SNEK_Equinox

SNEK Equinox Vorrei ringraziare Nightmare-Eclipse per l'ispirazione non personale dal progetto UnDefend - https://web.archive.org/web/20260521145157/https://github.com/Nightmare-Eclipse/UnDefend: Ironia della sorte, ho trovato un modo per mentire alla console web dell'EDR mostrando che Defender è...

VQ-RefluxCore

VQ-RefluxCore: Estrutura de Avaliação e Pesquisa de Vulnerabilidades de Kernel VQ-RefluxCore é uma estrutura avançada de pesquisa em segurança projetada para modelar, analisar e demonstrar mecânicas de Escalação de Privilégio Local LPE associadas a condições de corrida em nível de kernel e...

CVE-2026-41651

🔥 CVE-2026-41651 — TOCTOU Privilege Escalation Locale in PackageKit Pack2TheRoot Exploit di escalation dei privilegi locale che prende di mira il demone PackageKit. Permette di passare da un utente locale non privilegiato a root sfruttando una vulnerabilità di razza TOCTOU. 📌 Panoramica...

CVE-2026-5061

CVE-2026-5061 Consul Template hat validiert, wohin ein Symlink während der Template-Auswertung zeigte, aber der spätere Abruf der Abhängigkeit las den ursprünglichen Pfad. Wenn der Link zwischen diesen Vorgängen umgebogen wurde, wurde aus einem Dateiverweis innerhalb der Sandbox eine...

CVE-2026-41651

CVE-2026-41651 root@kitploit: CVSS 3.x : 7.8 HIGH CWE : CWE-367 Time-of-Check Time-of-Use Fix : PackageKit 1.3.5+ Affects : PackageKit 1.0.2 – 1.3.4 Escalata locale dei privilegi tramite condizione di gara TOCTOU nel gestore delle transazioni D-Bus di PackageKit. Qualsiasi utente locale senza...

SUSE CVE-2026-74692

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...

CVE-2026-74707

In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...

CVE-2026-74692

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...

CVE-2026-74707

CVE-2026-74707 affects the Linux kernel's xsk (AF_XDP sockets) component, specifically the zero-copy TX path . The root cause is a time-of-check-to-time-of-use (TOCTOU) flaw: TX metadata is validated when obtaining the descriptor context but then read again later when preparing the hardware reque...

CVE-2026-74707 xsk: validate metadata when processing requests

In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...

CVE-2026-74692 net/smc: fix TOCTOU race between smc_listen_out() and listener close

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...

CVE-2026-74692

A TOCTOU race condition in the Linux kernel's net/smc module allows a remote attacker to trigger kernel memory exhaustion. The function smc_listen_out() reads the listener's socket state without holding the listener lock, then acquires the lock only afterward. This window lets smc_close_active() ...

CVE-2026-74692 net/smc: fix TOCTOU race between smc_listen_out() and listener close

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...

EUVD-2026-64379

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...

PT-2026-79697

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smc listen out and listener close smc listen out reads lsmc-sk.sk state without the listener lock, then acquires lock sock nested only after the check passes. This opens a window where smc close...

PT-2026-79720

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpf nf ct lookup and bpf nf ct alloc entry read opts-netns id separately when acquiring and...

Linux Distros Unpatched Vulnerability : CVE-2026-74692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only...

EUVD-2026-63995

In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...

CVE-2026-49114 ONNX symlink-following and path-traversal arbitrary file write

In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...

CVE-2026-62941 Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...