CVE-2026-65400-poc

CVE-2026-65400 — macOS Screen Sharing pre-auth root file read read-only PoC Read-only proof of concept. It demonstrates the authentication bypass by reading a root-only file from a vulnerable host. It writes nothing to the target: no LaunchDaemon, no shell startup file, no crontab, no RCE chain...

CVE-2026-98600

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. This vulnerability allows an adjacent attacker within Bluetooth range to cause a Denial of Service DoS by transmitting a specially crafted frame with an extended length field. Because the kernel fails...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix possible out-of-bounds access in mt7925macwritetxwi80211 Check the frame length before accessing the mgmt fields in mt7925macwritetxwi80211 to prevent potential out-of-bounds access...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix possible out-of-bounds access in mt76connac2macwritetxwi80211 Check the frame length before accessing the mgmt fields in mt76connac2macwritetxwi80211 to prevent potential out-of-bounds access. fix check to also...

CVE-2026-98457

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

CLSA-2024-1719932549 kernel: Fix of 20 CVEs

net: iptunnel: make sure to pull inner header in iptunnelrcv CVE-2024-26882 - net: Set true network header for ECN decapsulation CVE-2024-26882 - media: dvb-core: Fix use-after-free due to race at dvbregisterdevice CVE-2022-45884 - media: dvbdev: fix error logic at dvbregisterdevice...

GO-2026-6559 SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo

SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo...

BIT-RABBITMQ-2026-67225 RabbitMQ: Stream-protocol frame length never validated against frame_max

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin...

PT-2026-105580

SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo...

UBUNTU-CVE-2026-102558

A flaw was found in libsoup. When max-incoming-payload-size is unlimited 0, SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data...

GHSA-8H6X-H86X-75WH SIPGO: DoS via unvalidated WebSocket frame length

Summary The WebSocket transport allocates a buffer from the frame payload length before validating its size, which can lead to an unauthenticated DoS. Details WSConnection.Read allocates a buffer from the declared WebSocket frame length before reading the payload...

CVE-2026-82435

Apache Storm workers are vulnerable to unauthenticated remote memory exhaustion due to the placement of the Netty message decoder in the pipeline. Because the decoder is installed ahead of SASL authentication handlers, it processes frames before credentials are verified. An unauthenticated peer w...

EUVD-2026-75325

GeoVision GV-LPC2211 V1.14 260903 allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources...

PT-2026-89331

🚨 HIGH: CVE-2026-88290 CVSS 7.5 GeoVision GV-LPC2211 V1.14 vulnerable to unauthenticated resource exhaustion via unbounded VLSVR frame lengths. Remote attackers can exhaust memory & connections. Patch immediately. CVE Vulnerability https://t.co/a8839UViqf...

SUSE CVE-2026-72114

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

SUSE CVE-2026-74648

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

CVE-2026-74648

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

UBUNTU-CVE-2026-74648

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

CVE-2026-74648

CVE-2026-74648 affects the rtl8723bs staging driver in the Linux kernel. The function rtw_cfg80211_monitor_if_xmit_entry() removes a radiotap header and then reads the 802.11 frame control field without verifying that a base 802.11 header remains. Additionally, the data path pulls the calculated ...

EUVD-2026-64585

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...