325153 matches found
CVE-2026-115723
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and...
CVE-2026-98893 firmware: arm_scmi: Validate SENSOR_UPDATE payload size
In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate SENSORUPDATE payload size SENSORUPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not...
CVE-2026-98893
The Linux kernel contains a vulnerability in the arm_scmi firmware component. The parser fails to verify that the received payload contains the required number of entries based on the sensor description before parsing them. This lack of validation for SENSOR_UPDATE payload sizes can lead to issue...
CVE-2026-98893 firmware: arm_scmi: Validate SENSOR_UPDATE payload size
In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate SENSORUPDATE payload size SENSORUPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not...
CVE-2026-98892 firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate BASEERROREVENT payload size BASEERROREVENT carries a variable number of message reports, with the count encoded in errorstatus. The notification parser used that count without checking whether the...
CVE-2026-98892 firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate BASEERROREVENT payload size BASEERROREVENT carries a variable number of message reports, with the count encoded in errorstatus. The notification parser used that count without checking whether the...
CVE-2026-98892
The Linux kernel contains a vulnerability in the arm_scmi firmware component. The BASE_ERROR_EVENT carries a variable number of message reports, where the count is encoded in the error_status . The notification parser incorrectly used this count without verifying if the received payload contained...
CVE-2026-98889 wifi: iwlwifi: mvm: fix sched scan IE sizing
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...
EUVD-2026-108683
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...
CVE-2026-98889
The Linux kernel 's iwlwifi driver contains a vulnerability where scheduled scans built probe requests before the iwl_mvm_scan_fits() check. This allowed oversized Information Elements (IEs) to be copied into a fixed preq buffer without prior length validation . To resolve this, the driver was up...
CVE-2026-98889 wifi: iwlwifi: mvm: fix sched scan IE sizing
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...
CVE-2026-98882 media: chips-media: wave5: Add range checks for dec_output_info
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...
EUVD-2026-108676
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...
CVE-2026-98882
The Linux kernel contains a vulnerability in the chips-media wave5 driver. If the driver's dec_output_info contains invalid data, it can result in a buffer overflow where the driver writes into invalid memory. Specifically, the wave5_vpu_dec_get_output_info() function in drivers/media/platform/ch...
CVE-2026-98882 media: chips-media: wave5: Add range checks for dec_output_info
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...
CVE-2026-115723
Snap7 versions through 1.4.3 contain an out-of-bounds write vulnerability in the passive partner component. A malicious active partner connecting from a configured peer address can overflow application buffers by declaring an unvalidated BSend total length of up to 65535 bytes while sending a sho...
EUVD-2026-108711
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and...
CVE-2026-115723 Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and...
baron-samedit
Baron Samedit PoC Description This is a Proof-of-Concept PoC exploit for the Baron Samedit vulnerability CVE-2021-3156 tested on Ubuntu 20.04 with sudo version 1.8.31 and glibc version 2.31. The exploit leverages a heap-based buffer overflow in sudo's handling of command-line arguments when using...
