Lucene search
+L

22443 matches found

CVE
CVE
added 2026/09/11 7:42 p.m.12 views

CVE-2026-81007

CVE-2026-81007 affects the Linux kernel 's ipmi/ipmb subsystem. The function ipmb_write() read message fields before validating the length byte, allowing a zero or short write to read uninitialized stack bytes and causing an integer underflow in the block write length when the length is smaller t...

7.1CVSS0.00125EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/09/11 7:42 p.m.25 views

CVE-2026-81007 ipmi: ipmb: validate write message length

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

7.1CVSS0.00125EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/11 7:42 p.m.7 views

EUVD-2026-76330

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

0.00125EPSS
SaveExploits0References4
Debian CVE
Debian CVE
added 2026/09/11 7:42 p.m.7 views

CVE-2026-81007

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

7.1CVSS0.00125EPSS
SaveExploits0
OSV
OSV
added 2026/09/11 7:42 p.m.5 views

CVE-2026-81007 ipmi: ipmb: validate write message length

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

6.1AI score
SaveExploits0References7
OSV
OSV
added 2026/09/11 7:42 p.m.7 views

CVE-2026-80973 ALSA: 6fire: bound the MIDI event length from the device

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

6.3AI score
SaveExploits0References7
CVE
CVE
added 2026/09/11 7:42 p.m.10 views

CVE-2026-80973

CVE-2026-80973 affects the Linux kernel's ALSA snd_usb_6fire driver. In usb6fire_comm_receiver_handler(), a MIDI event length byte supplied by the USB device is used without bounding it or checking urb->actual_length. The receiver_buffer is a 64-byte allocation (2-byte header + 62 usable bytes...

0.002EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/11 7:42 p.m.4 views

CVE-2026-80933 wifi: mt76: mt7996: validate default EEPROM firmware size

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

6.1AI score
SaveExploits0References6
CVE
CVE
added 2026/09/11 7:42 p.m.11 views

CVE-2026-80931

CVE-2026-80931 is an out-of-bounds read in the Linux kernel's DS28E17 1-Wire to I2C bridge driver (w1: ds28e17). During an I2C_M_RECV_LEN read, the device-controlled length byte (buf[0]) is not validated against the caller buffer size (34 bytes), allowing a read up to ~222 bytes out of bounds . P...

7.8CVSS0.00128EPSS
SaveExploits0References4
NVD
NVD
added 2026/09/11 4:17 p.m.7 views

CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

7.5CVSS0.00581EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/11 10:30 a.m.12 views

rewrite-cve-2026-22732

rewrite-cve-2026-22732 OpenRewrite recipe that detects code susceptible to CVE-2026-22732, a Spring Security defect where setting Content-Length through one of three response methods bypasses Spring Security's OnCommittedResponseWrapper. Because the wrapper never sees the header,...

9.1CVSS8.1AI score0.0048EPSS
SaveExploits3References1
Kitploit
Kitploit
added 2026/09/11 6:15 a.m.5 views

CVE-2026-23006-Kyber-Ciphertext-Length-Side-Channel

CVE-2026-23006 – Kyber Ciphertext Length Side‑Channel Program Code Python root@kitploit: kyberlengthleak.py - Leaks secret key bit based on ciphertext length import random Simulate encapsulation: ciphertext length depends on message bit def encapsulatepk, bit: In a flawed implementation, the...

5.5CVSS6AI score0.00194EPSS
SaveExploits0
RedhatCVE
RedhatCVE
added 2026/09/11 5:54 a.m.11 views

CVE-2026-89045

A flaw was found in zstd-jni. This vulnerability allows an attacker to trigger an infinite loop by providing negative length parameters to the ZstdInputStreamNoFinalizer.read method. This can cause the read method to spin indefinitely, holding the stream monitor and blocking other threads from...

5.1CVSS0.00124EPSS
SaveExploits0References9
Kitploit
Kitploit
added 2026/09/11 2:31 a.m.5 views

CVE-2018-2628-detect

Script de detección masiva de la vulnerabilidad CVE-2018-2628 Uso Formato de IP: root@kitploit: 192.168.31.1:443 192.168.31.100:443 Nómbrelo como url.txt y guárdelo en el mismo directorio; luego ejecute el script. ¡Los efectos de salida, coméntelos usted mismo! Ejecútelo así: root@kitploit:...

9.8CVSS8.5AI score0.99448EPSS
SaveExploits70References1
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.12 views

PT-2026-90436

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifs sb verify signature bounds the on-disk ubifs sig node-len field before handing the signature payload to verify pkcs7 signature, but the check has the wrong sign: if le...

0.00182EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.8 views

PT-2026-90249

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read chunk range svc rdma read chunk range walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmet...

0.00463EPSS
SaveExploits0References5
Tenable Nessus
Tenable Nessus
added 2026/09/11 12:00 a.m.10 views

Linux Distros Unpatched Vulnerability : CVE-2026-88054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks bu...

6.9CVSS0.00175EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.7 views

PT-2026-90211

In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm migrate request handler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node ...

0.00626EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.9 views

PT-2026-90304

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In ghes handle arm hw error, after skipping the cper sec proc arm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeofe...

0.00182EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.10 views

PT-2026-90459

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm sendrecv msg locked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy...

0.00144EPSS
SaveExploits0References5
Rows per page
Query Builder