68 matches found
CVE-2026-65343
CVE-2026-65343 — AppleKeyStore OOB Read KASLR Defeat Component: AppleKeyStore kernel extension — LibSerSEPControlDeserialize Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds read in SEP control message deserialization Impact: Kernel pointer lea...
CVE-2026-80118
PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) contain an unauthenticated physical memory disclosure in DirectIo64.sys . A single IOCTL with no caller-identity check allows unprivileged local users to write a crash-...
PT-2026-86231
Name of the Vulnerable Software and Affected Versions PassMark PerformanceTest versions prior to 11.1 build 1012 BurnInTest versions prior to 11.1 build 1000 OSForensics versions prior to 11.1 build 1016 Description An unauthenticated physical memory disclosure exists in the DirectIo64.sys driver...
CVE-2026-84267
A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...
DEBIAN-CVE-2026-84267
A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...
CVE-2026-84267 Gvfs: sftp: uninitialized heap disclosure in read_string()
A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...
CVE-2026-84267
CVE-2026-84267 is an uninitialized heap memory disclosure in the SFTP backend of gvfs (GNOME Virtual File System). The root cause is in the read_string() function, which allocates a buffer without verifying it is fully populated. A malicious SFTP server can send a short FXP_HANDLE reply, causing ...
Linux Distros Unpatched Vulnerability : CVE-2026-84267
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but...
New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access
Academic researchers have disclosed a Rowhammer attack impacting NVIDIA workstation GPUs with GDDR6 memory that defeats error correction codes ECC, the mitigation NVIDIA recommends against GPU Rowhammer, and enables denial-of-service DoS and privilege escalation to a root shell. Dubbed GPUThor ,...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, if the IMA appraisal method is used with the “imaappraiselog” boot parameter, lockdown can be circumvented using kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents the “imaappraiselog” parameter from being set during boot, but this does not cover...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libssh2 (UTSA-2026-102688)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102688 advisory. libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap...
ANT-2026-203E7E95 · twigphp/Twig · auth_bypass
auth-bypass high CVE-2026-46639 GHSA-mm6w-gr99-p3jj Severity Claude high · Security research firm high · Maintainer high Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Anvil Security. ANT-2026-203E7E95: Sandbox...
CVE-2026-71391
GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...
CVE-2026-15239 Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solv...
CVE-2026-43630
llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers can craft a malicious slot file with a...
EUVD-2026-47706
An attacker who knows or guesses that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of...
CVE-2026-11331 Potential wildcard CNAME RPZ policy bypass
An attacker who knows or guesses that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of...
CVE-2026-47247 libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor WordPress, Sharp/libvips,...
AZL-90387 CVE-2026-52937 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: tap: fix stack info leak in tapioctl SIOCGIFHWADDR In the SIOCGIFHWADDR path, tapioctl copies 16 bytes of an uninitialised on-stack struct sockaddrstorage to userspace via ifrhwaddr, but netifgetmacaddress only writes safamily an...
CVE-2026-52937
CVE-2026-52937 concerns the Linux kernel where the tap_ioctl() path handling SIOCGIFHWADDR leaks kernel stack contents by copying 16 bytes of an uninitialised sockaddr_storage to userspace. Specifically, netif_get_mac_address() writes only sa_family and dev->addr_len (6 bytes), leaving sa_data...