CVE-2026-85046-who-put-the-silverback-guerilla-in-the-wasm

CVE-2026-85046 이 취약점의 다른 POC를 보고, 이건 정말 보기 끔찍하다고 생각했습니다. 그래서 POC를 단순화하고 자신의 wasm으로 점프하는 기능을 추가했습니다. wasm이니까요. Chrome 152.0.7977.75는 sort 중에 객체 포인터와 정수를 혼동할 수 있습니다. poc.js는 오래된 Wasm 모듈 참조를 유지하고, 해제된 셀을 다른 모듈로 교체한 다음, 그 오래된 참조를 통해 교체된 모듈을 호출합니다. sort는 Wasm 모듈 포인터를 정수로 유출합니다. 포인터는 GC가 추적하지 않는 위치에...

CVE-2026-80926

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2oplockbreaknoti reads opinfo-conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected,...

CVE-2026-80926 ksmbd: fix use-after-free in oplock break notification

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2oplockbreaknoti reads opinfo-conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected,...

CVE-2026-80721

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream implementation. This vulnerability occurs because the system does not properly clear references to connection handles hcon after a connection is deleted. This oversight can lead to unpredictable system behavior or instability...

CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

CVE-2026-59307

Spring Integration JdbcMessageStore has a deserialization allow-list bypass. When the store is a Spring-managed bean , calling addAllowedPatterns(...) to restrict deserialization is silently ineffective because setBeanClassLoader (invoked during Spring's bean lifecycle) replaces the deserializer ...

PT-2026-79667

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the inet frag create function where the fragment queue timer is armed before the queue is inserted into the fqdir rhashtable. If the namespace fragment timeout is zero...

EUVD-2023-32735

Malicious code in bioql PyPI...

kernel: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain

A vulnerability was found in the Linux kernel's netfilter subsystem, related to the nftchainfilter feature. This issue occurs when a NETDEVUNREGISTER event is reported, which can leave a stale reference to a network device in the ingress basechain. If this issue is not addressed, this stale...

kernel: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain

A vulnerability was found in the Linux kernel's netfilter subsystem, related to the nftchainfilter feature. This issue occurs when a NETDEVUNREGISTER event is reported, which can leave a stale reference to a network device in the ingress basechain. If this issue is not addressed, this stale...

CVE-2024-26808 netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftchainfilter: handle NETDEVUNREGISTER for inet/ingress basechain Remove netdevice from inet/ingress basechain in case NETDEVUNREGISTER event is reported, otherwise a stale reference to netdevice remains in the hook...