CVE-2026-58926

A Use-After-Free (UAF) vulnerability exists in the EVS HAL , where a privileged client can free a buffer_handle_t while the producer thread is still actively using it. This race condition is triggered via the doneWithFrame and setMaxFramesInFlight functions. An attacker can exploit this to manipu...

r2frida

r2frida Radare2 and Frida better together Description Self-contained plugin for radare2 that ships frida and allows to instrument local or remote processes using r2 commands instead but not limited to Frida scripts. The radare project provides a complete toolchain for reverse engineering, it's...

ssh-auditor

SSH Auditor Features ssh-auditor will automatically: Re-check all known hosts as new credentials are added. It will only check the new credentials. Queue a full credential scan on any new host discovered. Queue a full credential scan on any known host whose ssh version or key fingerprint changes...

CVE-2026-58926: Google Android: A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t`…

A Use-After-Free UAF vulnerability exists in the EVS HAL, allowing a privileged client to free a bufferhandlet while the producer thread is still using it. This race condition, triggered via doneWithFrame and setMaxFramesInFlight, enables an attacker to manipulate freed heap memory, potentially...

CVE-2024-21626

Usage: 1.git clone https://github.com/cdxiaodong/CVE-2024-21626 2.docker-compose up Verification: If you can obtain the host's /etc/passwd, the vulnerability exists. Environment: runc: =v1.0.0-rc93,=1.1.11 Attack details & principle: In affected versions of runc, during initialization, some...

CVE-2026-32223-USBPrint-Exploit

CVE-2026-32223: Plug me If you can : Exploiting USB Printer Drivers in Windows Heap-based buffer overflow in Windows USB Print Driver usbprint.sys leading to Local Privilege Escalation LPE This vulnerability was discovered and reported by ENKI WhiteHat. Overview CVE-2026-32223 is a heap-based...

CVE-2026-119287

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

CVE-2026-119287

The Zuke build automation system for Deno (versions prior to 1.51.0 ) contains a vulnerability in the @zuke/core MCP registry mode. The system fails to apply the ZUKE_REGISTRY_LAUNCH_HOSTS authorization when processing command-form registry descriptors. If a run-capable caller invokes a tool from...

EUVD-2026-114132

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

CVE-2026-119287 Zuke: Command-form registry descriptors bypass the MCP launch policy

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

CVE-2026-119287 Zuke: Command-form registry descriptors bypass the MCP launch policy

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

CVE-2026-119287: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

PT-2026-133663

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE REGISTRY LAUNCH HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry...

CLSA-2026-1792239628 gstreamer1-plugins-good: Fix of 2 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

CVE-2026-98764

A flaw was found in the Linux kernel's USB Universal Serial Bus FunctionFS gadget subsystem. A local user can cause a Denial of Service DoS by triggering a kernel crash when querying endpoint descriptors on a USB gadget configured with lower-speed settings than the active connection speed. In thi...

SUSE CVE-2026-111066

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart...

EUVD-2026-104482

AIOHTTP: File descriptor exhaustion in multipart requests...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via multipart message handling in aiohttp/webrequest.py, where each body part in a multipart request previously opened a dedicated temporary file descriptor. An attacker can send a...

CVE-2026-96406

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...

EUVD-2026-105002

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...