macSubstrate

 macSubstrate - Substrate for macOS macSubstrate is a platform tool for interprocess code injection on macOS, with the similar function to Cydia Substrate on iOS. Using macSubstrate, you can inject your plugins .bundle or .framework into a mac app including sandboxed apps to tweak it in the...

EvilKaspersky

This is an old experiment I did year ago and now just saw the repo and decided to make it public. It is KasperkyHook, but the syscalls directly point onto functions useful for interprocess memory copying. You can fully unload the control driver afterwards and erase its memory. Another advantage i...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: ipc: Fix for use-after-free in ipcmsgsendrequest The ipcmsgsendrequest function waits for a generic netlink reply using an ipcmsgtableentry on the stack. The generic netlink handler handlegenericevent/handleresponse fil...

Astra Linux – Vulnerability in Linux 5.10

A vulnerability was discovered in the net/tipc/crypto.c file within the Linux kernel before version 5.14.16. The Transparent Inter-Process Communication TIPC functionality allows remote attackers to exploit a lack of sufficient validation of the user-supplied sizes for the MSGCRYPTO message type...

PALLET CONTROL products vulnerable to improper access control

Overview PALLET CONTROL products provided by JAL Digital Co.,Ltd. include multiple service programs that run in the background and provide certain functions. However, access to these service programs is not properly restricted, allowing non-administrative users to access them. Improper access...

CVE-2026-15059

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data

A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication IPC API call with spurious data. In older versions v249 and earlier, this can lead to stack overwriting with attacker-controlled content,...

CVE-2026-64563

In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter-p on table restart rhashtablewalkstartcheck has two restart paths when resuming a walk. When iter-walker.tbl is valid, it re-validates iter-p against the table and sets iter-p = NULL if the object is...

ALSA-2026:49851 Moderate: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 Bug Fixes and Enhancements: AlmaLinux8.10 - KVM: s390: Limit...

Fedora 43 : nsd (2026-0b77a23312)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0b77a23312 advisory. FEATURES: Merge 483 from ruuda: Improve Prometheus metrics: Move zonestats from metric name to label BUG FIXES: Fix 478: Feature request: reduce...

kernel: ipc: limit next_id allocation to the valid ID range

A flaw was found in the Linux kernel. The ipcidralloc function, used in the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a...

ALSA-2026:49212 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 kernel: tipc: fix double-free in tipcbufappend CVE-2026-52993 kernel: net: sched: UAF via missing handler for TCACTCONSUM...

JLSEC-2026-805 Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering

Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file but not an IPC stream with pre-buffering enabled, if the IPC file contains data with variadic buffers such as Binary View and String...

JLSEC-2026-804 Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package...

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...

RockyLinux 8 : kernel (RLSA-2026:45115)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:45115 advisory. kernel: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O CVE-2025-40026 kernel: xfrm single-frag length not properly limited kernel: ...

EUVD-2026-46375

Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in sortedset.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644...

CVE-2026-64617

The Data::PubSub::Shared Perl module (versions before 0.07 ) contains a vulnerability where it creates a world-readable mmap backing file. The root cause is the use of open(path, O_RDWR|O_CREAT, 0666) in pubsub.h without the O_EXCL or O_NOFOLLOW flags. Under a default umask of 022, the file is cr...

CVE-2026-64613

Versions before 0.05 of the Perl module Data::Buffer::Shared are vulnerable because they create a world-readable mmap backing file and open it without the O_NOFOLLOW flag. Specifically, in buf_generic.h, the segment is created using open(path, O_RDWR|O_CREAT|O_EXCL, 0666), which results in a 0644...

CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After performedStage1Installation = YES, new connections to the...

SUSE CVE-2026-64179

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix potential memory leaks in ipcimeminit The memory allocated in ipcprotocolinit is not freed on the error paths that follow in ipcimeminit. Fix that by calling the corresponding release function ipcprotocoldein...