CVE-2026-98035

A flaw was found in the Linux kernel's BPF subsystem. When updating or deleting elements in resizable hash tables, the kernel directly releases special object fields rather than safely deferring their cancellation, which is not safe when running in Non-Maskable Interrupt NMI context. A local user...

CVE-2022-29597

CVE-2022-29597: RSS v500 におけるローカルファイルインクルージョン Solutions Atlantic の RRS v500 アプリケーションには、ローカルファイルインクルージョン LFI の脆弱性が存在します。認証されたユーザーは誰でも、/RRSWeb/maint/ShowDocument/ShowDocument.aspx...

CVE-2026-98031

A flaw was found in the Linux kernel. When removing a nexthop routing group entry, an error path fails to properly initialize an error-reporting pointer, causing the kernel to dereference uninitialized stack memory. A local user with network administration privileges could exploit this flaw durin...

CVE-2026-97540

A flaw was found in the Linux kernel's Pegasus USB Ethernet driver. This vulnerability can lead to a Denial of Service DoS through a system crash. When dynamic device identifiers are configured, the driver improperly uses pointer calculations on heap memory instead of referencing its static devic...

CVE-2026-98028

A flaw was found in the Linux kernel's Netronome Flow Processor NFP network driver. When replacing an existing flow steering rule fails during hardware reprogramming, the driver fails to remove the old rule from its internal list, creating an inconsistency with the active rule counter. A local us...

CVE-2024-42002

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

CVE-2025-60710

CVE-2025-60710 これは、\Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration スケジュールタスクにおけるローカル権限昇格の脆弱性の PoC です。 このスケジュールタスクが開始されると、taskhostw.exe プロセスが C:\Users%username%\AppData\Local\CoreAIPlatform.00\UKP ディレクトリを開こうとし、次のフィルターを使用してディレクトリを検索します:...

CVE-2026-46215-POC

CVE-2026-46215: DRM GEM changehandle の Use-After-Free 非特権 LPE DRM コアの ioctl DRMIOCTLGEMCHANGEHANDLE drmgemchangehandleioctl, ioctl nr 0xD2 における Use-After-Free を介したローカル特権昇格。レンダーノード /dev/dri/renderD、主要なデスクトップディストリビューションでは systemd-logind によってアクティブセッションに許可される...

CVE-2026-97539

A flaw was found in the Linux kernel's xusbatm USB driver. When dynamic device identifiers are configured, the driver improperly performs pointer arithmetic on heap-allocated identifiers, resulting in an out-of-bounds array access. A local user could exploit this flaw to cause a Denial of Service...

CVE-2026-98022

A flaw was found in the Linux kernel. Multiple network subsystems allocate memory buffers based on the transmit queue length without enforcing an upper bound. A local unprivileged user can exploit this vulnerability by configuring an excessively large queue length on network devices, exhausting...

CVE-2026-97536

A flaw was found in the qla2xxx driver within the Linux kernel. A local user with administrative privileges could trigger a Denial of Service DoS or cause memory corruption during device or queue teardown. This issue occurs because background response queue tasks are not properly canceled before...

CVE-2026-97535

A flaw was found in the Linux kernel's qla2xxx driver. A local user can cause a Denial of Service DoS via a system crash by triggering an out-of-bounds memory write during virtual port management. This issue occurs because the driver fails to validate virtual port index numbers against the fixed...

CVE-2026-46242

🚨 CVE-2026-46242 - BadEpoll 影响 Linux 内核eventpoll 子系统的高危释放后使用漏洞，可能导致本地权限提升、内存损坏或拒绝服务。 📖 概述 CVE-2026-46242 是 Linux 内核 eventpoll epoll 实现中的一个释放后使用（UAF）漏洞。 该问题存在于 epremove 逻辑内部，其竞态条件允许 struct file 及其关联的 eventpoll 对象在被引用时被释放。 具备本地访问权限 的攻击者可以利用此竞态条件破坏内核内存，可能导致： 🔺 本地权限提升 💥 内核内存损坏 🚫 拒绝服务（内核恐慌） ⚠️ 系统不稳定 📊...

CVE-2026-23111

CVE-2026-23111 PoC Linux内核nftables释放后使用（本地权限提升） poc作者：baba01hacker 漏洞概要 CVE ：CVE-2026-23111 类型 ：释放后使用（CWE-416） CVSS ：7.8（高） 组件 ：net/netfilter/nftablesapi.c — nftmapcatchallactivate 根因 ：genmask检查逻辑取反，导致事务回滚时链引用计数器泄漏 受影响的内核版本 版本范围| 修复版本 ---|--- 6.19-rc1 至 6.19-rc8| 6.19-rc9+ 6.13 至 6.18.9| 6.18.10...

CVE-2024-42002 Unsafe use of eval() method in ros2 topic hz tool

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

CVE-2024-42002

A code injection vulnerability exists in the ROS 2 'ros2topic' command-line tool, specifically within the 'hz' verb . The flaw occurs because the tool accepts a user-provided Python expression via the --filter option and passes it directly to the eval() function without any sanitization. This all...

DEBIAN-CVE-2026-97026

Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...

CVE-2026-97026

Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...

CVE-2026-97025

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

DEBIAN-CVE-2026-97025

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...