Nameles

Auditable Invalid Traffic Detection Nameles • Key Features • Performance • Examples • Install • Support • Docs • Issues • License • Download Nameles brings state-of-the-art invalid traffic detection, analysis and real-time filtering to every advertiser, data scientist, advertising technology...

Sniffle

Sniffle Sniffle is a sniffer for Bluetooth 5 and 4.x LE using TI CC1352/CC26x2 hardware. Sniffle has a number of useful features, including: Support for BT5/4.2 extended length advertisement and data packets Support for BT5 Channel Selection Algorithms 1 and 2 Support for all BT5 PHY modes regula...

skylift

SkyLift SkyLift is an experimental Wi-Fi/BT geolocation spoofing device that uses the ESP8266 or ESP32 boards to broadcast Wi-Fi beacon frames or BT advertisements that emulate the wireless infrastructure from a remote/target location. The above example shows a successful georelocation to Peter...

Wp_Adning_Advertising_Shell_Upload

WpAdningAdvertisingShellUpload python 2.7...

Adning Advertising <= 1.5.5 - Arbitrary File Upload

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ninguploadimage function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites...

Joomla! Component Advertising 0.25 - Local File Inclusion

A directory traversal vulnerability in the Advertising comadvertising component 0.25 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1473 info: name: Joomla! Component...

CVE-2026-99014

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition between concurrent worker threads during Periodic Advertising PA sync scan setup can cause a command buffer to be freed while still in use. A local attacker could exploit this use-after-free flaw to cause a Denial of...

CVE-2026-81039

The Bluetooth host contains a connection reservation leak in the subsys/bluetooth/host/adv.c and subsys/bluetooth/host/hci_core.c components. When multiple connectable advertising sets share an identity and CONFIG_BT_EXT_ADV_MAX_ADV_SET &gt; 1, the host incorrectly attributes reservations to the ...

CVE-2026-81039 Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...

CVE-2026-81039 Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate mesh send advertising payload length Currently, meshsend limits MGMTOPMESHSEND to the total command length; however, it never verifies whether the bytes provided for the flexible advdata array actually...

CVE-2026-87968

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin, in versions before 5.3.2 , contains a vulnerability due to a missing nonce or capability check on an AJAX action. This flaw allows unauthenticated users to force a store re-regi...

EUVD-2026-100857

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visito...

CVE-2026-87968: Improper Access Control

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visito...

Grindr users’ sensitive data shared through ad auctions without valid consent

Norway’s privacy regulator Datatilsynet has fined advertising technology company Xandr 92 million Norwegian kroner, approximately $9.6 million, for unlawfully processing and sharing sensitive information about Grindr users. While the decision concerns users in Norway, the data-sharing practices...

CVE-2026-19570

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bapbroadcastsink.c copies subgroup metadata from a received Basic Audio Announcement BASE into the static Broadcast Audio Scan Service parameter structure modsrcparam without any bounds check. In basesubgroupmetacb the destination element was...

CVE-2026-19570

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bapbroadcastsink.c copies subgroup metadata from a received Basic Audio Announcement BASE into the static Broadcast Audio Scan Service parameter structure modsrcparam without any bounds check. In basesubgroupmetacb the destination element was...

CVE-2026-19570 Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bapbroadcastsink.c copies subgroup metadata from a received Basic Audio Announcement BASE into the static Broadcast Audio Scan Service parameter structure modsrcparam without any bounds check. In basesubgroupmetacb the destination element was...

CVE-2026-19570 Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bapbroadcastsink.c copies subgroup metadata from a received Basic Audio Announcement BASE into the static Broadcast Audio Scan Service parameter structure modsrcparam without any bounds check. In basesubgroupmetacb the destination element was...

EUVD-2026-95526

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bapbroadcastsink.c copies subgroup metadata from a received Basic Audio Announcement BASE into the static Broadcast Audio Scan Service parameter structure modsrcparam without any bounds check. In basesubgroupmetacb the destination element was...