ZKTeco BioTime <= 9.0.1 - Privilege Escalation

BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...

CVE-2025-55854-PoC

CVE-2025-55854 - Stored Cross-Site Scripting XSS Vulnerability Vulnerability Overview CVE ID: CVE-2025-55854 Vulnerability Type: Stored Cross-Site Scripting XSS Severity: High Affected Component: User Profile Bio Field Affected Application: FreelanceHub https://github.com/nooncarlett/FreelanceHub...

CVE-2026-22187-Bio-Formats-unsafe-Java-deserialization-via-.bfmemo

CVE-2026-22187-Bio-Formats-unsafe-Java-deserialization-via-.bfmemo Bio-Formats ≤ 8.3.0 performs unsafe Java deserialization of attacker-controlled .bfmemo cache files during image processing; crafted .bfmemo can trigger deserialization of untrusted data DoS/logic manipulation; potentially RCE if...

CVE-2021-24545

CVE-2021-24545 WP HTML Author Bio alert/XSS/ Then view post made by the author to trigger the XSS Video POC: https://www.youtube.com/watch?v=fhzJZ5hSI-g...

CVE-2021-24545

CVE-2021-24545 This is an XSS vulnerability discovered in a plugin that is no longer distributed as a plugin. WordPress Plugin HTML Author Bio description XSS This vulnerability is caused by improper validation of the description parameter in /wp-admin/profile.php. A remote attacker can exploit...

CVE-2026-126800

The Hydro @hydrooj/ui-default package, specifically versions before 4.59.1 , is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is located in markdown-it-xss.ts , where the application fails to properly handle double quotes in language- class tokens. A registered u...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix bio accounting for split md cloned bios Use mdclonedbio to control bio accounting instead of relying on r1bioexisted in raid1 or the ioaccounting flag in raid10. The previous logic does not reliably reflect...

CVE-2026-116541

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541

The netty-tcnative library before version 2.0.84.Final is vulnerable to a Denial of Service (DoS) flaw within the tcn_write_to_bytebuffer BIO write callback. The root cause is an incorrect calculation where the callback overreports the number of bytes consumed. This allow remote TLS 1.3 peers to ...

CVE-2026-116541 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116539 Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcnwritetobytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer,...

CVE-2026-116539 Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcnwritetobytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer,...

CVE-2026-116539 Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcnwritetobytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer,...

CVE-2026-116539

The netty-tcnative library, in versions prior to 2.0.84.Final , contains a heap buffer overflow vulnerability within the tcn_write_to_bytebuffer BIO callback. The flaw occurs because the software fails to wrap the non-application ring buffer write index. This allows a remote TLS peer to send hand...

PT-2026-123394

Content removed...

PT-2026-123392

Name of the Vulnerable Software and Affected Versions netty-tcnative versions prior to 2.0.84.Final Description A heap buffer overflow occurs in the tcn write to bytebuffer BIO callback due to a failure to wrap the non-application ring buffer write index. Remote TLS peers can send handshake,...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: erofs: add GFPNOIO in the bio completion if needed The bio completion path in the process context e.g., dm-verity will directly call into decompression rather than trigger another workqueue context for minimal scheduling latencie...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: erofs: Properly handle overlapped pclusters from crafted images SyZBot reported a task hang issue caused by a deadlock condition wherein it waits for the folio lock of a cached folio that will be used for cache I/O operations. Up...