probe-legacy

⚠️⚠️⚠️⚠️: this repository contains the source code of the legacy implementation of ooniprobe. Please, check out instead: 1. https://github.com/ooni/probe, the meta-repository where you should be opening issues and feature requests; 2. https://github.com/ooni/probe-cli, which contains the new...

lCTT-Apple-Silicon--Resonance-Vulnerability-CVE-2024-23296

CTT-Apple-Silicon--Resonance-Vulnerability-CVE-2024-23296 Apple Silicon runs at frequencies that are golden ratio harmonics of 587 kHz: · Performance cores: 3.2 GHz = 587 kHz × 5451 ≈ φ⁸ × 1000 · Efficiency cores: 2.0 GHz = 587 kHz × 3407 ≈ φ⁷ × 1000 · Neural Engine: 11.0 GHz = 587 kHz × 18739 ≈...

CVE-2024-3094_xz_check

Script de comprobación de CVE-2024-3094 xz Este repositorio contiene un script Bash y un comando de una sola línea para verificar si un sistema está ejecutando una versión vulnerable de la utilidad "xz", según lo especificado por CVE-2024-3094. Consulte la descripción y la declaración de impacto ...

CVE-2022-35978-POC

CVE-2022-35978 POC Description CVE-2022-35978 is a critical security vulnerability affecting Minetest versions up to and including 5.5.1. Minetest is a free, open-source voxel game engine that supports easy modding and game creation. In single-player mode, a mod can set a global setting that...

SUSE CVE-2025-71261

An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control...

PT-2026-64894

Forensic Master Report: API and GPS Infrastructure Interference 1. Threat Actor Identification and Landscape Forensic telemetry identifies a multi-tiered adversarial campaign characterized by a sophisticated coordination between institutional actors and Advanced Persistent Threat APT groups. The...

SUSE CVE-2026-64205

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during concurrent Fuzzing. The crash is caused by an unconditional hardware...

PT-2026-59139

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in whic...

Delta Electronics DVP12SE PLC

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to remotely issue commands, modify operational values, interfere with control logic, and alter device behavior without authentication or privilege enforcement. 2. RECOMMENDED PRACTICES CISA recommends users...

CVE-2026-45259

sigqueue2 was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kernsigqueue did not include a capability mode check restricting signal delivery to the calling process's own PID. A process in capability mode can use sigqueue2 to send signa...

PT-2026-53061

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description The implementation of the kern sigqueue function failed to include a capability mode check. This allows a process operating in Capsicum capability mode—a security framework that restricts...

CVE-2025-71261

An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control...

Linux Distros Unpatched Vulnerability : CVE-2026-9750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing...

CVE-2026-9750

An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal metadata in certain...

EUVD-2026-35866

An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal metadata in certain...

Continuous Discovery of Vulnerabilities in LLM Serving Systems with Fuzzing

LLM inference and serving systems have become security-critical infrastructure; however, many of their most concerning failures arise from the serving layer rather than from model behavior alone. Modern inference engines combine KV cache, batching, prefix sharing, speculative decoding, adapters,...

[BSA-131] Security Update for flatpak

Simon McVittie uploaded new packages for flatpak which fixed the following security problems, the same as in DSA 6207-1: CVE-2026-34078, which allowed a Flatpak app to break out of the sandbox, resulting in code execution in the host context CVE-2026-34079, which allowed a Flatpak app to delete...

CVE-2026-32589 Mirror-registry: quay: insecure direct object reference in blobupload

A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to rea...

CVE-2026-32589

A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to rea...

CVE-2026-22680

The vulnerability affects OpenViking prior to version 0.3.3, where the task polling endpoints (/api/v1/tasks and /api/v1/tasks/{task_id}) allow unauthenticated access. Root cause: missing authorization on task polling exposes background task metadata (task type, status, resource identifiers, arch...