597911 matches found
GHSA-2J95-GQXF-V3VG Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
Vulnerability ZooKeeperReplicationConfig.secret silently substitutes the hard-coded constant "ch4n63m3" leetspeak for "change me" whenever the operator omits replication.secret. The same secret is wired into both the client-facing SASL context and the quorum/learner SASL contexts of the embedded...
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
Vulnerability ZooKeeperReplicationConfig.secret silently substitutes the hard-coded constant "ch4n63m3" leetspeak for "change me" whenever the operator omits replication.secret. The same secret is wired into both the client-facing SASL context and the quorum/learner SASL contexts of the embedded...
CVE-2026-43499-S26
CVE-2026-43499 — Android GKI 6.12 pselect / configfs 内核漏洞利用 针对 Android GKI 6.12 系列（三星和 Pixel 设备）的 Linux 内核漏洞利用，目标是 CVE-2026-43499 ：rtmutexstartproxylock 中 removewaiter 的回滚存在缺陷，它使用了 current 而不是 waiter::task，导致等待者的 piblockedon 指向其（稍后被弹出的）内核栈上的 rtmutexwaiter。结合 pselect 的 fdset 栈覆写以及由消费者 schedsetattr...
[SECURITY] [DSA 6494-1] kamailio security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6494-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 11, 2026 https://www.debian.org/security/faq -...
CiscoISE-CVE-2025-20282-POC
Cisco ISE CVE 2025-20282 Prueba de concepto Informe: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ El script de Python abusa de la función de subida disponible sin autenticación en /admin/files-upload/ El script crea localmente una carpeta bin y un archivo...
Vlun-Agent-X
VulnAgent-X 研究原型 VulnAgent-X 是一个面向论文复现的多 Agent 漏洞/缺陷检测原型。 输入本地仓库或 diff，输出结构化 findings、证据链、定位结果、置信度和实验日志。 核心能力 输入形式：repo path 或 unified diff 工作流：screening - context expansion - scheduler - router - experts - sceptic - verificationstub - evidence fusion 输出字段： issuetype locationfile + line range...
CVE-2025-10230
CVE-2025-10230: Samba 关键 RCE 漏洞 CVSS 10.0 漏洞摘要 CVE-2025-10230 是一个关键的远程代码执行 RCE 漏洞，已在 Samba 代码库中隐匿了 13 年。 该漏洞存在于 WINS（Windows Internet Name Service）注册数据包的处理过程中。当 Samba 配置为域控制器，启用 wins support = yes 并在 wins hook 中定义了脚本时，它未能对接收到的 NetBIOS 名称进行净化。 未认证的攻击者可以发送包含 shell 元字符（例如 command）的恶意名称注册数据包，这些字符会直接传...
DEBIAN-CVE-2026-89766
In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...
CVE-2026-89766
In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...
DEBIAN-CVE-2026-89746
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as nameddata. Both are added to tr-histvars by savehistvars...
AZL-100169 CVE-2026-89746 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as nameddata. Both are added to tr-histvars by savehistvars...
CVE-2026-89746
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as nameddata. Both are added to tr-histvars by savehistvars...
AZL-100500 CVE-2026-89603 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscalltraceenter for ptrace, another thread can install a seccomp filter with SECCOMPFILTERFLAGTSYNC e.g...
DEBIAN-CVE-2026-89603
In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscalltraceenter for ptrace, another thread can install a seccomp filter with SECCOMPFILTERFLAGTSYNC e.g...
CVE-2026-89603
In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscalltraceenter for ptrace, another thread can install a seccomp filter with SECCOMPFILTERFLAGTSYNC e.g...
AZL-100424 CVE-2026-81013 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...
DEBIAN-CVE-2026-81013
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...
CVE-2026-81013
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...
CVE-2026-81008
In the Linux kernel, the following vulnerability has been resolved: interconnect: Fix use after free in iccget and oficcgetbyindex In oficcgetbyindex and iccget, if the dynamic allocation for path-name fails via kasprintf, the error handling path directly calls kfreepath to free the path object a...
DEBIAN-CVE-2026-81008
In the Linux kernel, the following vulnerability has been resolved: interconnect: Fix use after free in iccget and oficcgetbyindex In oficcgetbyindex and iccget, if the dynamic allocation for path-name fails via kasprintf, the error handling path directly calls kfreepath to free the path object a...