maskprocessor

maskprocessor High-Performance word generator with a per-position configurable charset Mask attack Try all combinations from a given keyspace just like in Brute-Force attack, but more specific. Advantage over Brute-Force The reason for doing this and not to stick to the traditional Brute-Force is...

PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

PostgreSQL has released updates to address a security flaw that allows an account with the REPLICATION attribute to run arbitrary code as the operating-system user running the database server. The flaw, tracked as CVE-2026-6471 CVSS score: 7.2, has been present since logical decoding was introduc...

CVE-2026-85696

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

CVE-2026-85672

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

CVE-2026-85674

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

CVE-2026-85626

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of gitlog, gitdiff, and gitshow tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

CVE-2026-85660

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

CVE-2026-85623

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

EUVD-2026-71248

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynslist When a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I/O Command Set, nvmetexecuteidentifynslist is called with matchcss set...

CVE-2026-80813

CVE-2026-80813 affects the Linux kernel nvmet (NVM Express Target) subsystem. A NULL pointer dereference occurs in nvmet_execute_identify_nslist() when a host issues an Identify command with CNS 07h (Active Namespace ID List for a specific I/O Command Set). The function dereferences req->ns-&g...

CVE-2026-80813 nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynslist When a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I/O Command Set, nvmetexecuteidentifynslist is called with matchcss set...

CVE-2026-80813 nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynslist When a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I/O Command Set, nvmetexecuteidentifynslist is called with matchcss set...

CVE-2026-80813

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynslist When a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I/O Command Set, nvmetexecuteidentifynslist is called with matchcss set...

CVE-2026-80811 io_uring/cmd: fix iovec leak when the async cmd is not recycled

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...

EUVD-2026-71246

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...

CVE-2026-80811 io_uring/cmd: fix iovec leak when the async cmd is not recycled

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...

CVE-2026-80811

CVE-2026-80811 is a memory leak in the Linux kernel's io_uring/cmd subsystem. An io_async_cmd carries an iovec array that is allocated when the vector must grow and retained across recycling via ctx->cmd_cache. On two code paths, the iovec is never freed: io_req_uring_cleanup() only clears the...

CVE-2026-80811

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...

CVE-2026-80789 nvmet-tcp: bound SGL data length before allocating command buffers

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-80789 nvmet-tcp: bound SGL data length before allocating command buffers

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...