Wincrash

Wincrash root@kitploit: I'm not responsible for what you use this to accomplish and should only be used for education purposes. CVE-2019-0708 - when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code...

Unauthenticated-CVE-2020-0796-PoC

Unauthenticated CVE-2020-0796 Proof-of-Concept All the proofs-of-concept scripts I've seen at this point have required both a username and a password. Therefore I decided to post my own PoC. It's nothing fancy, but it works. It doesn't require any additional modules and works with Python 3. Usage...

CVE-2023-40459

CVE-2023-40459 CVE-2023-40459 Unauthenticated DoS PoC Exploit. this vulnerability affects the ACEManager component of ALEOS 4.16 and earlier, a product of Sierra Wireless. Usage python3 PoC-CVE-2023-40459.py Address: http://target Port: 9091 Refrence NVD Article Double Take Zero Day...

CVE-2026-67184-Unauthenticated-NULL-Pointer-Dereference-Crashes-the-Server-TinyWeb-

Security Advisory: Unauthenticated NULL Pointer Dereference Crashes the Server TinyWeb Assigned CVE ID: CVE-2026-67184 Summary When TinyWeb fails to parse a request line, it returns an error but leaves the request's URL pointer set to NULL. The caller ignores the error and passes the request to t...

CVE-2024-10511

CVE-2024-10511 CWE-287: Improper Authentication Summary Schneider Electric PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations PowerChute Serial Shutdown v1.2.0.301 and prior...

EUVD-2026-83207

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query...

CVE-2026-93592

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

EUVD-2026-82676

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

CVE-2026-25075-check

CVE-2026-25075 Vulnerability Assessment Tool Safely detect whether a strongSwan VPN server is vulnerable to CVE-2026-25075 without causing any disruption. See the full write-up at the Bishop Fox blog. Description CVE-2026-25075 is an integer underflow vulnerability in strongSwan's EAP-TTLS plugin...

Fedora 44 : nodejs-undici (2026-90bb0fcd50)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-90bb0fcd50 advisory. Update to version 7.29.0. Contains fix for CVE-2026-18149. Tenable has extracted the preceding description block directly from the Fedora security advisory...

CVE-2026-86040 libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and...

CVE-2026-38361

CVE-2026-38361: Multiple Unauthenticated DoS Vulnerabilities in dash-uploader...

CVE-2026-26235-JUNG-Smart-Visu-Server-Unauthenticated-Reboot-Shutdown

👤 作者 Mohammed Idrees Banyamer 📍 国家： 约旦 📸 Instagram： @banyamersecurity CVE-2026-26235 的概念验证漏洞利用程序 - 通过 JUNG Smart Visu Server ≤ 1.1.1050 中缺失的身份认证实现未认证拒绝服务。 🚨 漏洞描述 CVE-2026-26235 是 JUNG Smart Visu Server 版本 ≤ 1.1.1050 中的一个未认证拒绝服务漏洞。该产品未能对关键系统管理功能实施身份认证，允许远程攻击者通过单个 POST 请求重启或关闭服务器。 端点...

dlink-dir-819-dos

CVE-2022-40946 Exploit: Unauthenticated Denial of Service in DLink consumer DIR 819 A1 routers Exploit Fetch the sources root@kitploit: $ git clone https://github.com/whokilleddb/dlink-dir-819-dos $ cd dlink-dir-819-dos $ pip install -r requirements.txt Run the exploit root@kitploit: $ ./exploit....

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS 通过 React Flight 协议实现未认证远程拒绝服务 服务器组件 Map 反序列化中的二次方 CPU 耗尽 概述 • 工作原理 • 工具 • 安装 • 用法 • Nuclei • 修复 • 免责声明 漏洞概述 字段| 详情 ---|--- CVE ID| CVE-2026-23869 别名| React2DoS CVSS 评分| 7.5（高危） CVSS 向量| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE| CWE-400（未受控的资源消耗） 类型| 未认证远程拒绝服务...

cve-2026-34473-unauthenticated-dos-zte-routers

CVE-2026-34473: Unauthenticated Denial of Service in ZTE Routers affecting 140K+ devices worldwide 17+ models Technical breakdown of CVE-2026-34473, published from the original disclosure set and firmware-analysis artifacts. Live site:...

CVE-2026-50787

CVE-2026-50787 — e-SIC Livre 中的不受控制的资源消耗 摘要 e-SIC Livre esiclivre 的 CAPTCHA 生成组件中存在资源消耗漏洞。 该易受攻击的端点接受用户可控的参数，这些参数定义了 CAPTCHA 图像的尺寸、字体大小以及要渲染的字符数量。这些值在使用时没有进行适当的边界检查。 未经身份验证的远程攻击者可以提供过大的值，导致应用程序在图像创建和文本渲染过程中消耗大量内存和 CPU 资源。这可能导致应用程序超时、HTTP 5xx 响应、工作进程耗尽或拒绝服务。 受影响项目 项目： e-SIC Livre 仓库：...

CVE-2026-1168

GitLab CE/EE is affected by a denial of service vulnerability in the GraphQL complexity calculation logic , where improper resource allocation limits allow an unauthenticated attacker over the network to exhaust server resources. The issue affects all versions from 18.4.6 before 19.1.8 , 19.2 bef...

EUVD-2026-80083

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these...

EUVD-2026-80066

On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate prematurely. This may result in traffic loss following a restart event...