171 matches found
ctl_ctloutput-leak
ctlctloutput-leak The ctlctloutput function in macOS High Sierra 10.13 ignores the return value of a call to sooptcopyin, which opens up a race window to leak uninitialized kernel heap data to user space. ctlctloutput-leak is a proof-of-concept exploit that attempts to trigger this information...
CVE-2019-6207
CVE-2019-6207 getdirentriesattr kernel heap inofo leak Esta vulnerabilidad puede desencadenarse en el sandbox en macOS=10.14.4 && iOS 12.2 Actualizaré más detalles sobre esta vulnerabilidad...
CYBERDUDEBIVASH-MONGODB-DETECTOR-v2026
CYBERDUDEBIVASH HERRAMIENTA DETECTORA DE MONGODB v2026.1 Detectar instancias de MongoDB expuestas y riesgos de CVE-2025-14847 "MongoBleed" — Escáner Python de Confianza Cero. En 2026, las bases de datos MongoDB mal configuradas siguen siendo una de las principales causas de violaciones de datos y...
AlmaLinux 9.2 [TuxCare] Security Update: libpng / libpng-devel / libpng-static / libpng-tools (ALMALINUX9.2:CLSA-2026:1778891359)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778891359 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files...
PT-2026-102921
https://www.freebsd.org/security/notices/ – three notices. https://www.freebsd.org/security/advisories/ – six advisories. CVE-2026-84782 CVE Record: CVE-2026-84782 via OpenSSL flags high-severity DTLS heap leak and crash risk · freenode Credit Laurent Gaffie secorizon.com Secorizon — Offensive...
SUSE CVE-2026-90000
In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...
CVE-2026-93174
CVE-2026-93174 affects the Linux kernel BPF subsystem. In copy_map_value_long(), the function passes map->value_size to bpf_obj_memcpy() instead of the correctly padded round_up(map->value_size, 8). When a per-CPU map contains special fields, bpf_obj_memcpy() copies around those fields with...
DEBIAN-CVE-2026-90000
In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...
CVE-2026-90000
In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...
AZL-101123 CVE-2026-90000 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...
DEBIAN-CVE-2026-89846
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen: if ISFWI2CAPABLEha sensedata += rspinfolen; parsenselen -=...
CVE-2026-90000 HID: rmi: fix OOB access with undersized RMI reports
In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...
EUVD-2026-80608
In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...
CVE-2026-90000 HID: rmi: fix OOB access with undersized RMI reports
In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...
CVE-2026-89865 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMAPOOLSIZE 256-byte bounce buffer obtained from dmapoolalloc, which does not zero the allocation. They initialize...
AZL-101265 CVE-2026-89779 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...
CVE-2026-89779
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...
UBUNTU-CVE-2026-89779
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...
CVE-2026-89779
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...
EUVD-2026-80300
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...