6821 matches found
incomplete-exploit-for-CVE-2018-4150-bpf-filter-poc-
이 저장소에는 README가 없습니다...
EUVD-2026-76739
A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...
Linux Distros Unpatched Vulnerability : CVE-2026-89480
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the...
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)
Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...
GHSA-99H5-JHH7-V3R3 Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)
Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...
CVE-2026-45057 matrix-sdk-ui: Incomplete edit validation
matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the matrix-sdk-ui crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious...
CVE-2026-81006
A flaw was found in the Linux kernel's Intelligent Platform Management Interface IPMI component. During the registration of an IPMI system management interface, an error in the cleanup process can leave a system file sysfs attribute registered even after its associated memory has been released...
CVE-2026-89480
CVE-2026-89480 affects the NVMe-TCP driver in the Linux kernel. The function nvme_tcp_recv_data() completes a read request once the current C2HData PDU is consumed, but no mechanism compares the total bytes received against the length requested by the command. A malicious or faulty NVMe controlle...
CVE-2026-53952
GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) are affected by a logic flaw that allows unauthenticated attackers to create a new administrator account . The root cause is a self-exclusion bug in the post-installation deletion logic for admin/setup.php, which fails to r...
CVE-2026-26114-Patch
CVE-2026-26114-Patch マイクロソフトより先にCVE-2026-26114のN-dayにパッチを適用します。マイクロソフトは何か月経っても100%のパッチ適用ができませんでしたが、FACセキュリティはそれを実現しました。...
CVE-2026-79298
🐞 CVE-2026-79298: Howyar SysReturn における UEFI Secure Boot バイパスの不完全な修復 脆弱性は修正された。バイナリは失効させられた。しかし、修正されたのはアーキテクチャの半分だけであった。18か月後、IA-32 ブートパスは依然として同じカスタム PE ローダーを搭載し、同じ Secure Boot 検証をバイパスし、同じ失効済み Authenticode ハッシュを保持していた。そして2026年7月まで、SysReturn NetCopy のすべてのコピーに商用として出荷され続けていた。これが CVE-2026-79298 である。 ...
perl-DBI security update
An update is available for perl-DBI. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list DBI is a database access Application Programming Interface API for the Perl...
RLSA-2026:66179 Important: perl-DBI security update
DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: Incomplete fix for...
EUVD-2026-76070
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...
CVE-2026-87436
A flaw was found in Chromium. A remote attacker, leveraging social engineering, could exploit an incomplete cleanup vulnerability in the browser. This could allow the attacker to bypass the web origin policy through a specially crafted extension, potentially leading to unauthorized access to...
MAL-001
MAL-001: Liferay Portal における FreeMarker サーバーサイドテンプレートインジェクション Liferay - Portal =7.4.3.12-ga12 に問題が発見されました。FTL テンプレートに悪意のあるコンテンツを挿入することで、攻撃者は SSTI（サーバーサイドテンプレートインジェクション）攻撃を実行し、FreeMarker の公開オブジェクトを悪用して制限を回避し、SSRF（サーバーサイドリクエストフォージェリ）を実行したり、任意のファイルを読み取ったり、RCE（リモートコード実行）を取得したりする可能性があります。 注記:...
EUVD-2026-75792
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist...
EUVD-2026-75800
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner...
Microsoft Edge (Chromium) < 152.0.4191.66 Multiple Vulnerabilities
The version of Microsoft Edge installed on the remote Windows host is prior to 152.0.4191.66. It is, therefore, affected by multiple vulnerabilities as referenced in the September 11, 2026 advisory. - Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...