vuln-poc-research-skill

Vuln-Poc-Research Skill Chinese vuln-poc-research is a...

PT-2026-56175

Name of the Vulnerable Software and Affected Versions apache-airflow versions prior to 3.3.0 Description A bug in the BaseSerialization.deserialize function allows unrestricted import string of attacker-controlled class paths when the Scheduler or API Server loads a serialized DAG. A DAG author c...

CVE-2026-11610: Heap-based Buffer Overflow

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. After a successful SASL bind with integrity protection SSF 0, an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer...

CVE-2026-14969: Generation of Predictable IV with CBC Mode

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext block...

Linux Distros Unpatched Vulnerability : CVE-2026-14474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for...

Oracle Linux 9 : 389-ds-base (ELSA-2026-36195)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36195 advisory. - Resolves: RHEL-182159 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasliorecv via padded SASL UNBIND rhel-9.8.z Tenable has...

Linux Distros Unpatched Vulnerability : CVE-2026-14969

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations,...

@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresses. However, a method to bypass exists...

GHSA-WW9Q-8R59-XV46 Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

Summary A soundness vulnerability in the variable-base scalar multiplication gadget of halo2gadgets allowed a malicious prover to produce a valid proof for an Orchard Action with an under-constrained base point. Because this gadget enforces the diversified-address-integrity condition of the Orcha...

Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

Summary A soundness vulnerability in the variable-base scalar multiplication gadget of halo2gadgets allowed a malicious prover to produce a valid proof for an Orchard Action with an under-constrained base point. Because this gadget enforces the diversified-address-integrity condition of the Orcha...

UBUNTU-CVE-2025-15668

A vulnerability was identified in GPAC up to b40ce70f5. This issue affects the function sgpddelentry of the file src/isomedia/boxcodebase.c of the component MP4Box. Such manipulation of the argument data leads to heap-based buffer overflow. Local access is required to approach this attack. The...

CVE-2025-15668 GPAC MP4Box box_code_base.c sgpd_del_entry heap-based overflow

A vulnerability was identified in GPAC up to b40ce70f5. This issue affects the function sgpddelentry of the file src/isomedia/boxcodebase.c of the component MP4Box. Such manipulation of the argument data leads to heap-based buffer overflow. Local access is required to approach this attack. The...

OESA-2026-2841 qt5-qtbase security update

This package provides base tools, such as string, xml, and network handling. Security Fixes: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an...

Matrix Synapse DoS

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

UTT HiPER 1250GW DoS

The vulnerability of the /goform/ConfigWirelessBase5g file of the Web Endpoint component of the microprogramming software for routers UTT HiPER 1250GW is related to the escape of operations from the buffer into memory. Exploiting this vulnerability could allow a malicious actor to cause service...

PT-2026-56057

Name of the Vulnerable Software and Affected Versions zebrad versions prior to 5.0.0 halo2 gadgets versions prior to 0.5.0 orchard versions prior to 0.14.0 zcash primitives versions prior to 0.28.0 zcashd versions prior to 6.20.0 Description A soundness issue in the variable-base scalar...

ROS-20260706-73-0029

The vulnerability of the pgbasebackup and pgrewind utilities in the PostgreSQL database management system is related to deficiencies in the mechanism for handling symbolic references. Exploiting this vulnerability allows a malicious actor to rewrite any files remotely...

ROS-20260706-73-0028

The vulnerability of the pgbasebackup and pgrewind utilities in the PostgreSQL database management system is related to deficiencies in the mechanism for handling symbolic references. Exploiting this vulnerability allows a malicious actor to rewrite any files remotely...

CVE-2026-14721

A vulnerability has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects an unknown function of the file /goform/ConfigWirelessBase5g of the component Web Endpoint. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack is possible to be carried o...

CVE-2026-14721

CVE-2026-14721 affects UTT HiPER 1250GW (up to 3.2.7-210907-180535). The vulnerability is in the Web Endpoint’s /goform/ConfigWirelessBase_5g function, where manipulating the ssid argument causes a stack-based buffer overflow. It can be exploited remotely, and the exploit has been disclosed publi...