cve-2026-32746

CVE-2026-32746 - telnetd LINEMODE SLC Buffer Overflow Pre-authentication buffer overflow in GNU InetUtils telnetd's LINEMODE SLC Set Local Characters handler. CVSS 3.1: 9.8 Critical | CWE: CWE-120, CWE-787 Overview The addslc function in telnetd/slc.c appends 3 bytes per SLC triplet to a fixed...

elfloader

Summary elfloader is a super simple loader for ELF files that generates a flat in-memory representation of the ELF. Pair this with Rust and now you can write your shellcode in a proper, safe, high-level language. Any target that LLVM can target can be used, including custom target specifications...

CVE-2019-18634

SUDO VULNERABILITY CVE-2019-18634 Exploit developed in Python for Sudo vulnerability BSS overflow CVE-2019-18634. For studying reasons USE root@kitploit: python run.py Credits https://github.com/Plazmaz/CVE-2019-18634 https://bestwing.me/CVE-2019-18634-analysis.html...

CVE-2026-14297

A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service CGMS Record Access Control Point RACP write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on...

CVE-2026-14297

CVE-2026-14297 is a buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler of Nordic Semiconductor Struct SA . The vulnerable code memcpys the entire attacker-supplied ATT write value into a fixed 20-byte static BSS buffer , ...

PT-2026-86654

A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service CGMS Record Access Control Point RACP write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A list management bug in BSS handling in the mac80211 stack of the Linux kernel versions 5.1 through 5.19.x, prior to 5.19.16, could be exploited by local attackers those capable of injecting WLAN frames to corrupt a linked list and, in turn, potentially execute unauthorized code...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A issue was discovered in the Linux kernel before version 5.19.16. Attackers who were able to inject WLAN frames could cause a buffer overflow in the ieee80211bssinfoupdate function in the net/mac80211/scan.c file...

SUSE CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

AZL-95846 CVE-2026-70457 affecting package rsync for versions less than 3.5.0-1

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

ALPINE-CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457 rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

EUVD-2026-58047

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457 rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

EUVD-2026-57047

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925mcubsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68307

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925vifconnectiter replays firmware state for links tracked in mvif-validlinks. After MLO link changes or MCU timeout recovery, the driver bitmap can...

CVE-2026-68307

The CVE concerns the Linux kernel wifi driver mt76 (mt7925) where a reset/replay path replays firmware state for links tracked in mvif-&gt;valid_links. After MLO link changes or MCU timeout recovery, the driver bitmap can temporarily include a link whose mac80211 bss_conf has already gone away, l...