EUVD-2026-105252

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass...

detection-defense-library

Detection Defense Library One defense-engineering library, consolidated. Attack classes, the patterns that detect them, the committed Sigma rules, and the Windows trust-boundary model, all in a single repo. This repo folds in five former sibling repositories: Former repo| Folded into| What it hol...

sshhipot

Version 2 is under development. Please switch to the v2 branch, build, and run with -h. SSHHiPot High-interaction SSH honeypot ok, it's really a logging ssh proxy. Still more or less a work-in-progress. Feel free to go install this repository if you'd like to try it. Run it with -h to see more...

CVE-2026-98608

A flaw was found in the Linux kernel's VirtIO GPU graphics processing unit driver. When handling resource creation requests, an improper error-handling path fails to release acquired object references upon failure, causing memory and system resources to leak. A local user could exploit this flaw ...

CVE-2026-98609

A flaw was found in the Linux kernel's VirtIO GPU driver. When graphics buffer handle creation fails, the driver improperly handles object references, preventing cleanup functions from freeing allocated memory and host resources. A local attacker could exploit this vulnerability to trigger a...

CVE-2026-95210

A flaw was found in GnuTLS. Improper certificate validation causes the library to accept certificates containing invalid extensions. A remote attacker could exploit this flaw by presenting a specially crafted certificate during a secure connection. Successful exploitation may allow an attacker to...

CVE-2026-95168

A flaw was found in thefuck. This vulnerability allows a local attacker to execute arbitrary code by supplying malicious rule files through insecure import path resolution. When the application loads rules, it evaluates code from untrusted paths, leading to unauthorized code execution with the...

browser-identity-attacks-matrix

Browser & Identity Attacks Matrix This repository is a collection of browser and identity attack techniques covering SaaS apps, browser-based attacks, identity providers, and phishing. It is intended to be a resource for security researchers, red/blue teams, and penetration testers to learn about...

payloads

payloads Git All the Payloads! A collection of web attack payloads. Pull requests are welcome! Usage run ./get.sh to download external payloads and unzip any payload files that are compressed. Payload Credits fuzzdb - https://github.com/fuzzdb-project/fuzzdb SecLists -...

CVE-2026-97605

A flaw was found in the Linux kernel. When resizing the decompression stream pool in the Enhanced Read-Only File System EROFS encounters a memory allocation failure, an uninitialized stream is improperly retained in the active pool. A local user accessing or decompressing an affected filesystem c...

CVE-2026-93255

A flaw was found in the Linux kernel's Btrfs file system. A race condition occurs between background read I/O completion and extent buffer cache invalidation during unmount operations because read status flags are cleared outside of the reference count lock. A local user performing file system...

CVE-2026-93243

A flaw was found in the Linux kernel's secret memory secretmem subsystem. A local user can bypass locked memory resource limits by repeatedly mapping and unmapping secret memory ranges. Because the kernel fails to properly track these unevictable memory pages against user limits, an unprivileged...

CVE-2026-93241

A flaw was found in the Linux kernel. When the out-of-memory OOM killer terminates a multi-threaded process and asynchronous memory cleanup cannot complete, exiting threads continue to invoke memory reclamation and serialize behind an internal lock. A local user can exploit this vulnerability by...

CVE-2026-93226

A flaw was found in the Linux kernel's IPv6 networking subsystem. A race condition occurs when reading route exception lists without proper synchronization against concurrent route updates. A local user can trigger this flaw by querying network routing tables during simultaneous route updates,...

CVE-2026-93206

A flaw was found in the Linux kernel. This vulnerability allows an unprivileged local attacker to bypass security restrictions. By obtaining a file descriptor from a privileged process, the attacker can read the entire Peripheral Component Interconnect PCI configuration space, which could lead to...

CVE-2026-90019

A flaw was found in the Linux kernel. A null pointer dereference can occur in the usbputfunctioninstance function within the USB gadget subsystem. This issue arises because a file descriptor fd is not allocated before being dereferenced in an error path, which can lead to a system crash. A local...

CVE-2026-89874

A flaw was found in the Linux kernel's v4l2-async media subsystem. When creating ancillary media links, the v4l2asyncmatchnotify function attempts to delete an unlinked entry if the link creation fails. This can lead to a null pointer dereference, potentially causing a system crash. A local...

CVE-2026-89808

A flaw was found in the drm/amdkfd component of the Linux kernel. During virtual memory VM migration, if a VM range is a 'hole' on the CPU side, an uninitialized variable is used. This can cause the system to drop all Video Random Access Memory VRAM, potentially leading to a denial of service or...

CVE-2025-50675-GPMAW-Permissions

CVE-2025-50675 – Insecure Permissions in GPMAW 14.2 Summary CVE-2025-50675 affects GPMAW 14.2, a bioinformatics software developed by Lighthouse Data. The installer creates the folder C:\Program Files\gpmaw with full control granted to the 'Everyone' group , allowing any local user to modify file...

CVE-2026-98499

A flaw was found in the Linux kernel's Wacom Human Interface Device HID driver. When processing a device report descriptor with mismatched usage and count configurations, the driver can calculate an invalid memory offset and perform an out-of-bounds read beyond the allocated report buffer. A loca...