55069 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-64580
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device...
Linux Distros Unpatched Vulnerability : CVE-2026-64571
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without...
Ghost: Blind Password Hash Disclosure in Ghost Admin API
Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...
CVE-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API
Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...
sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The commercial phishing-as-a-service PhaaS toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication MFA and seiz...
Root-My-Galaxy-Payloads
Root My Galaxy Payloads This repository contains the device-s...
Malicious code in tailwind-anime (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd7605f83f25074e67fa0c72679d47f50fe781dae40e4560ee0a216e91320014 [email protected] is a typosquat of tailwindcss-animate. Its index.js appends an evalatob'...' blob that runs whenever the plugin is required e.g....
CVE-2026-24083
Memory Corruption while processing IOCTL device driver requests with invalid arguments...
CVE-2026-25289
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...
EUVD-2026-52737
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...
CVE-2026-25289
CVE-2026-25289 describes memory corruption/stack-based overflow when processing Device Capability Extended attributes in NAN Service Discovery Frames with invalid length values in WLAN firmware. The issue is tied to the firmware image referenced in the August 2026 Qualcomm security bulletin; no e...
CVE-2026-25289 Stack-based Buffer Overflow in WLAN Firmware
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...
CVE-2026-24083
Memory Corruption while processing IOCTL device driver requests with invalid arguments...
EUVD-2026-52734
Memory Corruption while processing IOCTL device driver requests with invalid arguments...
MINI-P425-4C93-R82H
Bulletin has no description...
MINI-3HRC-HH2V-RVVH
Bulletin has no description...
CVE-2026-61514
CVE-2026-61514 affects Puwell IP Camera firmware 2.x to 4.x, where an authentication bypass allows unauthenticated remote access by sending protocol-conforming packets to TCP port 23456. The issue stems from an unvalidated Session field in the proprietary control protocol header, enabling attacke...