androguard

Androguard Do you think your phone has been pwned ? please check IsMyPhonePwned New tool: Goauld Dynamic injection tool for Linux/Android See the new version of Androguard: https://github.com/androguard/androguard/tree/ng Installation Quick installation: root@kitploit: pip install androguard...

ssh3

!NOTE SSH3 probablemente cambiará de nombre. Sigue siendo el Protocolo de Conexión SSH RFC4254 ejecutándose sobre HTTP/3 Extended Connect, pero los cambios necesarios son significativos y demasiado alejados de la filosofía de las implementaciones populares de SSH como para considerar su...

CLEANSTART-2026-GB26717 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the minio-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet: A possible leak has been fixed when destroying a ctrl during qp establishment. In nvmetsqdestroy, we capture sq-ctrl early. If it is not NULL, we know that a ctrl was allocated during the admin connect request handling. We...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Avoid null pointer deref during path establishment. For RTRS path establishment, the RTRS client initiates and completes connection establishment. After establishing all its connections, information is exchanged...

CVE-2026-49837

GoBGP (open source BGP implementation in Go) versions prior to 4.6.0 contain a boundary validation flaw in the BGP OPEN capability parser. Several capability decoders read from the full remaining buffer instead of the slice bounded by the declared CapLen , allowing a malformed OPEN message to cau...

CLEANSTART-2026-VO98287 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the vault package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-QN07777 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the vault package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-LA96365 Previously, a channel registered in the mux's chanList is not usable until it is established

Multiple security vulnerabilities affect the sealed-secrets package. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

CLEANSTART-2026-EG40747 Previously, a channel registered in the mux's chanList is not usable until it is established

Multiple security vulnerabilities affect the step-issuer package. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

CLEANSTART-2026-QK25151 Previously, a channel registered in the mux's chanList is not usable until it is established

Multiple security vulnerabilities affect the step-issuer package. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

CLEANSTART-2026-OX90258 Previously, a channel registered in the mux's chanList is not usable until it is established

Multiple security vulnerabilities affect the sealed-secrets package. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

DEBIAN-CVE-2026-56855

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

CVE-2026-78662

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

EUVD-2026-70266

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

EUVD-2026-65694

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow

A heap-based buffer overflow in FreeRDP's cryptorsacommon allows an unauthenticated remote attacker to trigger a denial of service or potential remote code execution. By sending a crafted ciphertext during RDP Standard Security key establishment, the attacker can force a data write before the siz...

CVE-2026-74345

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siwsocketdisassoc may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer...

CVE-2026-74345

The CVE-2026-74345 entry describes a Linux kernel vulnerability in the RDMA/siw driver where disassociating a socket from an endpoint may release the last reference to the endpoint, leading to a use-after-free if the endpoint’s socket pointer is cleared after the disassociation. The fix ensures t...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-17029, CVE-2026-18511, CVE-2026-18068, CVE-2026-18086 in Java Secure Sockets Extension JSSE as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17029 DESCRIPTION: IBM i could allow a local attacke...