CVE-2025-61155

CVE-2025-61155：GameDriverX64.sys 中的任意进程终止 https://github.com/user-attachments/assets/baf76601-94de-49a6-b4fd-e72f63112fab 概述 本仓库包含 CVE-2025-61155 的安全公告和 PoC。GameDriverX64.sys 反作弊驱动程序通过一个有漏洞的 IOCTL 处理程序，允许任何本地用户终止任意进程。 概念验证 PoC 源代码 演示了与驱动程序进行通信以终止指定进程的过程。 免责声明...

CVE-2026-65415

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory...

CVE-2026-43690

A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local user may be able to read kernel memory...

CVE-2026-43690

CVE-2026-43690 is a race condition in Apple macOS , addressed through improved locking. The vulnerability allows a local user with low privileges to read kernel memory , resulting in a confidentiality impact only (no integrity or availability impact). The CVSS 3.1 score is 4.7 (Medium) with a hig...

CVE-2026-65415

CVE-2026-65415 is a race condition in Apple's operating systems, addressed with additional validation. The vulnerability affects iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 , all of which contain the fix. A local user may be able to cause unexpected system termin...

CVE-2026-65415

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory...

CVE-2026-65359

CVE-2026-65359 is an out-of-bounds read in Apple's operating systems, fixed via improved bounds checking. Affected platforms include iOS/iPadOS 26.7 , iOS/iPadOS 27 , macOS Golden Gate 27 , macOS Sequoia 15.8 , macOS Tahoe 26.7 , tvOS 27 , visionOS 27 , and watchOS 27 . A local user with low priv...

EUVD-2026-78019

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination o...

CVE-2026-19816

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

CVE-2026-19816 PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

CVE-2026-19816

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

CVE-2026-19624 NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties vpn.data and vpn.secrets values unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a...

CVE-2026-19624 NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties vpn.data and vpn.secrets values unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a...

OESA-2026-3744 systemd security update

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. Security Fixes: systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user, due to missing home-record signature verification on...

UBUNTU-CVE-2026-90996

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...

CVE-2026-90996

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...

Astra Linux – Vulnerability in Linux 5.10

The checkaluop function in kernel/bpf/verifier.c in the Linux kernel, as of v5.16-rc5, did not properly update the bounds when handling the mov32 instruction. This issue allows local users to obtain potentially sensitive address information, also known as a “pointer leak.”...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8 contains SAUCE patches that may involve the use of an uninitialized variable in the AppArmor AFINET/AFINET6 socket mediation code. This bug can be triggered by a non-privileged local user, and it could lead to incorrect, fine-grained mediation of network sockets...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB Server before version 10.7 is vulnerable to Denial of Service attacks. In the file extra/mariabackup/dscompress.cc, when an error occurs pthreadcreate returns a non-zero value during the execution of the createworkerthreads method, the held lock is not released properly. This allows local...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A array indexing vulnerability was discovered in the netfilter subsystem of the Linux kernel. The absence of a certain macro could lead to an incorrect calculation of the offset of the h-nets array, giving attackers the ability to arbitrarily increment/decrement a memory buffer beyond its bounds...