91075 matches found
Linux kernel MRP: vector attribute parsing errors break applicant state handling
Linux kernel MRP: vector attribute parsing errors break applicant state handling Vulnerability Overview The Linux kernel MRP IEEE 802.1 Multiple Registration Protocol PDU parser mishandles zero-length vector attributes, event counts and attribute-value advancement in mrppduparsevecattr, breaking...
Linux kernel 6LoWPAN: off-by-one in multicast context address compression leaks a stack byte
Linux kernel 6LoWPAN: off-by-one in multicast context address compression leaks a stack byte Vulnerability Overview The Linux kernel 6LoWPAN IPHC multicast context address compression path contains an off-by-one error and uses a wrong memcpy offset, corrupting the RIID field of compressed multica...
Linux kernel 9p: oldfid erroneously released in p9_client_walk() error path
In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9clientwalk error path When p9clientwalk is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunkfid, which...
Exploit for NULL Pointer Dereference in Pgbouncer
--- CVE-2026-6666 – XPC Service NSKeyedUnarchiver Deserializ...
Exploit for CVE-2026-7777
--- CVE-2026-7777 – Rust Use‑After‑Free in Unsafe Web Server...
CVE-Poc_All_in_One
CVE Poc All in One 🛡️ This is a tool for searching, filtering...
Exploit for CVE-2026-2828
--- 4. CVE-2026-2828 – WebGPU Cross‑Origin Pixel Stealing vi...
Exploit for Improper Privilege Management in Google Chrome
--- 3. CVE-2026-9999 – Serverless Function Event Injection...
PT-2026-67419
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create...
EUVD-2026-52481
The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...
CVE-2026-51190
The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...
📄 Gogs 0.13.3 Authenticated Remote Code Execution
A proof of concept exploit for a Gogs version 0.13.3 authenticated remote code execution vulnerability. Gogs versions 0.13.3 and earlier contain a symlink handling flaw in the PUT /api/v1/repos///contents/ endpoint where updates to existing files bypass the symlink protection introduced for...
Linux Distros Unpatched Vulnerability : CVE-2026-69097
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through...
MiracleLinux 8 : grafana-9.2.10-32.el8_10 (AXSA:2026-1417:20)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1417:20 advisory. github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-44740 Tenable has extracted the preceding...
CVE-2026-51190
The CVE-2026-51190 entry concerns Serverless-Devs (package @serverless-devs/s) version
PT-2026-67513
The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to child process.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...
CVE-2026-51190
The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...
The vulnerability of the `gix_worktree_state::checkout()` function in the Rust library for working with Git repositories like gitoxide, allows a malicious actor to execute arbitrary code.
The vulnerability of the gixworktreestate::checkout function in the Rust library for working with Git repositories like gitoxide is related to an incorrect definition of symbolic references before accessing files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary co...
ROS-20260803-73-0007
The vulnerability of the act Runner component in the Git repository management system Gitea is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...