Linux Distros Unpatched Vulnerability : CVE-2026-97986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtioinput: stop callbacks before unregistering input device virtinputremove unregisters the input device before resetting the virtio device. virtinputrecveven...

UBUNTU-CVE-2026-97946

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

CVE-2026-17545: Improper Handling of Windows Device Names

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

Linux Distros Unpatched Vulnerability : CVE-2026-98106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/pagemap: Prevent double migration of device pages A device-private folio migrated to system memory by a CPU fault can remain reachable through the raw-PFN...

UBUNTU-CVE-2026-97902

In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested thaw Commit 7366f8b6fc6a "fs: handle freezing from multiple devices" replaced the freezeholders bitmask with per-holder counters to allow nested freezes. In the bitmask version, a th...

CVE-2026-39372: Exposure of Private Personal Information to an Unauthorized Actor

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or...

SUSE CVE-2026-97432

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix P2P-Device binding handling Our binding handling for P2P-Device can run into the following scenario, as observed by our testing: - a station interface is connected on some channel - the P2P-Device does a...

SUSE CVE-2026-97475

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/tegra/soctherma: Switch to devm cooling device registration Use devmthermalofcoolingdeviceregister to simplify resource management and avoid manual cleanup in error paths. As a side effect this change has the...

Mi8E5-Unlocker-by-CVE-2026-43499

Mi 8e5 Unlock Toolkit Herramienta de desbloqueo automatizada para Mi 8e5 basada en CVE-2026-43499 Descripción del Proyecto Mi 8e5 Unlock Toolkit es una herramienta auxiliar de desbloqueo automatizado diseñada para el modelo Mi 8e5. El proyecto se basa en la investigación relacionada con...

CVE-2025-6018

CVE-2025-6018 + CVE-2025-6019 提权利用指南 📋 快速利用流程 步骤 1：准备 XFS 镜像（本地机器） 创建 300MB XFS 镜像 dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image 挂载并安装 SUID bash mkdir mnt sudo mount -t xfs xfs.image mnt sudo cp /bin/bash mnt/bash sudo chmod 4755 mnt/bash sudo umount mnt rmdir mnt 验证（应该显示 300...

CVE-2026-95699

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and...

blackboxprotobuf

Blackbox Protobuf Blackbox Protobuf now has an official package on PyPi under the namebbpb. The blackboxprotobuf package is an older fork Description Blackbox Protobuf is a set of tools for working with encoded Protocol Buffers protobuf without the matching protobuf definition. Protobuf is a bina...

UPnP-Pentest-Toolkit

UPnP Pentest Toolkit This tool aims to bring together a range of UPnP assessment features, enabling quick assessment with minimal configuration and set-up. It has been developed to aid security consultants in exploring, spoofing and manipulating of UPnP devices and the underlying protocols at wor...

umap2

Umap2 Umap2 es la segunda revisión de la herramienta de evaluación de seguridad de hosts USB basada en Python de NCC Group. Esta revisión tendrá todas las funciones que se admitían en la primera revisión: umap2emulate - emulación de dispositivos USB umap2scan - escaneo de hosts USB para...

IvantiInitrdDecryptor

Esta es una herramienta rápida y sucia para descifrar el initrd del dispositivo Ivanti. Es más que nada académica, ya que hay otras formas de extraer las claves LVM mucho más útiles del dispositivo raíz real. Para usarla, copia el archivo del kernel desde el Ivanti y extrae el ELF del bzImage usé...

CVE-2026-95699

The iSteamX mobile application (MrSteam) contains an improper isolation or compartmentalization vulnerability due to a flaw in its AWS policy . This policy allowed authenticated users to access wildcard MQTT topics , potentially exposing other users' device data and profile information. An attack...

EUVD-2026-86468

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and...

CVE-2026-95699 MrSteam iSteamX Improper Isolation or Compartmentalization

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and...

CVE-2026-82164

Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering...

Best-Practices-Cybersecurity-Otanata-Project

CP3418BestPracticesCybersecurityOTANATAProject CVE-2024-3273 — Authorized Penetration Test Report D-Link DNS-320L NAS | Client: Otonata Overview This repository contains the full security assessment report for an authorized penetration test conducted on a D-Link DNS-320L NAS device for client...