CVE-2021-3156

CVE-2021-3156 Exploit para CVE-2021-3156 Introducción Este es un exploit para la vulnerabilidad CVE-2021-3156 de sudo denominada Baron Samedit por Qualys. compilar: $ make listar objetivos: $ ./sudo-hax-me-a-sandwich ejecutar: $ ./sudo-hax-me-a-sandwich...

Interpretation Conflict

Overview @nestjs/platform-fastify is a Nest - modern, fast, powerful node.js web framework @platform-fastify Affected versions of this package are vulnerable to Interpretation Conflict via absolute-form request targets in the Fastify adapter's middleware registration. When a request is made using...

Evaluating Whether GPT-6 Astra Performs Unsanctioned Supply-Chain Attacks

This technical report presents an alignment evaluation developed and performed by the UK AI Security Institute for assessing whether advanced AI systems take unsanctioned actions outside the scope of their assigned task. We evaluate whether frontier models conduct supply-chain attacks against...

PT-2026-97524

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.1.0 through 7.3.0 Description Authenticated non-administrator users can achieve arbitrary code execution on a COSMOS server by writing malicious content into the targets modified/ overlay directory. This is possible...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the drivers/md/dm-table.c file, the dmtablecreate function in the Linux kernel from version 6.7.4 onwards may attempt to allocate more than INTMAX bytes using alloctargets. This can lead to a crash due to a missing check for the struct dmioctl.targetcount structure...

Astra Linux – Vulnerability in RustC

crossbeam-utils provides atomic operations, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. Prior to version 0.8.7, crossbeam-utils incorrectly assumed that the alignment of i,u64 was always the same as AtomicI,U64. However, the alignment of i,u...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bonding: A buffer overflow issue was fixed in the bondoptionarpiptargetsset function. In this function, if newval-string is an empty string, newval-string+1 will point to the byte after the string, leading to a buffer overflow an...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Clear nfctarget before being used A slab-out-of-bounds read occurred in nlaput, called from nfcgenlsendtarget. This issue arises when target-sensbreslen is too large; this value is duplicated from an nfctarget in pn53...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dm: Clearing the clone request’s bio pointer when the last cloned bio is freed It has been observed that stale values of rq-bio can lead to double initialization of cloned bios in request-based device-mapper targets, resulting in...

Astra Linux – Vulnerability in Intel Microcode

The non-transparent sharing of return predictor targets between contexts in some Intel processors may allow an authorized user to potentially enable information disclosure through local access...

UBUNTU-CVE-2026-89653

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...

PT-2026-90366

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the CephFS client kernel when processing CEPH MSG MDS MAP messages. The function ceph mdsmap decode in fs/ceph/mdsmap.c reads the num export targets...

PT-2026-96530

In the Linux kernel, the following vulnerability has been resolved: ceph: bound num export targets array for mds info v2/v3 ceph mdsmap decode in fs/ceph/mdsmap.c reads num export targets from each per-mds info record and advances the decode cursor by num export targets sizeofu32 without first...

CVE-2026-88015

A flaw was found in rclone. When rclone is configured with backend/local and links=true, it exposes symlink targets as .rclonelink objects. A remote attacker can send a crafted Range request with an unchecked positive Range start, leading to a deterministic slice-bounds panic. This issue results ...

CVE-2026-88015

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

pd-agent v0.2.1

ProjectDiscovery Cloud Platform — Agent What it does • Quick Start • Install • Configuration • Scaling What it does pd-agent lets you scan your own internal networks from the ProjectDiscovery Cloud Platform. Install the agent on a machine inside the network you want to scan — a VM, a server, a...

PT-2026-89476

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.1 Description When using backend/local with the --links flag or links=true configuration, symlink targets are exposed as .rclonelink objects. A flaw exists where fs.RangeOption.Decode can pass an unchecked positiv...

PT-2026-89037

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

CVE-2026-80795 nfc: nci: fix out-of-bounds write in nci_target_auto_activated()

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking the array is full...

bounty-targets-data — Updated!

bounty-targets-data What's it for This repo contains data dumps of Hackerone and Bugcrowd scopes i.e. the domains that are eligible for bug bounty reports. The files provided are: Main files: domains.txt: full list of domains, without wildcards. wildcards.txt: full list of wildcard domains. Note:...