CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

copy-fail-blocker

copy-fail-blocker Atténuation BPF-LSM pour CVE-2026-31431 « Copy Fail » et la variante RxRPC de Dirty Frag, ainsi que pour les vulnérabilités d'élévation de privilèges similaires qui dépendent d'un accès utilisateur à un chemin de chiffrement en place côté noyau, accessible via les familles de...

CVE-2021-42237

CVE-2021-42237 هذا استغلال/إثبات مفهوم PoC لثغرة CVE-2021-42237 مأخوذ من: تقرير Assetnote هذا إخلاء مسؤولية: أنا لست مرتبطًا بـ Assetnote بأي شكل من الأشكال. هذا المحتوى مُقدَّم لأغراض تعليمية فقط. تأكد من استبدال CMD-COMMAND-HERE، بالإضافة إلى Host، في PoC أدناه: root@kitploit: POST...

nifi-CVE-2026-39816-poc

POC Apache NiFi CVE-2026-39816 Démonstration de preuve de concept pour CVE-2026-39816, un contournement de la permission EXECUTECODE dans Apache NiFi 2.8.0 qui permet à un concepteur de flux ayant été délibérément privé des privilèges d'exécution de code d'exécuter du Groovy arbitraire dans la JV...

CVE-2026-4112

SonicWall SMA 8200v: تصعيد الامتيازات عبر حقن SQL أعمى عبر معاملات متقاطعة البرنامج الثابت: 12.5.0-02283 تصحيح المنصة على الأساس 12.5.0-02002 استشارة SonicWall 1. الملخص ثغرة حقن SQL أعمى بعد المصادقة في وحدة تحكم إدارة SonicWall SMA 8200v المنفذ 8443 تسمح لأي مسؤول مصادق — بما في ذلك الحسابات...

CVE-2026-25232-PoC

CVE-2026-25232 — Contournement de la suppression de branche protégée dans Gogs Escalade Write → Admin Vue d'ensemble Champ| Détails ---|--- CVE| CVE-2026-25232 Produit| Gogs Go Git Service Versions affectées| = 0.13.4 Version corrigée| 0.14.1 Score CVSS| Moyen CWE| CWE-863 : Autorisation incorrec...

CVE-2025-4275 — Updated!

🐞 CVE-2025-4275: Hydroph0bia SecureFlash Certificate Shadowing This repository contains research material related to CVE-2025-4275, a Secure Boot bypass vulnerability affecting UEFI-compatible firmware based on Insyde H2O. It centralizes technical analysis of the vulnerability, the binaries...

SUSE CVE-2026-74383

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools nvmesetupdescriptorpools indexes dev-descriptorpools using the numanode forwarded from hctx-numanode by its single caller, nvmeinithctxcommon. On a non-NUMA kernel...

SUSE CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

SUSE CVE-2026-84373

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without...

A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses Towards Malicious Behaviors

Modern AI agent harnesses expose lifecycle hooks that bind shell commands to runtime events such as session start, tool calls, and file edits. These commands run with host privileges yet ship as lifecycle-hook configuration and may fire at times the LLM never observes. We identify the...

PT-2026-85288

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...

PT-2026-85209

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via stri...

UBUNTU-CVE-2026-53683

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

PT-2026-84974

SQL injection vulnerability in the del check parameter of the /ocsreports/?function=save query list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...

PT-2026-84989

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program id parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...

The Bug Report – August 2026 Edition

The Bug Report – August 2026 Edition By Jonathan Omakun · September 3, 2026 Why am I here? Sharpen your pencils and pull out those fresh notebooks; we're back with the bug report! Half the world is squeezing the last drops of joy out of their summer vacations, and the other half is on the...

TencentOS Server 2: dracut (TSSA-2026:0970)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0970 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Unity Linux 20.1060a / 20.1070a Security Update: glib2 (UTSA-2026-105539)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105539 advisory. A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter...

...[ More ]

ILIAS versions prior to 9.22, versions 10.0 through 10.9, and versions 11.0 through 11.2 contain an unauthenticated PHP object injection vulnerability in the Shibboleth logout functionality. An unauthenticated attacker can manipulate stored session data that is subsequently deserialized without...