Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ALSA: PCM: Fixed corruption of the wait queue list in sndpcmdrain for linked streams. sndpcmdrain uses initwaitqueueentry, which does not clear the prev/next entries of the queue. Additionally, it uses addwaitqueue, where a...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: mac80211: mesh: Fixed a leak of meshpreqqueue objects The hwmp code uses objects of type meshpreqqueue, which are added to a list in ieee80211ifmesh to track mpath. We need to fix this issue. If the mpath is deleted, the ex...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: block: Fixed a possible memory leak for rqwb when deviceadddisk fails. kmemleak reported memory leaks in deviceadddisk: - 3 new suspected memory leaks. Unreferenced object: 0xffff88800f420800 size 512: Command “modprobe”, PID...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netifnapidel When queues are started, netifnapiadd and napienable are called. If there are 4 queues and only 3 queues are used for the current configuration, only 3 queues’ napi should be registered and...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Staging: rtl8712: fixed a potential memory leak in r871xudrvinit. In r871xudrvinit, if r8712initdrvsw fails, the memory allocated by r8712allocioqueue in r8712usbdvobjinit is not properly released. This is because no action is...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: mana: Fixed error handling for TX CQE messages. For an unknown type of TX CQE error likely caused by newer hardware, still free the SKB, update the queue tail, etc. Otherwise, the accounting data will be incorrect...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pfifotailenqueue: Drop a new packet when sch-limit == 0. Expected behavior: If the scheduler’s limit is reached, pfifotailenqueue will drop a packet from the scheduler’s queue and decrease the scheduler’s qlen by one. Then, it wi...

ghostlock-s25fe

GhostLock（CVE-2026-43499）适用于 Galaxy S26 CVE-2026-43499 移植至三星 Galaxy S26 系列 — Android 16 / GKI 6.12。 单个二进制文件、三条内核线、运行时动态参数 匹配：理论上覆盖整个 S26 系列，无需 针对每个构建单独编译。 大多数 GhostLock 移植工作针对单一设备或单一固件。 本仓库是一次全新移植，为 S26 目标重写了所有机制， 预计可覆盖整个系列。 概览 在维护 snothin/CyberMeowfia 期间， 我发现原始的 pipe physrw 通道不稳定（会导致网络中断），因此...

activemq-cve-lab

ActiveMQ 消息代理 概述 ActiveMQ 消息代理应用程序，具备消息导入/导出功能。 版本： 5.11.1 功能特性 消息队列管理 队列统计与监控 消息文件导入/导出 实时代理状态 快速开始 Docker docker-compose up -d 访问地址：http://localhost:8161/console/ 本地构建 mvn clean package -DskipTests java -jar target/activemq-app-1.0-SNAPSHOT.jar 访问控制台 1. 仪表盘 - 代理状态概览 2. 队列 - 查看和管理消息队列 3. 消息导入 -...

CVE-2025-26466

CVE-2025-26466 CVE-2025-26466 的 PoC 作者：Fikret Can Gurbuz 使用方法 python3 poc.py -i -p 步骤如下： 1. TCP 连接到端口 2. 接收服务器横幅（SSH-2.0-OpenSSHX.Xp1） 3. 发送客户端横幅（SSH-2.0-YourClient\r\n） 4. 发送 wrapsshpacketbuildkexinit 5. 接收服务器的 KEXINIT 响应 6. 循环发送 buildping ! 永远不要完成 KEX，因此 pong 响应将无限排队...

CVE-2025-61765_PoC

摘要 python-socketio 5.14.0 之前的版本存在一个远程代码执行漏洞，在攻击者先前已获得服务器内部通信所用消息队列访问权限的多服务器部署中，攻击者可通过恶意 pickle 反序列化执行任意 Python 代码。 您可以在 GitHub Advisory 中找到此漏洞的详细分析。 运行 此演示涉及三个 docker 容器： 1. Redis 服务器 ：充当消息代理。 2. 易受攻击的 Socket.IO 服务器 ：一个基于 Flask 的服务器，使用 python-socketio 处理 WebSocket 连接，并通过 Redis 进行通信。 3. 攻击者客户端...

TickTock

TickTock 本仓库演示了一个用于枚举计时器队列（timer-queue）计时器的 PoC 内存扫描器，该技术被用于 Ekko 睡眠混淆（Sleep Obfuscation）：https://github.com/Cracked5pider/Ekko。如需完整的技术讲解，请参阅随附的博客文章：https://labs.withsecure.com/publications/hunting-for-timer-queue-timers.html。 以下截图展示了在 Ekko 运行期间扫描计时器队列计时器的结果： 注意：需要提醒的是，本 PoC 已在 Windows 10 1607 和...

CVE-2026-73317

CVE-2026-73317: Approval job authorization bypass XenForo before 2.3.13 lets an administrator with only the cache-rebuild permission dispatch an approval job as another user. What happens The ACP rebuild endpoint accepts a caller-supplied job class and options. Its authorization check asks only...

CVE-2026-104058

The Podgrab application contains a missing authentication vulnerability (CWE-306) due to the /ws WebSocket route being incorrectly registered on the root gin engine instead of the BasicAuth-protected router group . This flaw allows unauthenticated network clients to connect even when a PASSWORD i...

CVE-disclosures

CVE-2026-3171 与 CVE-2026-3170 – Archana M 由 Archana M 发布的官方漏洞披露。 🔹 CVE-2026-3171 产品： SourceCodester / Patrick Mvuma 患者候诊区排队管理系统 1.0 漏洞类型： 跨站脚本（CWE-79） 受影响文件： /queue.php 攻击向量： 远程 用户交互： 需要 CVSS v3.1： 3.5（AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N） 状态： 已公开披露 描述 对用户输入（firstname / lastname）的中和不当，导致跨站脚本（XSS）漏...

CTT-Kernel-Resonance-io_uring-Temporal-Phase-Transition

此针对 CVE-2026-24102 的漏洞利用代表了 SimoesCTT 系列的巅峰之作。通过瞄准 iouring——Linux 内核最先进的异步接口——你正在攻击“顺序逻辑”这一概念本身。 在 iouring 中，系统调用并非被执行，而是流动。我们将利用提交队列（SQ）与完成队列（CQ）之间的时间窗口，制造一种涡量诱导的释放后使用（Use-After-Free）。 SimoesCTT-Kernel-Resonance：iouring 时间相变 🌀 概述：CVE-2026-24102 CVE-2026-24102 是 Linux 内核 iouring...

ibm-qradar-ajp_smuggling_CVE-2022-26377_poc

CVE-2022-26377 由 @watchTowr 开发的一个概念验证（PoC），用于利用 AJP Smuggling 漏洞，通过存储的重定向来污染 IBM QRadar 实例的 HTTP 响应队列。 关注 watchTowr 实验室团队，了解我们的安全研究 https://labs.watchtowr.com/ https://twitter.com/watchtowrcyber https://www.ibm.com/support/pages/node/7145265...

CVE-2026-103251

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

CVE-2026-103251 n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

EUVD-2026-90645

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...