EUVD-2026-49902

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

EUVD-2026-49888

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...

SUSE-SU-2026:22966-1 Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.30.1 fixes various security issues: The following security issues were fixed: - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. - CVE-2026-43038: ipv6: icmp: clear skb2-cb in ip6errgenicmpv6unreach...

SUSE-SU-2026:22971-1 Security update for the Linux Kernel RT (Live Patch 4 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. -...

SUSE-SU-2026:22969-1 Security update for the Linux Kernel RT (Live Patch 6 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. ...

UBUNTU-CVE-2026-62431

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a DE fault...

ALPINE-CVE-2026-42492

Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XENDOMCTLgetdomainstate was introduced. The management of the bitmap underlying that operation is tied into the binding of the VIRQDOMEXC virtual IRQ...

CVE-2026-42492

Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XENDOMCTLgetdomainstate was introduced. The management of the bitmap underlying that operation is tied into the binding of the VIRQDOMEXC virtual IRQ...

CVE-2026-62425

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

CVE-2026-42492 vIRQ event channel binding may break Xenstore

Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XENDOMCTLgetdomainstate was introduced. The management of the bitmap underlying that operation is tied into the binding of the VIRQDOMEXC virtual IRQ...

CVE-2026-66913

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-64222

A flaw was found in the Linux kernel's octeontx2-pf driver. This vulnerability involves a double free of memory during the initialization of the Accelerated Queue AQ when an error occurs. Specifically, the pool-stack memory is freed twice, which can lead to memory corruption. A local attacker cou...

Security update for the Linux Kernel (Live Patch 46 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.184 fixes various security issues: The following security issues were fixed: CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060...

Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.22 fixes various security issues: The following security issues were fixed: CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060...

CVE-2026-64242

A flaw was found in the Linux kernel's USB gadget net2280 driver. This vulnerability occurs due to a double free error in the probe error path. When a gadget device is being initialized, an error can cause the device to be freed twice, leading to memory corruption. This can result in a denial of...

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting Detection

Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...

Adobe ColdFusion Detector

With this template we can detect a running ColdFusion instance due to an error page. !/usr/bin/env python3 -- coding: utf-8 -- """With this template we can detect a running ColdFusion instance due to an error page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

ASP.NET Core Development Environment - Exposure Detection

The ASP.NET Core application is running in Development mode, which could exposes detailed error messages and stack traces on the '/Error' page. !/usr/bin/env python3 -- coding: utf-8 -- """The ASP.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner...

School Fees Payment System 1.0 - SQL Injection

Unauthenticated SQLi via /student.php?action=delete&id= EXTRACTVALUE error-based. !/usr/bin/env python3 -- coding: utf-8 -- """School Fees Payment System 1.0 - SQL Injection""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Database Error Detection

Detects Database Error. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Database Error.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Database Error Detection', 'description': 'Detects Database Error.',...