Unity Linux 20.1060a Security Update: glib2 (UTSA-2026-071902)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-071902 advisory. A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection...

Security Updates for Microsoft PowerPoint Products C2R (September 2026)

The Microsoft PowerPoint Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. CVE-2026-69678, CVE-2026-69767, CVE-2026-69797, CVE-2026-80081 -...

Linux Distros Unpatched Vulnerability : CVE-2026-73324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VLC media player copies an RTSP response line into a fixed buffer without guaranteeing termination and then treats that buffer as a C string. RtspReadLine in...

PT-2026-89600

🚨 CVE-2026-86093 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a...

Linux Distros Unpatched Vulnerability : CVE-2026-88049

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and...

PT-2026-89517

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size used from a .traineddata model without a cap or an invariant check. reservereserved allocates the backi...

MGASA-2026-0390 Updated perl-DBI packages fix security vulnerabilities

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in...

Updated perl-DBI packages fix security vulnerabilities

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in...

DEBIAN-CVE-2026-79516

An out-of-bounds read in the stbspvsnprintf function stbsprintf.h of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service DoS via sending a crafted input...

DEBIAN-CVE-2026-79515

An out-of-bounds read in the stbttGetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service DoS via sending a crafted TTF file...

CVE-2026-79514

An out-of-bounds read in the gfdmdatareceived function downloader.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...

CVE-2026-79516

An out-of-bounds read in the stbspvsnprintf function stbsprintf.h of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service DoS via sending a crafted input...

CVE-2026-79522

An out-of-bounds read in the gfdmgetchunkdata function src/utils/downloader.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...

CVE-2026-79515

An out-of-bounds read in the stbttGetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service DoS via sending a crafted TTF file...

CVE-2026-20404-MediaTek-modem-remote-DoS-rogue-base-station-scenario-

CVE-2026-20404-MediaTek-modem-remote-DoS-rogue-base-station-scenario- Un problema de validación de entrada en el módem de MediaTek puede provocar un bloqueo del sistema DoS remoto cuando un UE se conecta a una estación base maliciosa controlada por un atacante, sin requerir interacción del usuari...

miniupnpd_poc

Miniupnpd path 大于 526 字节的 SUBSCRIBE 请求时被触发。 根本原因在于缺少对 snprintf 返回值的验证，因为 snprintf 返回的是它 可能 复制的字节数，而非实际复制的字节数。 截至 2019 年 1 月 25 日，此 repro 中的 PoC 已成功针对 Google Wifi 进行测试。 其他使用 miniupnpd 的设备也可能存在漏洞。 根本原因 upnpevents.c root@kitploit: static void upnpeventpreparestruct upnpeventnotify obj obj-buffersize...

DEBIAN-CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...

CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...

CVE-2026-31431-REVSHELL

root@kitploit: █▀▀ ▄▀█ █ █ █▀█ █▀█ █▀█ ▀█▀ █▀░ █▀█ █ █▄▄ █▀▄ █▄█ █▄█ ░█░ CVE-2026-31431 • Linux 内核 LPE → Root 反向 Shell 概述 FailRoot 是一个针对 CVE-2026-31431 的武器化利用程序——该漏洞是 Linux 内核 crypto: algifaead 子系统中的越界写入。 它将权限提升 与守护进程化的 root 反向 Shell （带完整 PTY）串联在一起： root@kitploit: AFALG + splice → 4 字节页缓存写入 → 修补...

CVE-2026-31431-Advanced-Exploit

CVE-2026-31431 — Copy Fail Linux 内核页缓存越权写入漏洞 AFALG AEAD 散列表链错误 概述 Linux 内核 algifaead 接口存在一个漏洞，允许无特权用户 向任意可读文件 的页缓存（page cache）写入任意数据——完全绕过文件权限检查、强制访问控制（MAC）以及完整性校验。 磁盘上的文件内容不会改变，但此后所有读取该文件的进程（包括 SUID 程序、动态链接器、execve 等）都会看到攻击者篡改后的版本，直到页缓存被回收。 影响范围 项目| 说明 ---|--- 子系统| crypto/algifaead.c 算法|...