CVE-2026-31431

🔐 CVE-2026-31431 - 内核利用研究框架 用于研究 Linux 中基于 AFALG + Page Cache 注入 技术的权限提升（LPE）漏洞的模块化框架。 🎯 目标 本项目设计用于： Linux 内核漏洞研究 真实利用技术（LPE）教学 受控网络安全实验室执行 ⚙️ 这个项目做什么？ 该框架实现了一种技术，能够： 修改 SUID 二进制文件的内存内容（page cache ） 在运行时改变其行为 尝试在不修改磁盘上二进制文件的情况下将权限提升至 root 🧠 漏洞如何运作？ 该利用基于内核多种机制的组合： 1. AFALG（Linux 加密 API）...

CentOS Linux 7 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS7:CLSA-2026:1777287060)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777287060 advisory. - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache...

CentOS Linux 8.4 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS8.4:CLSA-2025:1764321653)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2025:1764321653 advisory. - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the...

CentOS Linux 8.5 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS8.5:CLSA-2025:1764584370)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1764584370 advisory. - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the...

CLEANSTART-2026-KY78316 dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-...

Multiple security vulnerabilities affect the dnsmasq package. dnsmasqs extractname function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS...

EulerOS Virtualization 2.13.0 : dnsmasq (EulerOS-SA-2026-3210)

According to the versions of the dnsmasq packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A Denial of Service DoS vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via...

GO-2026-5239 OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga...

EulerOS Virtualization 2.10.0 : dhcp (EulerOS-SA-2026-2044)

According to the versions of the dhcp package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into...

CVE-2026-2291

dnsmasqs extractname function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS...

CVE-2026-2291 CVE-2026-2291

dnsmasqs extractname function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS...

CVE-2026-2291

dnsmasqs extractname function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS...

CVE-2026-2291: Undefined Security Weakness

dnsmasqs extractname function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the session restoration process. An attacker can execute arbitrary memory deallocation by injecting a crafted session into the cache and triggering the application to call the relevant session restor...

GO-2026-4890 act: actions/cache server allows malicious cache injection in github.com/nektos/act

act: actions/cache server allows malicious cache injection in github.com/nektos/act...

PT-2026-29937

act: actions/cache server allows malicious cache injection in github.com/nektos/act...

CVE-2026-34042

act: The CVE-2026-34042 flaw in the act project’s actions/cache server lets connections from any interface create caches with arbitrary keys and read existing caches, potentially enabling arbitrary remote code execution inside the local Docker container. The issue stems from listening on all inte...

CVE-2026-34042 act: actions/cache server allows malicious cache injection

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and...

CVE-2026-34042 act: actions/cache server allows malicious cache injection

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and...

EulerOS Virtualization 2.12.1 : dhcp (EulerOS-SA-2026-1422)

According to the versions of the dhcp package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into...

EulerOS Virtualization 2.12.0 : dhcp (EulerOS-SA-2026-1479)

According to the versions of the dhcp package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into...