gate0

gate0 A small, auditable, terminating, deterministic micro-policy engine. Why Gate0? I built Gate0 because I was tired of debugging RegEx-based policies in production. I wanted something that was boring, bounded, and impossible to crash. If you want a flexible, general-purpose policy engine, you...

heaphopper

heaphopper HeapHopper is a bounded model checking framework for Heap-implementations. Overview Setup sudo apt update && sudo apt install build-essential python3-dev virtualenvwrapper git clone https://github.com/angr/heaphopper.git && cd ./heaphopper mkvirtualenv -ppython3 heaphopper pip install ...

heaphopper

heaphopper HeapHopper es un framework de verificación de modelos acotados para implementaciones de Heap. Descripción general Configuración sudo apt update && sudo apt install build-essential python3-dev virtualenvwrapper git clone https://github.com/angr/heaphopper.git && cd ./heaphopper...

gdcm-security-poc

Hallazgos de GDCM 1-6: paquete de reproducción Seis defectos de parser/codec en GDCM, reproducidos en v3.2.6 como fallos de sanitizer o comprobaciones de propagación acotadas. Cada disparador automatizado tiene un control casi válido que no produce la señal vulnerable. El hallazgo 1 también inclu...

CVE-2026-97428

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...

EUVD-2026-86041

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...

CVE-2026-97428: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...

SUSE CVE-2026-88012

Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream...

PT-2026-90459

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists where the nsm sendrecv msg locked function stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the...

EUVD-2026-75767

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentiall...

CVE-2026-13480

The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...

EUVD-2026-66557

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv, the PTPMGMTTIME case casts mgmttlv-data to a 10-byte struct ptptimestamp and reads it then byte-swaps and writes it back without first checking that the TLV data...

CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler

The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...

CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler

The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...

PT-2026-82107

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP MGMT TIME management id. In the tlv mgmt post recv function, the PTP...

CVE-2026-50142 libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heifcontextreadfrommemory with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seqboxes.cc, Boxstsz::parse applies maxsequenceframes only to...

CVE-2026-72685

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

PT-2026-71794

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description A flaw allows a low-privileged authenticated user with indexing permissions to submit a small document containing crafted input. Processing this document occupies a worker thread from a...

CVE-2026-68348

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2781: bound firmware description string parsing The TAS2781 firmware parser reads several variable-length description strings with strlen before checking that the string terminator is present inside the firmware blob. A...

CVE-2026-68241

In the Linux kernel, the following vulnerability has been resolved: drm/i915/mst: limit DP MST ESI service loop The loop in inteldpcheckmststatus keeps servicing interrupts originating from the sink without bound. Add an upper bound to the new interrupts occurring during interrupt processing to n...