CVE-2019-6207

CVE-2019-6207 getdirentriesattr 커널 힙 정보 누출 이 취약점은 macOS=10.14.4 &&ios 12.2의 샌드박스에서 트리거될 수 있습니다. 이 취약점에 대한 더 자세한 내용을 업데이트하겠습니다...

CYBERDUDEBIVASH-MONGODB-DETECTOR-v2026

CYBERDUDEBIVASH MONGODB DETECTOR TOOL v2026.1 Обнаруживайте доступные экземпляры MongoDB и риски CVE-2025-14847 "MongoBleed" — сканер Python с нулевым доверием Zero-Trust. В 2026 году неправильно настроенные базы данных MongoDB остаются одной из главных причин утечек данных и атак...

ctl_ctloutput-leak

ctlctloutput-leak Функция ctlctloutput в macOS High Sierra 10.13 игнорирует возвращаемое значение вызова sooptcopyin, что открывает окно состояния гонки для утечки неинициализированных данных кучи ядра в пользовательское пространство. ctlctloutput-leak — это proof-of-concept эксплойт, который...

CVE-2026-89743 misc: nsm: bound the device-reported response length

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsmsendrecvmsglocked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy backend...

kernel: smb/client: fix out-of-bounds read in smb2_compound_op()

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker, acting as a malicious SMB server, could send a specially crafted, truncated response with an oversized buffer length. This could lead to an out-of-bounds read in the smb2compoundop function, allowing the...

Linux Distros Unpatched Vulnerability : CVE-2026-85089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in...

CVE-2026-84267

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...

libssh2: libssh2: Information disclosure and potential arbitrary code execution via heap out-of-bounds read

A missing bounds check in the libssh2 publickey subsystem allows malicious SSH servers to trigger a client-side out-of-bounds read, leaking heap pointers that could enable security bypasses, denial of service, or code execution...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098929)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098929 advisory. In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated R...

ANT-2026-B615AQ9E · exim · off-by-one

off-by-one medium CVE-2026-40685 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif. ANT-2026-B615AQ9E: Exim dewrap Off-By-One OOB Read → Co...

CVE-2026-74278

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE with the original event embedded as variable-length data, while kernel...

CVE-2026-74278

CVE-2026-74278 affects the Linux kernel ALSA seq subsystem. The leak arises from bounce_error_event() always emitting SNDRV_SEQ_EVENT_KERNEL_ERROR with a raw struct snd_seq_event pointer exposed to users. The fix differentiates by client type: for USER_CLIENTS, send SNDRV_SEQ_EVENT_BOUNCE with SN...

Linux Distros Unpatched Vulnerability : CVE-2026-74278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE wi...

Exploit for CVE-2026-42533

CVE-2026-42533 Pre-auth heap buffer overflow and heap informa...

BIT-SQLITE-2026-51296

SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information...

CVE-2026-66759

A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icnsdecompres...

CVE-2026-64479

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA sequencer. This vulnerability allows an unprivileged local user to trigger a heap information leak in the sndseqeventdup function. By reading from /dev/snd/seq, an attacker can obtain 4 bytes of uninitialized kernel hea...

SUSE CVE-2026-64479

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in sndseqeventdup sndseqeventdup copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell-ump.raw.extra word that the memcpy did not cover. The guard...

CVE-2026-64479

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in sndseqeventdup sndseqeventdup copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell-ump.raw.extra word that the memcpy did not cover. The guard...

UBUNTU-CVE-2026-64479

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in sndseqeventdup sndseqeventdup copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell-ump.raw.extra word that the memcpy did not cover. The guard...