one-multiply-too-many-cve-2026-70638-llama-cpp-android-jni-integer-overflow

CVE-2026-70638 - Desbordamiento de enteros JNI de LLaMA-Android en llama.cpp PoC complementario para el artículo de Hunt-Benito "Una multiplicación de más: CVE-2026-70638 — Desbordamiento de enteros en la asignación de montón JNI de Android de llama.cpp" →...

CVE-2026-42533-POC

CVE-2026-42533 Desbordamiento de búfer en el heap y fuga de información del heap antes de la autenticación en nginx, causados por la falta de guardado/restauración del estado de las capturas de PCRE entre las dos pasadas del motor de scripts. Una variable map con regex evaluada entre dos...

RLSA-2026:66348 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...

vim security update

An update is available for vim. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

nginx: NGINX: Arbitrary code execution via crafted HTTP requests

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

nginx-cve-2026-42945-poc

CVE-2026-42945 — Desbordamiento de búfer en el montículo del Módulo Rewrite de NGINX → RCE RCE confirmado exitoso — mediante desbordamiento de montículo + inyección de proceso GDB, ejecuta comandos arbitrarios en los procesos worker de NGINX / OpenResty. Inicio rápido root@kitploit: 一键构建 NGINX 镜像...

CVE-2026-42945

Script de evaluación de riesgo real de CVE-2026-42945 Herramienta de evaluación de riesgo local para CVE-2026-42945 Nginx Rift. A diferencia de simplemente decir "la versión afectada es peligrosa", este script verifica capa por capa las tres condiciones que realmente determinan el riesgo, dando u...

CVE-2026-11108-Integer-Overflow-in-Memory-Allocator-kmalloc-Sim-

CVE-2026-11108 – Desbordamiento de entero en asignador de memoria kmalloc Sim Código del programa C root@kitploit: // allocsim.c - Vulnerable memory allocator include include include define MAXBLOCK 1024 void mymallocsizet size sizet total = size + sizeofsizet; // header if total MAXBLOCK return...

CVE-2021-3156

Project Title Exploit generator for CVE-2021-3156 sudo Installation 1. Install dependencies ./install.sh 2. Run exploit generator: ./run.sh 3. If the system's sudo version is vulnerable, an exploit is generated for the installed version 4. The exploit is generated in exploit.c and the binary...

RockyLinux 10 : vim (RLSA-2026:66336)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:66336 advisory. vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service v...

AlmaLinux 9 : vim (ALSA-2026:66366)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:66366 advisory. vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via...

CVE-2026-79393

A heap-based buffer overflow in the WS-Addressing Action transformation function of the Sofia IPC daemon in Xiongmai IP Camera XM530 (firmware HMT.CM2005-v220608.1837 and earlier) allows remote unauthenticated attackers to trigger a denial of service or potentially execute arbitrary code by sendi...

AlmaLinux 10 : vim (ALSA-2026:66336)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:66336 advisory. vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service vi...

nginx security update

1.20.1-28.0.1.el98.6 - Reference oracle-indexhtml within Requires Orabug: 33802044 - Remove Red Hat references Orabug: 29498217 - Update upstream references Orabug: 36579090 2:1.20.1-28.6 - Resolves: RHEL-212458 - nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533...

Security Update for Microsoft .NET Core (September 2026)

The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a...

EUVD-2026-76185

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary cod...

Security Update for Microsoft .NET Core SDK (September 2026)

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges ove...

CVE-2026-45761

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached...

DEBIAN-CVE-2026-45761

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached...

CVE-2026-45761

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached...