CVE-2026-50416-writeup-and-poc

CVE-2026-50416: One QWORD Too Many in the Desktop Heap On Windows 11 Insider build 10.0.28020.2149, the user mode mapping of the Win32k desktop heap exposed a raw kernel session pool pointer at offset 0x100. The read itself is almost offensively small: root@kitploit: ULONG64 leaked = ULONG64...

CVE-2023-20598-PDFWKRNL

A Proof of Concept exploit for AMD Radeon Driver PDFWKRNL.sys intended to be able to work from a Low Integrity process...

CVE-2021-44852

CVE-2021-44852 An issue was discovered in BSRCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700. A low-integrity process can open the driver's device object and issue IOCTLs to read or write to arbitrary physical memory locations or call an arbitrary address, leading to execution of arbitrary code...

python313-aiosmtplib-5.1.3-1.1 on GA media (moderate)

python313-aiosmtplib-5.1.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11799-1 Rating: moderate Cross-References: CVE-2026-90467 CVSS scores: CVE-2026-90467 SUSE : 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N CVE-2026-90467 SUSE : 6.3...

Fedora 44 : stb (2026-2a592f622a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2a592f622a advisory. Patch stbsprintf: security fix for CVE-2026-79516 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Kernel-Arbitrary-Read-Vulnerability-Superfetch-EOP

Kernel-Arbitrary-Read-Vulnerability-Superfetch-EOP Kernel Arbitrary Read Vulnerability + Superfetch EOP based on reacher from https://starlabs.sg/blog/2022/06-trying-to-exploit-a-windows-kernel-arbitrary-read-vulnerability/ . Exploit must be run from low integrity...

CVE-2026-26717

CVE-2026-26717: HMAC Timing Attack in OpenFUN Richie LMS Author: Elvin Latifli CVE ID: CVE-2026-26717 Severity: Medium CVSS 3.1: 4.8 — AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Product: OpenFUN Richie all versions prior to commit a1b5bbd Affected Component: src/richie/apps/courses/api.py —...

CVE-2022-22715

Blogpost: https://whereisk0shl.top/post/break-me-out-of-sandbox-in-old-pipe-cve-2022-22715-windows-dirty-pipe Exploit needs to be executed from LOW INTEGRITY Cleanup is not completed. The exploit just fix the overwritten TOKEN objects but not the VS pool structure. This part is explained in the...

Fedora 45 : ruby (2026-ab0c751524)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ab0c751524 advisory. This rpm updates included resolv gem to 0.7.2 to resolve CVE security issues. Tenable has extracted the preceding description block directly from th...

openSUSE 16 Security Update : libidn (openSUSE-SU-2026:21758-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21758-1 advisory. This update for libidn fixes the following issue: - CVE-2026-57053: out-of-bounds read in ToUnicode APIs bsc1268965. Tenable has extracted the preceding...

PT-2026-86963

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

Fedora 45 : openvkl / rkcommon (2026-ca74beef5f)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ca74beef5f advisory. Update to the latest version to fix CVE-2026-21399 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

CVE-2026-71144

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hyperion Financial...

Fedora 44 : libidn (2026-2291be7d88)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2291be7d88 advisory. Security fix for CVE-2026-57053. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2026-66775 Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

PT-2026-70047

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter does not enforce cross-site request forgery CSRF protection on the authentication flow by default. CSRF is a type of attack that tricks a victim into submitting a maliciou...

Photon OS 5.0: Runc PHSA-2024-5.0-91-0375

An update of the runc package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0375. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-65922

Technical details for CVE-2026-65922 are not publicly provided in the supplied documents; monitor for updates.

CVE-2026-41853

A flaw was found in Spring MVC and WebFlux applications, components of the Spring Framework. This vulnerability allows a remote, unauthenticated attacker to perform Multipart request smuggling attacks. Such an attack can lead to a low integrity impact, potentially enabling the attacker to bypass...

CVE-2026-48805

A flaw was found in Twig, a template language for PHP. Deprecated internal wrappers in the src/Resources/core.php file do not correctly forward the sandbox state. This allows legacy function calls, such as twigarraysome, to bypass security restrictions imposed by the sandbox. An attacker could...