27665 matches found
CVE-2026-110632 Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module...
File-Tunnel
File Tunnel Tunnel TCP connections through a file server. A full list of supported file systems can be found here. Download Portable executables for Windows, Linux and Mac can be found over in the releases section. Example 1 - Bypassing a firewall You'd like to connect from Host A to Host B, but ...
SUSE-SU-2026:4660-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's-nocbcbkthread pointer bsc1254408. - CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queu...
AppleDOS
AppleDOS CVE-2018-4407 Based on CVE-2018-4407 https://lgtm.com/blog/applexnuicmperrorCVE-2018-4407, this tweet, and this video. The bug is heap overflow vulnerability in bad packet handling when OS try to send ICMP message containing segments from bad packet back to the sender. This POC will...
EUVD-2026-100744
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet retransmit or malicious is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to...
CVE-2026-98417
In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...
FreeBSD -- Remotely triggerable buffer overflow in tcp_rack
Problem Description: When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: unbound (UTSA-2026-130093)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130093 advisory. In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet...
DEBIAN-CVE-2026-94453
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet retransmit or malicious is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to...
CVE-2026-94453
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet retransmit or malicious is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to...
CVE-2026-94453
Libreswan's pluto daemon contains a use-after-free vulnerability in its IKE-over-TCP handling. The flaw occurs because the daemon retains IKE state in memory after a client closes a TCP connection; if a subsequent packet is received for the same tuple, the daemon accesses an invalid pointer to a ...
CVE-2026-94453 IKEv2 Use-After-Free bug when using IKE-over-TCP
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet retransmit or malicious is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to...
CVE-2026-94453
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet retransmit or malicious is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to...
CVE-2026-49950
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv passing unvalidated data to cloudpickle.loads, which...
CVE-2026-96852
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally...
CVE-2026-85834
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally...
CVE-2026-85368
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally...
CVE-2026-83872
Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally...