EUVD-2026-81916

In the Linux kernel, the following vulnerability has been resolved: usb: atm: usbatm: fix invalid cirange initialization syzbot reported a shift-out-of-bounds in vccconnect: UBSAN: shift-out-of-bounds in net/atm/common.c:382:32 shift exponent -1 is negative CPU: 0 UID: 0 PID: 5987 Comm: syz.0.18...

CVE-2026-90054

CVE-2026-90054 affects the Linux kernel TCP retransmit path. The root cause is a missing urgent-mode guard in __tcp_retransmit_skb(): unlike the normal transmit path, it builds multi-segment GSO packets while in urgent mode. Because urg_ptr is an offset from each segment's own sequence number but...

CVE-2026-90054 tcp: fix corruption of urgent data on multi-segment retransmit

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

EUVD-2026-81915

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

CVE-2026-90052

A buffer overflow in the Linux kernel's dm-integrity subsystem occurs when processing keyed discard operations. Since commit 68c5c42567bc, integrity_metadata computes a checksum for every discarded block into a fixed-size buffer. However, integrity_sector_checksum always writes the full digest re...

CVE-2026-90052 dm-integrity: fix buffer overflow with keyed discard

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc "dm-integrity: replace forgeable discard filler with a keyed sector marker", integritymetadata computes a checksum for every discarded block into the...

EUVD-2026-81913

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc "dm-integrity: replace forgeable discard filler with a keyed sector marker", integritymetadata computes a checksum for every discarded block into the...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcpconnrequest bsc1235944 bsc1269731. CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync...

CVE-2025-14847

CVE-2025-14847 CVE-2025-14847 漏洞环境附带一份poc https://jira.mongodb.org/browse/SERVER-115508 SUMMARY This is a critical fix to address CVE-2025-14847. Upgrade to 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30. ISSUE DESCRIPTION AND IMPACT An client-side exploit of the Server's zlib implementation ca...

poc-cve-2025-29927

Next.js 中间件绕过 CVE-2025-29927 概念验证 本仓库包含 CVE-2025-29927 的 概念验证 POC ，这是 Next.js 中的一个严重漏洞，允许攻击者绕过在中间件中实现的授权检查。 📋 目录 1. 运行 POC 应用 2. 使用漏洞利用脚本 3. 如何修复漏洞 4. 漏洞详情 运行 POC 应用 此 Next.js 应用程序通过一个受保护的控制面板路由演示了该漏洞。 设置说明 1. 克隆仓库 2. 安装并运行： root@kitploit: npm install npm run build npm run start 3. 在浏览器中访问...

CVE-2026-42533

CVE-2026-42533 — nginx map/regex capture clobbering tracking site Source for the CVE-2026-42533 patch-status tracker: a single-page site recording which distributions have shipped a fix for the nginx map/regex capture-clobbering heap overflow. Where the facts live Everything about the bug —...

nimux

纯 Nim 编写的网络枚举与远程执行工具包 nimux - 原生操作员工具包 nimux 是一个面向授权安全评估的原生命令界面。它将网络枚举、轻量级 Web 发现、凭据验证、Active Directory 操作、Kerberos 工作流、远程执行、文件传输、机密收集、DCSync、GPO 操作、数据库客户端和 SOCKS 路由整合到一个纯 Nim 工具包中。 当前版本：v1.0.6 您正在访问 nimux 的官方公共仓库。 网站：https://nimux.wiki 文档：https://docs.nimux.wiki 源码：https://github.com/blue0x1/nim...

google-osconfig-privesc

Summary googleosconfigagent 进程是 GoogleCloudPlatform https://github.com/GoogleCloudPlatform/osconfig 工具的一个组件， 默认运行在每个 VM 上。该代理以 root 身份运行，并负责一些用户可控制的服务， 包括 OS config https://cloud.google.com/compute/docs/os-config-management，这有点像 Google 的基于轮询的期望状态 配置实现。 本仓库托管了一个关于我在该实现中发现的一个权限提升缺陷的演示（该缺陷后来已被 Googl...

log4shell-finder

log4shell-finder - 最快的 log4j 实例文件系统扫描器 Python 移植版本，基于 https://github.com/mergebase/log4j-detector。log4j-detector 版权所有 C 2021 Mergebase Software Inc. https://mergebase.com/，采用 GPLv3 许可。 移植到 Python 的动机是提升性能、降低内存消耗并提高代码可读性。请参阅下面关于性能对比的部分。 而且它似乎是内存占用最低且扫描速度最快的工具 识别文件系统上存在漏洞的 log4j 1.x、reload4j 1.2.18...

grubcrawler

具备反检测、视觉回退和点对点网格的智能网络爬虫。 端点 · 网格 · 反检测 · Ghost Protocol · 实时流 · MCP 工具 · 快速开始 · 基准测试 · 架构 全栈网络爬虫引擎，支持 JavaScript 渲染、Camoufox 反检测浏览器、每请求代理路由和自主代理循环。通过原生 Rust 提取引擎将页面转换为干净的 Markdown。当常规爬虫被 Cloudflare、验证码或 JavaScript 墙阻挡时，Ghost Protocol 会截取屏幕截图并通过视觉 AI（Claude、GPT-4o 或 Ollama）提取内容。支持单个会话中跨...

tanstack-compromise-checker

tanstack-compromise-checker 检测开发者机器、仓库或CI运行器上TanStack npm供应链攻击的指标。提供Bash脚本、Docker镜像和GitHub Action三种入口，共享同一检测引擎。 CVE-2026-45321 /GHSA-g7cv-rxg3-hmpx 2026年5月11日，攻击者通过GitHub Actions缓存投毒，在42个@tanstack/包中发布了84个恶意版本。该载荷窃取GitHub令牌、npm令牌、AWS/GCP/Azure凭证，并安装了一个死亡开关 守护进程，一旦被窃取的令牌被撤销，就会立即清空/目录。 快速开始...

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15. The escape runs with the rights of the host account that runs th...

WEBFANG

WEBFANG v2.0 免責事項: Webfangは、倫理的なハッカー、ブルーチーム、レッドチーム向けに設計・開発されたリコンサンスツールキットのCLIです。スパイダリング、サブドメインスキャン、WHOIS、DNS、Shodan、ヘッダーフィンガープリンティングを使用して、パッシブおよびアクティブリコンサンスを実行します。WEBFANGは、許可されたペネトレーションテスト、OSINTリサーチ、倫理的なハッキング専用です。無許可での使用は違法です。作成者は悪用に対する責任を負いません。常に適切な許可を得てから使用してください。® All Rights Reserved プレビュー:...

CVE-2026-86864 pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...

CVE-2026-86864 pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...