xss2shell

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Remove a drr class from the active list if it changes to strict. Whenever a user issues a ets qdisc change command, transforming a drr class into a strict one, the ets code does not check whether that class was in...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dm: Clearing the clone request’s bio pointer when the last cloned bio is freed It has been observed that stale values of rq-bio can lead to double initialization of cloned bios in request-based device-mapper targets, resulting in...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Counter: Interrupt-cnt: Remove the IRQFNOTHREAD flag An IRQ handler can either use IRQFNOTHREAD or acquire spinlockt. As noted by CONFIGPROVERAWLOCKNESTING: ============================= BUG: Invalid wait context 6.18.0-rc1+git...

OpenAI's Next AI Model Astra Shows Cyber Performance Strong Enough to Trigger Pause

OpenAI has announced that it's pausing some "internal activities" involving its upcoming artificial intelligence AI model Astra after an internal evaluation found it had made significant advancements in agentic coding and cybersecurity. In response to the discovery, the AI upstart said it's...

Exploit for CVE-2026-64564

SCTPhantom — Linux kernel SCTP ASCONF use-after-free tracking...

ubi-stage6-exploit-chain

UBI Stage 6 — Exploit Chain Evidence marker: UBI-A6-AE2856E7...

PT-2026-69908

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch...

...[ More ]

A proof of concept exploit for a time-of-check to time-of-use local privilege escalation vulnerability in libcap version 2.77. The vulnerability exists in capsetfile, which checks a supplied pathname with lstat before independently resolving the same pathname when calling setxattr. Because setxat...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Photon OS 5.0: Git PHSA-2025-5.0-91-0590

An update of the git package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0590. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-68187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p...

Linux Distros Unpatched Vulnerability : CVE-2026-68151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch an...

PT-2026-69913

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. A flaw exists where the application.saveBitbucketProvider function stores bitbucketOwner and bitbucketRepository without proper validation...

PT-2026-69894

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.0 through 2.43 Description Calling the wordexp function with the WRDE APPEND flag can cause the interface to return invalid memory within the we wordv member. This condition may lead to a process abort during subsequen...

...[ More ]

A proof of concept exploit for a server-side request forgery vulnerability in Gitea version 1.26.4. The vulnerability affects repository migration functionality and results from insufficient validation of pull request patch URLs. Although Gitea validates the original migration URL against its...

The vulnerability in the implementation of the STP (Spanning Tree Protocol) protocol for the net/bridge subsystem of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the STP protocol implementation in the Linux kernel’s net/bridge subsystem lies in the possibility of exploiting memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

Oracle Linux 10 : kernel (ELSA-2026-51295)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-51295 advisory. 6.12.0-211.44.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux...

Linux Distros Unpatched Vulnerability : CVE-2026-68399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 bpf,fork: wipe -bpfstorage before bailouts that access it, skclone performs an...

Linux Distros Unpatched Vulnerability : CVE-2026-63623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by...