253

🚨 CVE-2026-20253 - Splunk Enterprise 未认证文件创建高危漏洞 未认证的任意文件创建与截断漏洞，影响Splunk Enterprise与Splunk Cloud Platform。 📖 执行摘要 CVE-2026-20253 是 Splunk Enterprise 与 Splunk Cloud Platform 中的一个高危漏洞，允许未认证的远程攻击者通过暴露的PostgreSQL sidecar服务端点创建或截断任意文件。 由于受影响的功能缺乏认证控制，攻击者可在无有效凭证的情况下执行文件操作。 成功利用可能导致： 任意文件创建 文件截断 数据破坏...

CVE-2026-41096-POC

这个 bug 位于 DnsQueryRaw 函数中（具体来说，在 DnsRawTruncateMessageForUdp 内部），所以你需要一个程序来调用它。 我也许是错的，但目前在 Windows 11 中没有任何服务或默认程序使用这个函数，这就是为什么我需要 client.c。 这个仓库有两个文件：client.c 和 poc.py： client.c：它实现了 DnsQueryRaw（你需要根据你的配置替换接口索引） poc.py：触发器使用 scapy，你必须将变量 iface 替换为你攻击机上的接口 我把这个漏洞的利用留作练习，祝好 附注：Windows 10 是安全的，那个函...

CVE-2026-86287 Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

SSH-Terrapin-Prefix-Truncation-Weakness-CVE-2023-48795-Checker

terrapincheck.py Un escáner ligero en Python para CVE-2023-48795 — la vulnerabilidad de truncamiento de prefijo Terrapin en SSH. Terrapin es una vulnerabilidad a nivel de protocolo en SSH que permite a un atacante realizando un MitM activo truncar la información de extensión negociada, degradando...

CVE-2025-47812

CVE-2025-47812 这是 Wing FTP 服务器漏洞（CVE-2025-47812）的概念验证（PoC） 描述 Wing FTP Server 7.4.4 之前的版本因对用户名参数的不安全处理而存在远程代码执行（RCE ）漏洞。当我们在 /loginok.html 页面登录时，可以注入空字节 %00 后跟 Lua 代码，以实现 RCE。 背景事件 当我们向 loginok.html 页面发送 POST 请求时，cCheckUser 函数（用于验证正确用户名和密码的函数）使用了 strlen。问题在于该依赖函数容易受到空字节截断的影响。 这意味着如果我们在用户名后发送...

CVE-2026-86315

A flaw was found in Samsung Open Source Escargot. This out-of-bounds write vulnerability, caused by numeric truncation, allows an attacker to corrupt native memory. By supplying specially crafted JavaScript for execution, a remote attacker can trigger this flaw, leading to the host process crashi...

CVE-2026-86315

An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16MA...

CVE-2026-86315

An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16MA...

CVE-2026-86315

Samsung Open Source Escargot (a JavaScript engine) on Linux x86-64 is affected by an out-of-bounds write caused by numeric truncation. A crafted class definition whose instance initialization entry count exceeds UINT16_MAX allows an attacker who can supply JavaScript for execution to corrupt nati...

Linux Distros Unpatched Vulnerability : CVE-2026-80760

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it...

Linux Distros Unpatched Vulnerability : CVE-2026-86315

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to...

CVE-2026-84947 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...

CVE-2026-84947

CVE-2026-84947 affects undici (Node.js HTTP client), specifically its dump interceptor . When a chunked response (no Content-Length) exceeds the configurable maximum body size, the interceptor signals completion early without pausing or aborting the request. The underlying parser then delivers a ...

CVE-2026-84947 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...