PT-2026-90143

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate password input computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first...

PT-2026-90096

In the Linux kernel, the following vulnerability has been resolved: ALSA: portman2x4: Check card index validity at probe Although portman2x4 driver has a check of the given devptr-id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This...

PT-2026-90090

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media seg num against the cache device size seg num is read from the crc32c-only superblock, so whoever supplies the cache device on a table load CAP SYS ADMIN controls it. It sizes cache-segments and is th...

PT-2026-90407

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4 release compoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value...

PT-2026-90445

In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensor hub get feature sensor hub get feature clamps its return value to the caller's buffer size, but the copy loop still copies field-report size / 8 bytes for each report value. A...

PT-2026-90446

In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in altera cvp send block dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or...

PT-2026-90441

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32 rx done appends each received CEC byte to rx msg.msg using rx msg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without...

PT-2026-90447

In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl rch get aer info out-of-bounds AER register read cxl rch get aer info copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl loop bounded by sizeofstruct aer capability regs. This...

PT-2026-90186

In the Linux kernel, the following vulnerability has been resolved: power: supply: cros usbpd: Limit port counts to EC USB PD MAX PORTS Currently the cros usbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number ...

UBUNTU-CVE-2026-79522

An out-of-bounds read in the gfdmgetchunkdata function src/utils/...

PT-2026-90344

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcd debug eeprom read trusts resp-raw data2 -- a length byte supplied by the device in its REPORT EE DATA reply -- clamped only to the caller's read count: re...

CVE-2026-16172

Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP EPDLP service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful...

CVE-2025-5688-FreeRTOS-Plus-TCP-Out-of-Bounds-Write

CVE-2025-5688 – FreeRTOS-Plus-TCP Out-of-Bounds Write Exploit Remote memory corruption / DoS / potential RCE trigger in FreeRTOS-Plus-TCP when processing overly long DNS names in LLMNR or mDNS queries Buffer Allocation Scheme 1. Exploit Author: Mohammed Idrees Banyamer Country: Jordan Instagram:...

CVE-2026-3055

🔥 NetScalerBleed2：Citrix NetScaler 中的严重未授权内存过度读取 CVE-2026-3055 未授权越界内存读取（内存泄漏） 仅适用于配置为 SAML 身份提供程序 IdP 的设备 📋 概述 CVE-2026-3055 是 Citrix NetScaler ADC 和 NetScaler Gateway 中的一个严重 越界读取漏洞（CWE-125）。 该漏洞由 SAML 处理过程中输入验证不足 导致。未授权 远程攻击者可触发内存过度读取，泄露设备内存中的敏感数据——包括活动的会话令牌 、凭据或其他机密（在特定条件下）。...

CVE-2026-16172

CVE-2026-16172 affects the Endpoint DLP (EPDLP) service of the Netskope Client , where an out-of-bounds heap read occurs due to a missing bounds check on a specially crafted message. A local standard user can trigger the flaw, causing the kernel driver handler to crash and potentially interruptin...

CVE-2026-16172 Netskope Endpoint DLP Service Out-of-Bounds Read Leading to Process Crash

Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP EPDLP service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful...

CVE-2025-14847-MongoDB

CVE-2025-14847-MongoDB 内存泄露研究工具 概述 本仓库包含一个教育性研究工具，用于演示 CVE-2025-14847 背后的内存安全概念——这是一个在 MongoDB 的 BSON 解压实现中发现的严重漏洞。该工具模拟了解压过程中不恰当的边界检查如何导致内存泄露。 演示的关键概念： BSON 协议解析与验证 内存边界检查失败 安全与非安全的解压实现对比 错误消息的净化处理 重要法律声明：本工具仅供教育用途。仅可用于你拥有或已获得明确书面许可的系统。未经授权的测试可能违反法律，包括《计算机欺诈与滥用法案》等。 目的 本工具演示了： 边界验证失败如何导致内存泄露...

CVE-2026-86093

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack...

DEBIAN-CVE-2026-45765

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory,...

CVE-2026-45765

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory,...