EUVD-2026-89433

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

EUVD-2026-89435

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and...

CVE-2026-74221

Versions of U-Boot prior to 2026.10-rc5 are susceptible to a buffer overflow in the nfs_readlink_reply() function located in net/nfs-common.c. The vulnerability occurs when the bootloader processes responses from an NFS server that provides crafted READLINK replies containing negative or oversize...

CVE-2026-74222

U-Boot versions before 2026.10-rc5 are vulnerable to a use-after-free flaw in the httpc_recv_cb() function of the lwIP wget implementation. The vulnerability occurs when HTTP data storage fails: the callback frees the connection PCB but incorrectly returns ERR_BUF instead of ERR_ABRT. This error ...

CVE-2026-71971

The U-Boot bootloader (versions before 2026.10-rc3 ) is vulnerable to an out-of-bounds write in the ‘net_defragment‘ function within net/net.c when CONFIG_IP_DEFRAG is enabled. A remote attacker can trigger this by sending a crafted IP fragment with a non-zero offset and the More-Fragments flag s...

CVE-2026-97927

A flaw was found in the Linux kernel's Unix File System UFS implementation. This vulnerability allows a local user to cause a Denial of Service DoS by mounting a specially crafted or corrupted file system image. During a failed mount operation, an improper cleanup sequence leads to a null pointer...

CVE-2026-97925

A flaw was found in the Linux kernel's timer tick broadcast subsystem. A race condition occurs when installing a replacement clock event device concurrently with ongoing tick broadcast operations, causing the system to attempt to arm a detached timer device. If the central processing unit CPU...

CVE-2026-97916

A flaw was found in the Linux kernel's Intel VPU ivpu driver. A compromised device firmware can cause a Denial of Service DoS by modifying log buffer metadata in shared memory. Because the host driver re-reads buffer size fields from shared memory after validating them, the firmware can alter the...

CVE-2026-102809

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight...

CVE-2026-102712

On the first DTLS ClientHello, the parser copies a device-claimed sessionid length and validates the ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim in...

CVE-2026-102555

A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling gbase64decodeinplace. If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the si...

CVE-2026-102724

NULL Pointer Dereference When Evicting the Sole MSRP Attribute...

CVE-2026-102712

On the first DTLS ClientHello, the parser copies a device-claimed sessionid length and validates the ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim in...

CVE-2026-102712

A vulnerability exists in the DTLS parser where it incorrectly validates the ciphersuite-list length against the total record length rather than the remaining bytes during the first ClientHello . This flaw allows an unauthenticated peer to trigger an Out-of-Bounds (OOB) source read of up to 255 b...

CVE-2026-67406

A flaw was found in rabbitmq-server. When the Shovel plugin worker process crashes due to network or connection failures, it fails to sanitize its internal state before logging error reports. As a result, sensitive connection details and unencrypted credentials, including plaintext passwords, are...

CVE-2015-1318

CVE-2015-1318 我在Matthew Might的编译器课程中用来获取10%期末额外加分的漏洞利用程序。 https://bugs.launchpad.net/apport/+bug/1438758 额外加分机会（http://matt.might.net/teaching/compilers/spring-2015/）...

CVE-2026-97905

A flaw was found in the Linux kernel's CPU frequency scaling cpufreq subsystem. When creating a frequency policy, the kernel exposes system control files sysfs attributes before the CPU mask memory is zero-initialized. A local user could exploit this race condition by accessing these sysfs...

CVE-2024-23722-poc

CVE-2024-23722-poc 使用方法 python3 exploit.py http://127.0.0.1:8888 port is currently not open port is currently not open port is currently not open port is currently not open Server might have crashed port is currently not open port is currently not open port is currently not open Server might have...

CVE-2026-97901

A flaw was found in the Linux kernel's Generic Netlink genetlink component. This flaw allows a local user to cause a Denial of Service DoS through a system crash. The vulnerability occurs because the kernel fails to maintain a reference to the target module during a policy dump that spans multipl...

EUVD-2026-89108

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sdstress command where the -b byte count parameter is parsed without validation before being passed to malloc and memset. Attackers with shell access, including through MAVLink, can supply invalid byte count...