CVE-2026-74399

A flaw was found in the Linux kernel's Extended Verification Module EVM. The evmreadxattrs function, when processing extended attributes, fails to properly initialize a buffer. This can lead to an out-of-bounds read when no extended attributes are configured, potentially allowing an attacker to...

CVE-2026-75900

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-75900

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-75900 Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

EUVD-2026-62363

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-75900

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-75900

swtpm's SWTPM_NVRAM_CheckHeader() validates buffer length against sizeof(pointer) instead of sizeof(struct), allowing an undersized buffer to pass and cause a 2-byte heap overread (6 bytes on 32-bit). Impact: daemon termination and heap data leakage to logs. Red Hat reports no mitigation; fixed i...

CVE-2026-75900

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-72352

A flaw was found in the Linux kernel's Human Interface Device HID Berkeley Packet Filter BPF component. An integer overflow, where a calculation exceeds the maximum value an integer type can store, in the hidbpfgetdata function's range check can occur when processing a very large size value. This...

CVE-2026-72400

A flaw was found in the Linux kernel's Segment Routing over IPv6 SEG6 component. Insufficient validation of the Segment Routing Header SRH length before reading its fixed fields can lead to an out-of-bounds read. A local attacker, by crafting a malicious BPF Berkeley Packet Filter program, could...

CVE-2026-72396

A flaw was found in the Linux kernel's hwmon subsystem, specifically in the adm1275 driver. This vulnerability allows a local attacker or a specially crafted device to trigger an out-of-bounds read during device name comparison. By providing a device name shorter than expected, uninitialized stac...

Libssh2-Exploit

Libssh2-Exploit 目标 在这个项目中，我们旨在针对libssh2中CVE-2019-13115所描述的越界读取漏洞创建一个漏洞利用程序。构建一个恶意ssh服务器，使连接至它的客户端崩溃，并查看是否可以进一步利用此漏洞从客户端窃取数据。 让OpenSSH服务器运行起来 下载并解压 openssh-8.1p1.tar.gz（用于未经修改的OpenSSH服务器）或 openssh-malicious.zip（用于恶意服务器）。 进入该文件夹并运行以下命令 1. ./configure --with-md5-passwords --with-pam --with-selinux...

kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

A flaw was found in the Linux kernel's CIFS Common Internet File System client. When the cifssanitizeprepath function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-boun...

CVE-2019-19012

CVE-2019-19012 在 Oniguruma 6.x（低于 6.9.4rc2）的 regexec.c 中的 searchinrange 函数中存在一个整数溢出，导致越界读取，且该读取的偏移量可由攻击者控制。（仅影响 32 位编译版本）。远程攻击者可通过精心构造的正则表达式造成拒绝服务或信息泄露，或可能产生其他未明确的危害。 研究人员：ManhND of The Tarantula Team, VinCSS a member of Vingroup 什么是 Oniguruma Oniguruma 由 K. Kosako 开发，是一个采用 BSD...

CVE-2026-75904

libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplo...

UBUNTU-CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8...

Linux Distros Unpatched Vulnerability : CVE-2026-18694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be...

Linux Distros Unpatched Vulnerability : CVE-2026-75904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index...

Linux Distros Unpatched Vulnerability : CVE-2026-63632

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.versionconverter.convertversion can...

ROS-20260819-73-0046

The vulnerability of the vobsubreadidx function in the file /src/mediatools/vobsub.c of the MP4Box component of the GPAC multimedia platform is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...