CVE-2026-97026

Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...

CVE-2026-97025

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

CVE-2026-98018

A flaw was found in the Linux kernel. A race condition in the Management Component Transport Protocol MCTP I3C driver occurs when device discovery releases a lock prematurely while a bus is simultaneously removed. A local user could exploit this synchronization flaw to access freed memory,...

CVE-2026-97534

A flaw was found in the Linux kernel's Flash-Friendly File System F2FS. When segment ranges are truncated, the file system fails to properly adjust the free section counter for sections that were already marked free, leading to an overestimation of available storage during background garbage...

CVE-2026-97532

A flaw was found in the Linux kernel's qla2xxx storage driver. When memory allocation fails during device initialization, the driver's error-handling routine fails to clear pointers to memory that has already been released. A local user capable of triggering device initialization failures can cau...

zygote-CVE-2024-31317

Zygote Toolkit - CVE-2024-31317 これは、CVE-2024-31317 を利用して ADB 経由でプライベートアプリデータを抽出したり、アプリの UID でシェルを起動するツールキットです。この脆弱性は、セキュリティパッチレベル 2024-06-01 以下の Android 9 から 14 に影響します。テスト済みデバイスのサポートマトリックスは以下を参照してください。 前提条件 Debian/Ubuntu システムパッケージ sudo apt update sudo apt install adb openjdk-17-jdk-headless...

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

Summary Address6.isLinkLocal recognizes fe80::/64 rather than fe80::/10. Link-local unicast is the whole /10 under RFC 4291 §2.4 and the IANA IPv6 Special-Purpose Address Registry, so the method returns false for every link-local address outside the one /64 that stateless address autoconfiguratio...

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

Summary No classifier on Address6 recognizes the NAT64 local-use range 64:ff9b:1::/48 RFC 8215. isPrivate, isLoopback, isLinkLocal and their siblings all return false for every address in it, so an internal IPv4 destination written through a local-use NAT64 prefix 64:ff9b:1:7f00:0:100:: for...

NPM: ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

NPM: ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass vulnerability discovered by ? in WordPress Npm ip-address versions = 10.2.0, = 10.5.0...

CVE-2026-22009-Linux-eBPF-Map-Locking-Race-Use-After-Free

CVE-2026-22009 – Linux eBPF マップロック競合 → Use‑After‑Free プログラムコード（Cシミュレーション） // ebpfmapuaf.c - Simulated concurrent map update/free include include include include void mapdata = NULL; int mapfreed = 0; void updatemapvoid arg // Simulate eBPF program updating map if !mapfreed char mapdata = 'A';...

CVE-2026-31635

🩸 CVE-2026-31635 – DirtyDecrypt Linux Kernel のローカル権限昇格 — RXGK ページキャッシュ破損を悪用 "DirtyDecrypt" — 2026年「Dirty」ファミリーエクスプロイトの一部 📖 概要 DirtyDecrypt CVE-2026-31635 は、Linux カーネルの rxrpc サブシステム（特に rxgk コンポーネント）における ローカル権限昇格 の脆弱性です。 AES-CBC 復号化中の Copy-on-Write COW チェックの欠落を悪用し、非特権ユーザーがページキャッシュを破損させ、任意のファイル書き込み...

kernel: perf: Reject exited events as group leaders

A flaw was found in the Linux kernel's performance monitoring perf subsystem. This vulnerability allows a local attacker to trigger a use-after-free condition by improperly handling exited events as group leaders. Successful exploitation could lead to a system crash, resulting in a denial of...

kernel: perf/core: Detach event groups during remove_on_exec

A flaw was found in the Linux kernel's performance monitoring unit PMU subsystem. This vulnerability occurs when a performance event group leader is removed during process execution, but its associated events siblings remain active and linked to a stale list. This inconsistent state can lead to a...

copy-fail-mcp

Copy Fail MCP 📖 インストールガイド — クイックスタート、手動セットアップ、トラブルシューティング CVE-2026-31431 — これまでに発見された最悪のLinux脆弱性。今やMCPで制御可能。 732バイトのPythonコード。コンパイル不要。レースコンディションなし。ディストリビューションごとのオフセット不要。 ワンショットで、2017年以降にビルドされたすべてのLinuxカーネルでユニバーサルなroot権限を取得できる。...

CVE-2026-50343-InstallService-EoP

CVE-2026-50343: InstallService StaticPluginMap 権限昇格 標準ユーザーからSYSTEMへ 私は、現在 CVE-2026-50343 として追跡されているこの脆弱性を独自に発見し、報告しました。MSRC は、私の提出物が別の研究者による以前の報告の重複であることを確認しました。標準的な対話型ユーザーは、攻撃者が制御するプラグイン状態を HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State 配下に書き込むことができます。Microsoft Store...

CVE-2026-98012

A flaw was found in the Linux kernel's Stochastic Fairness Queueing SFQ network packet scheduling subsystem. A local attacker with network administration privileges, including within an unprivileged user namespace, can supply an improperly bounded quantum parameter alongside a crafted packet size...

CVE-2026-98010

A flaw was found in the Linux kernel's Deficit Round Robin DRR network packet scheduler. This vulnerability allows a local user with network administration privileges to cause a Denial of Service DoS by configuring a traffic class with an unconstrained low quantum value. When processed with large...

CVE-2026-98011

A flaw was found in the Linux kernel's Heavy-Hitter Filter HHF network scheduler. A local attacker with network administration privileges, which can be acquired within an unprivileged user namespace, can cause a Denial of Service DoS. By setting an excessively small quantum value alongside a...

CVE-2026-98013

A flaw was found in the Linux kernel. A local user with network administration privileges, including within a user namespace, can cause a Denial of Service DoS by configuring the Flow Queue Proportional Integral controller Enhanced FQ-PIE packet scheduler with an excessively low quantum value and...

CVE-2026-98008

A flaw was found in the Linux kernel's Cadence MACB ethernet driver. A local user with administrative privileges could cause a denial of service DoS by triggering a driver unbind operation or an initialization failure on a device configured with a fixed-link connection. In this configuration, the...