Exploit for CVE-2026-13043

🕷️ CVE-2026-13043 - Panda / WatchGuard Kernel Memory Access...

SUSE-SU-2026:24115-1 Security update for qemu

This update for qemu fixes the following issues: Security issues fixed: - CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to bypass chipset DLCK protection and injecting code into System Management Mode memory bsc1282077. -...

heartbleed

HEARTBLEED：OpenSSL TLS 心脏出血漏洞 OpenSSL TLS 心跳扩展 - 内存泄露 - 多 SSL/TLS 版本漏洞扫描器与利用工具 需要： sudo apt-get install nmap lolcat Java sudo apt install default-jre default-jdk...

CVE-2026-19186

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

EUVD-2026-94229

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

CVE-2026-19186 Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

CVE-2026-103416

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TL...

CVE-2025-14847-MongoBleed

CVE-2025-14847 MongoBleed MongoDB zlib圧縮メモリ開示 — 分析、検出、および修正 概要 CVE-2025-14847は、一般にMongoBleed と呼ばれる、:contentReferenceoaicite:0index=0 Server に影響を与える高深刻度の情報漏洩脆弱性です。 この脆弱性により、リモートの未認証攻撃者 が、zlib圧縮されたネットワークメッセージの不適切な処理を悪用して、サーバーメモリから機密データを漏洩させる可能性があります。...

kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources()

A flaw was found in the Linux kernel's RDMA/rxe component. A local user could exploit a memory corruption vulnerability in the freerdatomicresources function by updating the maxdestrdatomic value before the old array is properly freed, leading to an out-of-bounds write. This issue can cause a...

CVE-2025-22457-vulnserver-lab

step 1 environment setting 權限&執行腳本 使用windows的話可以開wsl執行 chmod +x setupenvironment.sh ./setupenvironment.sh step 2：尋找動態數值 需要手動的步驟 由於記憶體位址和 IP 在不同環境中是動態的，需要手動找到它們，並更新 exploit.py 腳本。 2.0 先開啟兩個attacker docker和一個victim docker作為後續準備 docker exec -it atac /bin/bash docker exec -it vic /bin/bash 2.1 尋找...

Formbook-Payload-Extraction-XOR-Decryption-Net-Assembly-Analysis

1. x32dbg – 加密配置解密与内存分配 x32dbg 内存转储显示，Formbook 解密其配置数据，并使用 NtAllocateVirtualMemory 为其分配内存。 关键观察： NtAllocateVirtualMemory – 为解密后的载荷分配内存。 mov edx, dword ptr ds:esi+1C – 从 ESI 寄存器中获取加密数据的大小。 push 0x1000 – 使用 MEMCOMMIT 分配内存。 push 0 – 指定分配类型或保护标志。 mov edx, dword ptr ds:esi+4 – 获取另一个配置值。 lea ecx, ebp-4...

CVE-2026-98357

A flaw was found in the Linux kernel's iSCSI Extensions for Remote Direct Memory Access iSER target driver. This vulnerability can lead to arbitrary code execution or a Denial of Service DoS due to memory corruption. During connection teardown, background tasks process deferred control messages...

K000163580: Elasticsearch vulnerability CVE-2026-56149

Security Advisory Description Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130. A user with elevated privileges can submit a specially crafted machine learning request that causes excessive memory...

kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources()

A flaw was found in the Linux kernel's RDMA/rxe component. A local user could exploit a memory corruption vulnerability in the freerdatomicresources function by updating the maxdestrdatomic value before the old array is properly freed, leading to an out-of-bounds write. This issue can cause a...

kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access subsystem, specifically within the rxe driver. A remote attacker could exploit this vulnerability by sending a specially crafted ATOMICWRITE request with a zero-byte payload. This improper handling of non-8-byte ATOMICWRITE...

kernel: nvmet-auth: reject short AUTH_RECEIVE buffers

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable

A flaw was found in the Linux kernel's netfilter synproxy module. When handling TCP timestamp options, a stale pointer can be used after memory reallocation. This can result in memory corruption, where data is written to a freed memory area, or lead to packets being sent with an incorrect checksu...

ROOT-OS-ALPINE-321-CVE-2026-3805 CVE-2026-3805 in curl - Patched by Root

Root has patched CVE-2026-3805 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

kernel: ALSA: 6fire: fix use-after-free on disconnect

A flaw was found in the Linux kernel's ALSA 6fire USB audio device driver. During the disconnection process of a 6fire USB audio device, a use-after-free vulnerability occurs. This happens when the system attempts to write to memory that has already been deallocated, which can lead to memory...

RLSA-2026:76747 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command...