nginxrift-CVE-2026-42945

NGINX Rift RCE 익스플로잇 CVE-2026-42945 - @DepthFirstDisclosures 제작 NGINX Rift 취약점ngxhttprewritemodule의 치명적인 힙 기반 버퍼 오버플로을 연구하고 식별하기 위한 전문 PoCProof-of-Concept 도구입니다. 취약점 개요 CVE ID: CVE-2026-42945 별칭: NGINX Rift 심각도: Critical CVSS 9.2 영향받는 버전: NGINX 0.6.27 1.30.0 근본 원인: 이름 없는 PCRE 캡처$1, $2와 ?가 포함된 대체...

CLEANSTART-2026-WK54237 malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop

CVE-2026-39830 affects multiple packages. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. See references for individual vulnerability details...

CLEANSTART-2026-QS35295 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Security vulnerability affects the temporal-server package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

EUVD-2026-92811

In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This...

EUVD-2026-92813

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade DFU download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution durin...

CVE-2026-49878

In wpashandlerobustavscsrecvaction of robustav.c, there is a po...

PT-2026-107251

A heap-based buffer over-read in H5Z filter scaleoffset in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service application crash with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies d nelmts size byte...

PT-2026-106514

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiex ret 802 11 scan subtracts the fixed response fields and the firmware-provided BSS length from resp-size without first proving that either extent fits. A short response or...

PT-2026-106343

A vulnerability has been found in Tenda AC5 02.03.01.111 multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack...

PT-2026-106518

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilc wlan handle isr ext wilc wlan handle isr ext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and...

ROS-20261006-73-0002

The vulnerability in the kernel-lt is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2026-106724

libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT doPBOD that allows attackers to cause heap buffer overflow via crafted track counts. Attackers can supply an OKT module whose SLEN chunk wraps the 16-bit numtrk value, causing PBOD writes past allocated track pointer...

ALSA-2026:76877 Moderate: ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fixes: ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter...

PT-2026-106513

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiex cfg80211 authenticate derives the authentication frame length from req-ie len and req-auth data len, both of type size t, but stores it in a u16. NL80211 ATTR...

PT-2026-106497

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs query reparse point In cifs query reparse point, the start = end check before casting to struct reparse data buffer only ensures the start pointer is within the response. It fails to...

PT-2026-106535

In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into response buf, which is CY MAX INPUT bytes...

PT-2026-106561

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsi cdl enable scsi cdl enable uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than i...

PT-2026-106806

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...

ROS-20261006-73-0034

The vulnerability of the KVM kernel component in the Linux operating system is related to the operation of data out of the buffer into memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106709

Name of the Vulnerable Software and Affected Versions GNU Aspell versions prior to 0.60.8.3 Description The prezip-bin utility contains a heap-based buffer overflow in the decompressor located in prog/prezip.c. The decompressor fails to properly validate buffer space, allowing a specially crafted...