CVE-2026-82539

CVE-2026-82539 Information Vendor: TOTOLINK Vendor's website: TOTOLINK Model: A720R Firmware version: V4.1.5cu.630B20250509 Firmware download address: TOTOLINK Severity CVSS v4.0 Base Score: 9.4 Critical Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P Vulnerability...

extract75-cve-2020-13995

针对 CVE-2020-13995 的控制流劫持利用 构建： root@kitploit: make 运行： root@kitploit: make run 进行 Mayhem 模糊测试： root@kitploit: docker tag extract75-cve-2020-13955 /extract75-cve-2020-13955 docker push /extract75-cve-2020-13955 mayhem run --image /extract75-cve-2020-13955 \ --project /extract75 . （默认运行时间为600秒；可通过...

CVE-2026-2766-but-with-wasm

CVE-2026-2766, pero con wasm Estado: PoC de fallo validado con secuestro de flujo de control demostrado pc del fallo = veneno de celda liberada 0xcdcdcdcdcdcdcdcd bajo el shell de depuración — el motor salta a un puntero leído del ICScript liberado. Trabajo restante: controlar los bytes reclamado...

CVE-2026-57163

A flaw was found in PJSIP. A stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate. A remote attacker can exploit this by presenting a specially crafted certificate during the TLS handshake, before SIP-level authentication...

tenda-ac8v4-rop

Tenda-Ac8v4-PoC Tenda Ac8v4 通过执行流劫持和多寄存器操作利用，实现从基于栈的溢出到远程代码执行；相关 CVE 为： CVE-2023-33675 CVE-2023-33673 CVE-2023-33672 CVE-2023-33671 CVE-2023-33670 CVE-2023-33669 标记为 N1 - N7 rop.py 确保你在可访问的机器上托管了 tftp；通过 args.attackerhost 指定它； 确保预编译的加载器 rs 托管在 tftp 中； 反向 shell 连接将在脚本内监听。...

Linux Distros Unpatched Vulnerability : CVE-2026-57163

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backen...

Linux Distros Unpatched Vulnerability : CVE-2026-57162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media...

DEBIAN-CVE-2026-57163

PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate tlscertgetinfo in sslsockgtls.c. Only GnuTLS builds are affect...

CVE-2026-64565

A flaw was found in the Linux kernel's ims-pcu component. A malicious USB device can send an oversized data packet, which is not properly handled. This can lead to a heap buffer overflow, allowing an attacker to manipulate internal pointers. Successful exploitation could result in a control flow...

CVE-2026-13212

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

EUVD-2026-64925

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

CVE-2026-13212 Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

CVE-2026-13212

The Zephyr RTOS virtio driver contains an out-of-bounds read in virtio_isr() (drivers/virtio/virtio_common.c). The device-written descriptor-chain head id from the used ring is used directly as an index into recv_cbs[] and desc[] without a bounds check. A malicious or compromised virtio backend (...

ANT-2026-C6E98TYX · liboqs · Uninitialized Function Pointer (CWE-824)

other high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-C6E98TYX: 01-liboqs-ntru-uninit-fn-ptr The NTRU constructors in...

ANT-2026-QRPT15J8 · duckdb · Stack-buffer-overflow

stack-buffer-overflow high Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-QRPT15J8: Stack-buffer-overflow in...

SUSE CVE-2026-64565

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in imspcuprocessdata The imspcuprocessdata processes incoming URB data byte by byte. However, it fails to check if the readpos index exceeds IMSPCUBUFSIZE. If a malicious USB device sends...

CVE-2026-64565

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in imspcuprocessdata The imspcuprocessdata processes incoming URB data byte by byte. However, it fails to check if the readpos index exceeds IMSPCUBUFSIZE. If a malicious USB device sends...

EUVD-2026-52606

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in imspcuprocessdata The imspcuprocessdata processes incoming URB data byte by byte. However, it fails to check if the readpos index exceeds IMSPCUBUFSIZE. If a malicious USB device sends...

ANT-2026-S6CB3P3P · bind9 · Stack Buffer Overflow

stack-buffer-overflow high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-S6CB3P3P: 03-bind9-matchnsec3-stack-bof In BIND's...

libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC Scalable Video Coding layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer contex...