SUSE SLES12 Security Update : perl-DBI (SUSE-SU-2026:4442-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4442-1 advisory. - CVE-2026-88815: numeric value incorrectly treated as strings in sqltypecastsvpv allows for process crash bsc1283055. -...

Linux Distros Unpatched Vulnerability : CVE-2026-75818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer...

Local Privilege Escalation and Configuration Injection in Brocade Fabric OS System Logging Daemon

: A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication IPC channels allow an unprivileged local user to submit malformed logging...

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Impact This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine. Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such a...

GHSA-WFPM-5GCM-94CG Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Impact This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine. Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such a...

NPM: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

NPM: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process vulnerability discovered by ? in WordPress Npm vm2 versions = 3.12.1...

GHSA-2V2P-6J97-CJG9 vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

Summary An untrusted script run by VM.run can construct an embedder-exposed host function that returns a rejected native Promise and ignore the result. The sandbox-to-host construct trap forwards that Promise without applying the host-side rejection handling already used by the neighboring apply...

vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

Summary An untrusted script run by VM.run can construct an embedder-exposed host function that returns a rejected native Promise and ignore the result. The sandbox-to-host construct trap forwards that Promise without applying the host-side rejection handling already used by the neighboring apply...

0xM0nCrush

0xM0nCrush Um terminador de processos Windows multi-versão. Ele carrega um driver de kernel HONOR assinado MonProcessEX.sys, resolve o PID de cada processo alvo e o encerra a partir do contexto de kernel através de um único IOCTL. Sem offsets de kernel, sem downloads de PDB, sem shellcode...

CVE-2026-77226

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...

CVE-2026-102262

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code...

CVE-2025-7771

CVE-2025-7771 Ein einfacher PoC, der die Schwachstelle im Treiber ThrottleStop.sys demonstriert und beliebige Lese- und Schreibzugriffe auf den physischen Arbeitsspeicher sowie die virtuelle-zu-physische Adressübersetzung mittels Superfetch aufzeigt. ⚡ Verwendung: 1. Dienst registrieren: Starten...

CVE-2026-102262 Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code...

CVE-2026-36425

CVE-2026-36425 : OPSWAT AppRemover Terminação Arbitrária de Processos Um driver de kernel assinado da OPSWAT que mata qualquer processo sob demanda. Sem necessidade de direitos de administrador, sem verificações de privilégio, sem perguntas. Aponte para um EDR, um antivírus, um processo protegido...

DEBIAN-CVE-2026-104030

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash a...

CVE-2026-49933

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2019-16098

CVE-2019-16098 Diese CVE nutzt den RTCore64.sys-Treiber aus und erstellt einen cmd.exe-Prozess mit Systemberechtigungen, indem es das Token des Systemprozesses auf einen der cmd.exe-Prozesse mit niedrigen Berechtigungen kopiert. Ein Blog über den Ansatz und die Methodik ist hier zu finden...

CVE-2026-49933

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2026-49933

A vulnerability exists in the msft.cc component within the handle_le_monitor_device_event function. An uninitialized pointer dereference allows for a potential control-flow hijack within a privileged Bluetooth process. This flaw could enable a local escalation of privilege without requiring addit...

CVE-2026-49933

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...