CVE-2026-80672

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

EUVD-2026-67471

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add...

CVE-2026-80595

CVE-2026-80595 affects the Linux kernel 's ims-pcu driver. The driver processes response data from device buffers without verifying that the device actually sent enough data , which can lead to out-of-bounds reads or processing stale data . The fix adds checks for the expected response length bef...

CVE-2015-7547

CVE-2015-7547 https://github.com/fjserna/CVE-2015-7547 Con questo ho provato se su CentOS6 varie cose vanno in crash. root@kitploit: ./CVE-2015-7547-poc.py & vi /etc/resolve.conf --------------------------------------------------------------- options single-request-reopen nameserver 8.8.8.8...

CVE-2026-80573

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

CVE-2026-13481

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv, the PTPMGMTTIME case casts mgmttlv-data to a 10-byte struct ptptimestamp and reads it then byte-swaps and writes it back without first checking that the TLV data...

EUVD-2026-66557

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv, the PTPMGMTTIME case casts mgmttlv-data to a 10-byte struct ptptimestamp and reads it then byte-swaps and writes it back without first checking that the TLV data...

CVE-2026-13481 Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv, the PTPMGMTTIME case casts mgmttlv-data to a 10-byte struct ptptimestamp and reads it then byte-swaps and writes it back without first checking that the TLV data...

CVE-2026-13481 Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv, the PTPMGMTTIME case casts mgmttlv-data to a 10-byte struct ptptimestamp and reads it then byte-swaps and writes it back without first checking that the TLV data...

CVE-2026-13481

CVE-2026-13481 is an out-of-bounds read in the IEEE 1588 PTP management-message parser in Zephyr RTOS (subsys/net/lib/ptp/tlv.c). In tlv_mgmt_post_recv(), the PTP_MGMT_TIME case casts TLV data to a 10-byte ptp_timestamp struct without validating that the data field is at least that size, unlike a...

EUVD-2026-66556

The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...

EUVD-2026-66555

The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...

VulnCheck KEV: CVE-2026-31635

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgkverifyresponse decodes authlen from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE...

PT-2026-82166

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds check exists in the ccwchain calc length function. This routine counts the number of channel command words CCWs chained together in a single channel program and is...

PT-2026-82107

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP MGMT TIME management id. In the tlv mgmt post recv function, the PTP...

CVE-2011-4862

CVE-2011-4862 Progetto finale per Security and Privacy CS 600.443 | Autunno 2018 Ho inizialmente provato a usare diff per creare una patch. Ho creato la patch nel modo in cui pensavo dovesse essere, prima di guardare la patch reale. encrypt.patch è questa patch originale che ho creato con diff...

EUVD-2026-64970

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can trigger this vulnerability via crafted...

EUVD-2026-64846

RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStreamRead in libs/clipboard/src/windows/wfcliprdr.c requests...

CVE-2026-74649

A flaw was found in the Linux kernel's rtl8723bs driver. A remote attacker, by operating a malicious Access Point AP, could send a specially crafted Wi-Fi Protected Equivalent Privacy WEP shared-key authentication challenge. This could lead to an out-of-bounds write or information disclosure due ...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: cfg80211 – Fix for buffer overflow in elem comparison. For vendor elements, the code assumes that 5 octets are present without checking them. Since the element itself has already been checked for compatibility, we only need...