CVE-2020-9332

CVE-2020-9332 Descripción Un controlador de bus vulnerable en FabulaTech "USB para Escritorio Remoto" y "USB a través de la Red" permite a usuarios con pocos privilegios agregar un dispositivo USB de software completamente controlado, lo que podría ser utilizado por un atacante para elevar...

Zammad GmbH Zammad Improper Privilege Management Vulnerability

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489...

PT-2026-104067

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications...

Linux Distros Unpatched Vulnerability : CVE-2026-103431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it,...

foreman: command injection in foreman-tail

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...

gvcidrv64

hola hackers. GVCIDrv64.sys es el controlador de kernel firmado que se distribuye con la utilidad de BIOS de Gigabyte. Crea \.\GVCIDrv64 sin descriptor de seguridad, por lo que cualquier usuario local puede abrirlo sin admin, sin UAC. Expone 3 IOCTLs sin ningún control de acceso: mapear 32 MB de...

CVE-2026-104182

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

CVE-2026-104183

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...

CVE-2026-104183 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...

CVE-2026-104183

The stream-json micro-library (versions prior to 3.6.0 ) is vulnerable to a prototype pollution flaw within its Assembler component. The root cause is the use of plain assignment to materialize object properties, which allows an input key named __proto__ to invoke an inherited setter. This result...

CVE-2026-104183 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...

CVE-2026-104182

The stream-json micro-library is vulnerable to a Denial of Service (DoS) via a flaw in its JSONC parser (specifically at stream-json/jsonc/parser.js and stream-json/jsonc/verifier.js). Prior to version 3.6.0 , the parser restarts comment-terminator scanning from the opening slash whenever a block...

cve-2026-31431-checker

Herramienta de Detección de CVE-2026-31431 Copy Fail Una herramienta integral de detección y análisis para la vulnerabilidad CVE-2026-31431 "Copy Fail" en kernels de Linux. ⚠️ AVISO IMPORTANTE Esta herramienta es SOLO PARA DETECCIÓN. No explota ni modifica ningún archivo del sistema. Solo lee...

CVE-2026-31431-copy-fail

Copy Fail La mayoría de los LPE de Linux necesitan una ventana de carrera o un offset específico del kernel. Copy Fail es una falla lógica de línea recta: no necesita ninguna de las dos. El mismo script de Python de 732 bytes otorga privilegios de root en todas las distribuciones de Linux lanzada...

Weekly-Breach-Investigation--006

Vulnerabilidad de Copia Fallida CVE-2026-31431 Resumen Fallo de escalada de privilegios local de alta gravedad en el kernel de Linux, que permite a usuarios sin privilegios obtener acceso root corrompiendo la caché de páginas en memoria. Afecta a distribuciones de Linux desde 2017 y plantea grave...

cve-2026-31431-algif-aead-remediator

CVE-2026-31431 / GHSA-2274-3hgr-wxv6 — Remediador de algifaead Gravedad: Alta CVSS 7.8 — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Antecedentes CVE-2026-31431 es una vulnerabilidad de escalada de privilegios local en el módulo algifaead del kernel de Linux interfaz de sockets criptográficos...

CVE-2026-31431-RCE-Exploit

🔴 CVE-2026-31431 — "Copy Fail" Un fallo lógico del kernel de Linux de 9 años que otorga acceso root en segundos Resumen Copy Fail es una vulnerabilidad de escalada de privilegios local LPE de alta severidad en el subsistema criptográfico del kernel de Linux algifaead. Descubierta y divulgada por...

cve-2026-21509-mitigation

Script de Mitigación CVE-2026-21509 Versión en chino tradicional: READMEzh-TW.md Descripción general Este script aplica una mitigación basada en el registro para proteger contra CVE-2026-21509 vulnerabilidad de omisión de la característica de seguridad de Microsoft Office, que ha sido explotada...

CVE-2026-12542

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...

CVE-2026-102369

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...