CVE-2023-5178

CVE-2023-5178 The exploit for CVE-2023-5178: NVMe-oF-TCP vulnerability, which is a logic error in NVMe-oF-TCP driver during the handle of corrupted Initialize Connection Request. It leads to racy double-free in kmalloc-96 , which can be exploited to gain LPEsee demo below. The exploit targets...

CVE-2026-86218

CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit Overview This is a Python 3 proof-of-concept exploit for CVE-2026-86218, a critical pre-authentication remote code execution vulnerability in N-able N-central. Vulnerability Details: CVE: CVE-2026-86218 CVSS Score: 10.0 Critical CWE: CWE-96...

SUSE CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

UBUNTU-CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

Astra Linux – Vulnerability in Firefox

Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs in Firefox 95. Some of these bugs exhibited signs of memory corruption, and we believe that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects...

Astra Linux – vulnerability in Chromium

Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the iframe sandbox of Google Chrome prior to version 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions through a crafted HTML page...

Malicious code in lexical_prawn_emerald-96 (npm)

Source: amazon-inspector dba5af5e1b3de7017320ecbfc9aad4be0313c156cd3a294c121cfc71aed2d488 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lengthy_mite_gold-96 (npm)

Source: amazon-inspector 8b0c2e131ea562a6017c6064609ccc0456f379bda8c886fb32bf3aa9808d8ee1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Astra Linux – Vulnerability in Chromium

In Google Chrome, using "after free" in V8 before version 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Before version 96.0.4664.93, using the "after free" mechanism in Google Chrome’s developer tools allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Astra Linux – Vulnerability in Firefox and Thunderbird

Certain network request objects were freed too early when releasing a network request handle. This could have led to a use-after-free condition, potentially causing a crash that can be exploited. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5...

Malicious code in intellectual_guan_harlequin-96 (npm)

Source: amazon-inspector 9d894a2652def21c774ecc37f6e5d26727257402bc87d2da3f9edcc16c45e796 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in improved_newt_yellow-96 (npm)

Source: amazon-inspector a8b8d18a28a6a28fdf081ed668064f01c70236cd42eaa18502f8b68753cb96d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in icha-96 (npm)

Source: amazon-inspector 1a81e84f35e15ae3eed7e225e4aef7ccbbaa353367e2f19f9e86e9a194ab0d6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hariyono-96 (npm)

Source: amazon-inspector b02e0638dadd44ef9ea9de01bd3b45cc9fcc7238c820714bd792ec7e39e60415 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in exciting_lynx_tan-96 (npm)

Source: amazon-inspector 6310422e7bde1114c6d758584d8b650b16aa47aca1513a417b23c8adc0027b94 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in everyday_swift_turquoise-96 (npm)

Source: amazon-inspector 8ec9abd788013bbd0a1b33f4c1db52255057c657d1f1289a095cf89ca63ae488 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...