Lucene search
+L

138675 matches found

EUVD
EUVD
•added 2026/09/24 4:02 p.m.•5 views

EUVD-2026-86195

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...

5.8AI score
SaveExploits0References3
CVE
CVE
•added 2026/09/24 4:02 p.m.•8 views

CVE-2026-93808

The Linux kernel contains a vulnerability in the ALSA: usb-audio: caiaq driver. The function usb_ep1_command_reply_dispatch() fails to verify if the urb->actual_length is sufficient before reading command-specific fixed items from the URB buffer at offsets such as buf[1] , buf[2] , or buf + 3 ...

5.8AI score
SaveExploits0References3
EUVD
EUVD
•added 2026/09/24 4:02 p.m.•3 views

EUVD-2026-86194

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers rsihalloadkey copies txmickey and rxmickey from data16 and data24 whenever key data is present. Those offsets are only part of the 32-byte TKIP key layout. Shorter keys...

5.8AI score
SaveExploits0References3
CVE
CVE
•added 2026/09/24 4:02 p.m.•7 views

CVE-2026-93807

The Linux kernel contains a vulnerability in the wifi: rsi component where the rsi_hal_load_key() function performs unconditional copies of tx_mic_key and rx_mic_key from specific offsets within the key data. Because these offsets are part of the 32-byte TKIP key layout, using shorter keys for ot...

5.8AI score
SaveExploits0References3
EUVD
EUVD
•added 2026/09/24 4:02 p.m.•3 views

EUVD-2026-86193

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate assoc response length before status and IE access cfg80211rxassocresp initialises the status and response-IE fields of cfg80211connectrespparams from the management frame before proving that the frame is...

5.8AI score
SaveExploits0References3
CVE
CVE
•added 2026/09/24 4:02 p.m.•10 views

CVE-2026-93806

The Linux kernel contains a vulnerability in the cfg80211 wifi component. The cfg80211_rx_assoc_resp() function incorrectly initializes the status and response-IE fields of cfg80211_connect_resp_params from a management frame before verifying that the frame is long enough to accommodate those off...

8.8CVSS5.8AI score
SaveExploits0References3
EUVD
EUVD
•added 2026/09/24 4:02 p.m.•3 views

EUVD-2026-86192

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...

5.9AI score
SaveExploits0References3
CVE
CVE
•added 2026/09/24 4:02 p.m.•6 views

CVE-2026-93805

The Linux kernel contains a vulnerability in the cfg80211 component where cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() fail to properly validate the lengths of MLME callback frames before accessing their contents. Specifically, the functions only verify that frames are at least 2 bytes lon...

5.9AI score
SaveExploits0References3
CVE
CVE
•added 2026/09/24 4:02 p.m.•7 views

CVE-2026-93803

The Linux kernel contains a vulnerability in the libipw component where libipw_rx() fails to perform adequate bound checks when extracting the WEP key index . The function reads skb->data[hdrlen + 3], but the existing guard only ensures skb->len >= hdrlen + 3, which does not guarantee th...

5.8AI score
SaveExploits0References3
EUVD
EUVD
•added 2026/09/24 4:02 p.m.•5 views

EUVD-2026-86190

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipwrx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

5.8AI score
SaveExploits0References3
CVE
CVE
•added 2026/09/24 4:02 p.m.•5 views

CVE-2026-93787

The Linux kernel contains a vulnerability in the SMB1 client where cifs_filldir() fails to verify if the entry name length provided by a server stays within the bounds of the allocated SMB response buffer. A hostile SMB1 server can return an oversized FileNameLength , causing memchr() to perform ...

8.1CVSS6.3AI score
SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/24 4:02 p.m.•12 views

CVE-2026-93787 smb: client: bound dirent name against end of SMB response in cifs_filldir

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifsfilldir cifsfilldir copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length de.namelen supplied by the server. The kmalloc'd SMB...

8.1CVSS
SaveExploits0References3
EUVD
EUVD
•added 2026/09/24 4:02 p.m.•3 views

EUVD-2026-86174

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifsfilldir cifsfilldir copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length de.namelen supplied by the server. The kmalloc'd SMB...

6.3AI score
SaveExploits0References3
EUVD
EUVD
•added 2026/09/24 4:02 p.m.•3 views

EUVD-2026-86171

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...

6.1AI score
SaveExploits0References3
CVE
CVE
•added 2026/09/24 4:02 p.m.•7 views

CVE-2026-93784

A vulnerability exists in the Linux kernel 's cfg80211 component. The function cfg80211_wext_siwgenie() fails to validate the IE buffer stored via SIOCSIWGENIE , leading to an out-of-bounds read in skip_ie() and an integer underflow in memcpy during a subsequent SIOCSIWESSID connection attempt. T...

6.1AI score
SaveExploits0References3
EUVD
EUVD
•added 2026/09/24 4:02 p.m.•2 views

EUVD-2026-86170

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

5.8AI score
SaveExploits0References3
CVE
CVE
•added 2026/09/24 4:02 p.m.•7 views

CVE-2026-93783

The Linux kernel contains a vulnerability in the Bluetooth RFCOMM component within the rfcomm_recv_frame() function. The root cause is a missing length validation when casting skb->data to struct rfcomm_hdr. This allows a truncated frame to trigger an out-of-bounds read of uninitialized memory...

5.8AI score
SaveExploits0References3
Kitploit
Kitploit
•added 2026/09/24 4:01 p.m.•13 views

CVE-2020-15368

Cómo explotar un driver vulnerable de Windows Exploit y Prueba de Concepto PoC para CVE-2020-15368. Asrock reempaquetó el driver de rweverything para su herramienta de configuración del controlador RGB y lo firmó. Lo "protegen" cifrando sus ioctls...lol. Encontramos este CVE por accidente el vera...

5.5CVSS6.6AI score0.0136EPSS
SaveExploits1References3
Kitploit
Kitploit
•added 2026/09/24 4:01 p.m.•8 views

CVE-2026-39363

CVE-2026-39363 — PoC de lectura arbitraria de archivos en Vite Dev Server PoC ejecutable directamente para GHSA-p9ff-h696-f583. A través de un WebSocket HMR sin autenticación, invoca fetchModule, eludiendo la restricción server.fs.allow de la capa HTTP, para leer archivos arbitrarios en la máquin...

8.2CVSS5.7AI score0.02619EPSS
SaveExploits4
Kitploit
Kitploit
•added 2026/09/24 3:59 p.m.•8 views

flowise-arbitrary-file-read-getFileFromStorage

Lectura arbitraria de archivos no autenticada en Flowise getFileFromStorage — nueva CVE propuesta Una vulnerabilidad independiente de CVE-2025-71338 que es el sumidero de escritura. Se trata de una lectura arbitraria de archivos no autenticada en la ruta de "rehydrate" del cargador de...

10CVSS5.9AI score0.01157EPSS
SaveExploits1
Rows per page
Query Builder