EUVD-2026-86247

In the Linux kernel, the following vulnerability has been resolved: memcg: bypass the reclaim and oom killer for dying tasks once oomreaper is done At Meta, we are seeing instances where an OOM killed job is stuck in the exit path for several hours. In one particular case, the job was stuck for...

CVE-2026-93241

The Linux kernel contains a vulnerability in memcg where dying tasks can bypass reclaim and the oom killer once the oom_reaper has finished its task. This occurs because the oom_reaper is a best-effort, one-shot process; if it fails to acquire the mmap_lock in read mode (e.g., due to a sibling th...

CVE-2026-93241

In the Linux kernel, the following vulnerability has been resolved: memcg: bypass the reclaim and oom killer for dying tasks once oomreaper is done At Meta, we are seeing instances where an OOM killed job is stuck in the exit path for several hours. In one particular case, the job was stuck for...

CVE-2026-93241 memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done

In the Linux kernel, the following vulnerability has been resolved: memcg: bypass the reclaim and oom killer for dying tasks once oomreaper is done At Meta, we are seeing instances where an OOM killed job is stuck in the exit path for several hours. In one particular case, the job was stuck for...

CVE-2026-93241 memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done

In the Linux kernel, the following vulnerability has been resolved: memcg: bypass the reclaim and oom killer for dying tasks once oomreaper is done At Meta, we are seeing instances where an OOM killed job is stuck in the exit path for several hours. In one particular case, the job was stuck for...

EUVD-2026-86240

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...

CVE-2026-93235 f2fs: fix to zero post-EOF data when extending file size

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...

CVE-2026-93235

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...

CVE-2026-93235 f2fs: fix to zero post-EOF data when extending file size

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...

CVE-2026-93235

The Linux kernel f2fs filesystem contains a vulnerability where extending a file size across an unaligned EOF boundary (via truncate , fallocate , or write ) could fail to zero out post-EOF data in the partial page. This flaw could expose stale disk data after a remount or crash recovery. The fix...

wp-secure-mcp

wp-secure-mcp In plain terms: this lets an AI agent read and lightly write to a WordPress site through a real WordPress Application Password — the same credential type wp-admin already issues — and nothing else. There is no sign-up form, no OAuth client registration, no token endpoint of any kind...

CVE-2026-63203

In Logto versions 1.31.0 through 1.42.0 , a vulnerability exists in the Account API handlers located in packages/core/src/routes/account/third-party-tokens.ts. The root cause is that the handlers authenticate users but fail to require the identities scope , allowing callers with only an openid sc...

CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

EUVD-2026-86223

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-77825

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

go-cpe

go-cpe A Go library for CPEA Common Platform Enumeration 2.3 go-cpe is a implementation of the CPE Naming and Matching algorithms, as described in NIST IRs 7695 and 7696. For the reference Java implementation, see: https://cpe.mitre.org/specification/CPEReferenceImplementationSep2011.zipx...

RCE-Exploit-Framework

RCE-Exploit-Framework This framework is designed to assist penetration testers or developers in understanding the mechanics of remote code execution RCE exploitation. Features Payload Generator : Supports the creation of custom payloads based on Python, Bash, and PHP. Exploit Executor : Delivers...

crtsh

crtsh API client for crt.sh crtsh allows to get the information about a HTTPS website. e.g. Search subdoimains. This tool uses Certificate Transparency logs. For more information, check https://crt.sh/ Example Subdomains Search subdomains of example.com Organization In --query, % can be used as...