CVE-2025-52099

CVE-2025-52099 an integer overflow in SQLite 3.50.0 A proof-of-concept PoC to trigger an integer overflow in SQLite 3.50.0's setupLookaside function is provided below. This overflow occurs due to unchecked multiplication of sz nBig, which can wrap into a negative value and result in invalid memor...

CVE-2017-14980

🐞 CVE-2017-14980: Sync Breeze Enterprise 10.0.28 - Stack-Based Buffer Overflow Stack-based buffer overflow in Sync Breeze Enterprise 10.0.28 reachable through the /login handler, demonstrating how unchecked input length can corrupt stack memory. 📑 Table of Contents Why this repository exists Why...

sysctl_coalition_get_pid_list-dos

sysctlcoalitiongetpidlist-dos The sysctlcoalitiongetpidlist function in bsd/kern/syscoalition.c uses the coalitiongetpidlist function to collect a list of PIDs in a coalition. This function will return the number of PIDs if successful or a negative errno on failure. However, the...

flow_divert-heap-overflow

flowdivert-heap-overflow flowdivert-heap-overflow is a proof-of-concept exploit for CVE-2016-1827, which was patched in OS X El Capitan 10.11.5 and iOS 9.3.2. The vulnerability is a series of unchecked arithmetic operations on an untrusted length supplied from user space in the function...

cve-2026-25994_PJSIP

CVE-2026-25994 – PJNATH ICE Stack Buffer Overflow pjsip ≤ 2.16 Overview CVE-2026-25994 is a stack-based buffer overflow vulnerability affecting the ICE Interactive Connectivity Establishment implementation in pjsip ≤ 2.16, specifically within the PJNATH component. The vulnerability exists in the...

Snappy-java: JVM Crash From Unchecked Ranges In Snappy.arrayCopy And SnappyOutputStream.rawWrite

Impact "Snappy.arrayCopyObject src, int offset, int byteLength, Object dest, int destOffset" called a native "memcpy" without validating the ranges. A negative or oversized "byteLength" or offset read or wrote outside the arrays and crashed the JVM. "SnappyOutputStream.rawWrite" and...

snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite

Impact Snappy.arrayCopyObject src, int offset, int byteLength, Object dest, int destOffset called a native memcpy without validating the ranges. A negative or oversized byteLength or offset read or wrote outside the arrays and crashed the JVM. SnappyOutputStream.rawWrite and...

GHSA-XQRX-QH46-34M7 snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite

Impact Snappy.arrayCopyObject src, int offset, int byteLength, Object dest, int destOffset called a native memcpy without validating the ranges. A negative or oversized byteLength or offset read or wrote outside the arrays and crashed the JVM. SnappyOutputStream.rawWrite and...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-111497 Google Brotli Unchecked Return Value...

CVE-2026-82943 Out-of-Bounds Read via Unchecked Length Values

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An...

CVE-2026-82943 Out-of-Bounds Read via Unchecked Length Values

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An...

CVE-2026-89319

The JweDirectDecryptorBlock.Decrypt function is vulnerable to a flaw where it reads a 64-bit plaintext length from the _thales_aad protected-header field without performing any validation. This lack of input validation leads to three distinct failure states: a truncated field causes a binary.BigE...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Unchecked Return Value in Libreswan (CVE-2026-14957)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Unchecked Return Value in Libreswan that can result in a denial of service condition in FIPS mode. Libreswan is used in our Speech Service runtimes This vulnerability has been addressed. Please read the details for remediation below...

CrowdStrike Channel File 291: An Engineering Analysis of a Global Endpoint Outage

On July 19, 2024, a CrowdStrike Falcon content update caused Windows systems to crash, affecting about 8.5 million devices according to a Microsoft estimate. The immediate defect was an inconsistency between a detection template that declared 21 inputs and sensor code that supplied 20. A new...

Amazon Linux 2023 : glycin-loaders (ALAS2023-2026-3215)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3215 advisory. Fix RUSTSEC-2026-0221: event-listener allows !Send tags to cross thread boundaries via StackSlot Fix RUSTSEC-2026-0186: Unchecked pointer offset in crate memmap2 Tenable has extracted the preceding...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: In virtiobt, there is a issue where skbPutskb, len is called before proper validation of len. len comes directly from virtqueuegetbuf, without any validation against the buffer that is posted to the device. The RX skb ...

Astra Linux – Vulnerability in libstb

stbimage is a single-file library licensed under MIT that is used for processing images. The stbigetn function reads a specified number of bytes from the context usually a file into the specified buffer. If the file stream points to the end of the file, it returns zero. There are two places where...

Astra Linux – Vulnerability in gst-plugins-good1.0

GStreamer is a library for constructing graphs of media-handling components. A OOB-read vulnerability has been discovered in the qtdemuxparsecontainer function within qtdemux.c. In the parent function qtdemuxparsenode, the value of length is not properly checked. As a result, if length is large...

Astra Linux – Vulnerability in libxml2

In libxml2 versions before 2.9.14, several buffer handling functions in buf.c xmlBuf and tree.c xmlBuffer do not check for integer overflows. This can lead to out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software that uses libxml2’s...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130100)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130100 advisory. Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication formerly JASPICServerAuthContext component...