CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107287

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local webfetchtool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML...

php-bypass-disable-functions

php-bypass-disable-functions Proyecto de demostración sobre cómo omitir el control de seguridad disablefunctions de PHP en Linux, donde los procesos pueden inspeccionar e incluso escribir su propia memoria a través del archivo especial /proc/self/map mediante operaciones estándar de archivo...

kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem, specifically within the SEV Secure Encrypted Virtualization feature. A malicious guest operating system utilizing SEV-SNP Secure Nested Paging can exploit an out-of-bounds write vulnerability due to improper...

kernel: vsock/virtio: fix zerocopy completion for multi-skb sends

A flaw was found in the Linux kernel's vsock/virtio component. This vulnerability occurs during zerocopy completion for large messages fragmented into multiple socket kernel buffers skbs. An issue in how user arguments uargs are handled for these buffers can lead to pinned user pages not being...

kernel: vsock/virtio: bind uarg before filling zerocopy skb

A flaw was found in the Linux kernel's vsock/virtio transport. This vulnerability occurs when the system processes zerocopy socket buffers skbs and encounters an error during memory allocation for fixed-buffer vectored data. The system may attempt to free memory incorrectly, leading to a...

kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

A flaw was found in the Linux kernel's ipvlan component. The ipvlan devices do not properly inherit neededheadroom and neededtailroom from the physical device phydev. This can lead to insufficient space being reserved for packet headers and trailers, potentially causing memory corruption, such as...

kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF

A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash...

kernel: igc: set tx buffer type for SMD frames

A flaw was found in the Linux kernel's igc network driver. The igcfpeinitsmdframe function, responsible for initializing transmit TX buffer fields for Stream-based Data SMD frames, does not correctly set the buffer type. This can result in stale XDP eXpress Data Path or XSK AFXDP socket types...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

Cooper-ndss-2022

Cooper: Pruebas del código de enlace de lenguajes de script mediante mutación cooperativa Cooper utiliza mutación cooperativa para probar el código de enlace de los lenguajes de script y encontrar problemas de seguridad de memoria. La mutación cooperativa modifica simultáneamente el código de los...

CVE-2025-53020-PoC

CVE-2025-53020 - Apache httpd HTTP/2 内存耗尽 PoC 一个针对 CVE-2025-53020 的概念验证程序，该漏洞是 Apache httpd 的 HTTP/2 实现中的一个内存耗尽漏洞，由我在 2025 年中发现。 📖 深度解读 : galbarnahum.com/posts/apache-httpd-cve-2025-53020 漏洞概述 Apache httpd 在处理 HTTP/2 标头时容易受到拒绝服务攻击。该漏洞是由于在 HTTP/2 请求中处理重复的标头名称时产生了不必要的内存重复。 攻击机制 1. HPACK 利用 : 攻击利用...

ICSFuzz

ICSFuzz: Herramienta de Fuzzing para Aplicaciones de Control ICS Descripción general ICSFuzz es una herramienta de fuzzing del lado del PLC para descubrir vulnerabilidades en aplicaciones de control ICS por Dimitris Tychalas @ditihala .. @ditihala: https://www.twitter.com/ditihala Instalación La...

CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-

CVE-2025-24201 WebKit 漏洞检测器（PoC） 此概念验证用于检测基于 WebKit 的浏览器是否易受 CVE‑2025‑24201 影响，这是一个由 WebGL 实现中不正确的功能验证导致的高严重性越界写入漏洞 。 🔍 漏洞摘要 当 WebGLRenderingContext（WebGL 1）允许启用常量 PRIMITIVERESTARTFIXEDINDEX（0x8D69）——一个仅在 WebGL 2 中有效的功能——而不产生 GLINVALIDOPERATION 或 GLINVALIDENUM 错误时，就会触发 CVE‑2025‑24201。...

kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

A flaw was found in the Linux kernel's ipvlan component. The ipvlan devices do not properly inherit neededheadroom and neededtailroom from the physical device phydev. This can lead to insufficient space being reserved for packet headers and trailers, potentially causing memory corruption, such as...

kernel: nfsd: fix UAF in async copy cancel and shutdown

A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free UAF vulnerability. This allows an async copy object to be freed or used after being freed, potentially causing memory...

kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

A flaw was found in the Linux kernel's Network File System Daemon nfsd component. When performing an asynchronous async copy operation, a programming error causes a stale identifier IDR entry to point to memory that has already been reused. This can lead to memory corruption, where the system...

kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF

A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

kernel: vsock/virtio: fix zerocopy completion for multi-skb sends

A flaw was found in the Linux kernel's vsock/virtio component. This vulnerability occurs during zerocopy completion for large messages fragmented into multiple socket kernel buffers skbs. An issue in how user arguments uargs are handled for these buffers can lead to pinned user pages not being...