CVE-2026-99153

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsihandlereject takes the ITT out of that copy to find the task to clean up: memcpy&rejectedpdu, data,...

CVE-2026-99153

The Linux kernel 's libiscsi component contains a vulnerability where iscsi_handle_reject() fails to properly validate the ITT (iSCSI Task Tag) reflected in a Reject PDU . Because the function accepts an arbitrary ITT provided by the target and uses it to retrieve a task from the pool without suf...

CVE-2026-99153 scsi: libiscsi: Validate the ITT reflected in a Reject PDU

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsihandlereject takes the ITT out of that copy to find the task to clean up: memcpy&rejectedpdu, data,...

EUVD-2026-111905

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsihandlereject takes the ITT out of that copy to find the task to clean up: memcpy&rejectedpdu, data,...

CVE-2024-51179

CVE-2024-51179 : Flooding of Crafted packets from an Attacker can crash UPF/SMF in Open5gs Vulnerability Description Description: An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of servie via the Network Function Virtualizations NFVs such as the User Plane Function UPF and...

CVE-2022-33174

CVE-2022-33174 Powertek PDU Identity Bypass Optional Arguments: -h, --help show this help message and exit -u url, --url url Target URL eg:"http://127.0.0.1" -f file, --file file Targets in file eg:"ip.txt" Use python3 CVE-2022-33174.py -u http://127.0.0.1 python3 CVE-2022-33174.py -f ip.txt Link...

CVE-2019-0708

Leaving for a wedding tomorrow, if I can't find anything then someone else take the reins Going to drop the crash PoC here Friday if there isnt one public already... Maybe the following week, depending on if the vulnerable numbers drop consistently or not. https://vimeo.com/339425966 I'm not...

Server Technology PRO3X Rack PDU - port_mux Listener Program Override to Root Co — Detect

Fingerprint / reachability check for Server Technology PRO3X Rack PDU - portmux Listener Program Override to Root Command Execution !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Server Technology PRO3X Rack PDU - portmux Listener Program Override to Root Command Execution""" from...

Opengear NGCS Firmware 25.11.8 — PDU `name` Command Injection (Authenticated Adm — Detect

Fingerprint / reachability check for Opengear NGCS Firmware 25.11.8 — PDU name Command Injection Authenticated Administrator to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Opengear NGCS Firmware 25.11.8 — PDU name Command Injection Authenticated Administrator to Root R"""...

ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization

Zoho ManageEngine OpManager Stable build before 125203 and Released build before 125233 allows Remote Code Execution via the Smart Update Manager SUM servlet. id: CVE-2020-28653 info: name: ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization author: iamnoooob,pdresearch severity:...

CVE-2026-89973

A flaw was found in the Linux kernel's nvme-tcp component. A malicious or misconfigured NVMe controller can send a Controller to Host Data Protocol Data Unit C2HData PDU in response to a write command, which is not properly validated for data direction. This can trigger a kernel warning, leading ...

CVE-2026-98960 btrfs: don't stash io_uring encoded data across -EAGAIN

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash iouring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfsuringencodeddata in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. iouring does not free driver PDU...

CVE-2026-98960

The Linux kernel 's btrfs filesystem contains a vulnerability where btrfs_uring_encoded_data is leaked if the request is cancelled or the ring exits before reissue. This occurs because the kernel returns -EAGAIN while leaving the encoded data in the command PDU, and io_uring does not free driver ...

CVE-2026-114042

A flaw was found in FreeRDP. The drdynvc channel frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a crafted Virtual Channel PDU to trigger the free and crash the client during teardown. This issue affects...

CVE-2026-114042 FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash th...

CVE-2026-114042 FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash th...

CVE-2026-114042

FreeRDP 3.32.0 is vulnerable to a use-after-free flaw in the drdynvc channel . The issue occurs because the software frees a pool-owned stream using the owned-stream deallocator when the totalLength is smaller than the chunk size. A malicious RDP server can exploit this by sending a single well-f...

CVE-2026-114042 FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash th...

PT-2026-120170

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX MAP SURFACE TO WINDOW PDU with oversized...

SUSE CVE-2026-98479

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...