CVE-2026-89894

A flaw was found in the Linux kernel's cx231xx media driver. A local attacker can exploit this vulnerability by manipulating video and Vertical Blanking Interval VBI queue operations. This allows for a heap out-of-bounds write, which could lead to arbitrary code execution or a denial of service...

CVE-2025-60751

CVE-2025-60751 CVE-2025-60751에 대한 PoC 영향받는 제품: Geographiclib = v2.5.1 전체 상세 분석 글은 https://zer0matt.blogspot.com/2026/05/cve-2025-60751-geographiclib-stack.html에서 확인할 수 있습니다. 설명 GeoConvert가 조작된 입력을 받을 때 스택 버퍼 오버플로우가 발생합니다. 이 오버플로우는 프로그램이 내부 인덱스를 제대로 검증하지 않아 스택에 경계를 벗어난 쓰기를 허용하기 때문에 발생합니다. 공격자는 이...

postgresql-cve-2026-14662

追踪 CVE-2026-14662 — PostgreSQL 全文搜索的越界写入漏洞 针对 PostgreSQL 全文搜索数据类型（tsvector / tsquery）中发现的 CVE-2026-14662， 本文记录了在 Docker 中同时运行修复前（18.4）与修复后（18.6）版本，并实际观察行为差异 的过程。 本内容为安全学习用途整理，并附带演示资料。 该漏洞概要 项目| 内容 ---|--- CVE| CVE-2026-14662 对象| PostgreSQL 的 tsvector / tsquery 类型| 整数回绕导致的分配大小不足与越界写入 CVSS| 8.8 /...

CVE-2026-77178

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet Am79C970A network device model...

empty_list

emptylist - p0 이슈 1564 CVE-2018-4243 iOS 11.0 - 11.3.1 커널 읽기/쓰기 익스플로잇 @i41nbeer 버그: getvolattrlist은 fgetattrlist 시스템 콜을 통해 사용자 제어 bufferSize 인자를 받습니다. 속성 목록을 직렬화할 커널 버퍼를 할당할 때 다음과 같은 주석이 있습니다: / 속성 결과를 위한 대상 버퍼를 할당합니다. 호출자가 요청한 것보다 더 많이 복사하지 않으므로, 그들이 제공한 것보다 더 많이 할당할 필요가 없습니다. / ab.allocated =...

BIT-APACHE-2026-59685 Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM

Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

BIT-APACHE-2026-56449 Apache HTTP Server: mod_proxy_html: crash in dump_content

Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

AZL-105969 CVE-2026-75818 affecting package aspell 0.60.8.1-1

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to...

OPENSUSE-SU-2026:22025-1 Security update for gimp

This update for gimp fixes the following issues: Changes in gimp: - CVE-2026-96546: one-byte out-of-bounds heap read in the uncompressed DDS loader bsc1282601 - CVE-2026-97185: out-of-bounds write in GIMPressionist plugin via crafted preset file bsc1282596...

EUVD-2026-93364

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to...

DEBIAN-CVE-2026-98312

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

AZL-106407 CVE-2026-98312 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

AZL-106476 CVE-2026-98265 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity dataepsetparams allocates each data URB for exactly u-packets isochronous frames, so urb-isoframedesc has u-packets slots and ctx-packets is the driver's only...

DEBIAN-CVE-2026-98265

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity dataepsetparams allocates each data URB for exactly u-packets isochronous frames, so urb-isoframedesc has u-packets slots and ctx-packets is the driver's only...

CVE-2026-98265

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity dataepsetparams allocates each data URB for exactly u-packets isochronous frames, so urb-isoframedesc has u-packets slots and ctx-packets is the driver's only...

AZL-105981 CVE-2026-98232 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsicdlenable scsicdlenable uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its...

DEBIAN-CVE-2026-98222

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

AZL-106092 CVE-2026-98222 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

CVE-2026-98222

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

AZL-106341 CVE-2026-98206 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into responsebuf, which is CYMAXINPUT bytes...