54892 matches found
CVE-2026-64580
In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...
EUVD-2026-53274
In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...
CVE-2026-64571 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...
CVE-2026-64571
Technical details are not publicly available in the provided documents. Monitor for updates on affected versions, fixes, and affected hardware/software.
CVE-2026-64571
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...
CVE-2026-64571 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...
Kali365 Exploits Microsoft Device Login to Access US Corporate Data
Learn how Kali365 has been abusing Microsoft device login to gain OAuth tokens, targeting US firms, and how SOC teams can detect, hunt, and stop these phishing attacks...
CVE-2026-49004
CVE-2026-49004 describes misconfiguration and command injection in the built-in PostgreSQL service on the mobile device (ZTE NX799J/Red Magic 11 Air). The service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGR...
CVE-2026-18902 H3C NX15 esps repeaterproc command injection
A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit i...
SUSE CVE-2026-67303
FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in channels/serial/client/serialmain.c. When serial device redirection is enabled and a server-controlled IRPMJDEVICECONTROL request specifies an unsupported IOCTL...
Linux Distros Unpatched Vulnerability : CVE-2026-64580
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device...
Linux Distros Unpatched Vulnerability : CVE-2026-64571
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without...
Ghost: Blind Password Hash Disclosure in Ghost Admin API
Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...
CVE-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API
Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...
sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The commercial phishing-as-a-service PhaaS toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication MFA and seiz...
Root-My-Galaxy-Payloads
Root My Galaxy Payloads This repository contains the device-s...
Malicious code in tailwind-anime (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd7605f83f25074e67fa0c72679d47f50fe781dae40e4560ee0a216e91320014 [email protected] is a typosquat of tailwindcss-animate. Its index.js appends an evalatob'...' blob that runs whenever the plugin is required e.g....
