poctest

Android 13 introduces many enhancements in order to harden Parc...

ironclaw ironclaw-v1.3.0-rc.1

IronClaw Your secure personal AI assistant, always on your side English | 简体中文 | Русский | 日本語 | 한국어 Reborn Quick Start • Philosophy • Features • Installation • Configuration • Security • Architecture IronClaw Reborn Quick Start IronClaw Reborn is the standalone runtime on the reborn-integration...

ANT-2026-1BCAFJCC · torvalds/linux · Use-After-Free

use-after-free high CVE-2026-31554 Severity Claude high · Security research firm - · Maintainer high REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-1BCAFJCC: futex: UAF in private-hash teardown via cross-process sysfutexrequeue leading giving LPE A process P can allocat...

SUSE CVE-2026-53790

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

SUSE CVE-2026-70462

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

CVE-2026-75915: Exposure of Sensitive Information to an Unauthorized Actor

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...

PT-2026-99464

Name of the Vulnerable Software and Affected Versions MONAI versions prior to 1.6.0 Description OS command injection is possible in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2 runner. User-controlled values from CLI/kwargs arguments and YAML configuration files, specifically the datas...

PT-2026-80765

Name of the Vulnerable Software and Affected Versions MineAdmin versions prior to 3.2.0-alpha.2 Description The app-store plugin service fails to sanitize the identifier variable before concatenating it into file system paths. This allows an attacker to use path traversal sequences, such as ../, ...

PT-2026-76919

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description SiYuan contains a missing authorization issue affecting 17 endpoints within kernel/api/block.go. These handlers are only protected by basic authentication and lack necessary publish-access filtering...

PT-2026-76965

Name of the Vulnerable Software and Affected Versions code-projects Task Management System version 1.0 Description An issue exists in the Login Form component within the /index.php file. Specifically, the Operation::select with multiple condition function is susceptible to SQL injection, a...

PT-2026-77166

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description The js execution tool fails to scrub parent process environment variables before spawning Node.js. This allows attackers to execute malicious JavaScript code that reads process.env to leak sensiti...

PT-2026-77298

Name of the Vulnerable Software and Affected Versions Pydio Cells versions 5.0.0 through 5.0.2 Description An authorization bypass exists in the REST handler for the endpoint "GET /a/share/link/Uuid" within the idm/share/rest/handler.go file. The handler processes the Uuid variable from the path...

PT-2026-77265

Name of the Vulnerable Software and Affected Versions libre versions prior to 4.8.1 Description The websock decode function in src/websock/websock.c contains an integer overflow during the validation of a masked WebSocket frame utilizing 64-bit extended length encoding. When the hdr-len variable ...

PT-2026-80761

Name of the Vulnerable Software and Affected Versions GeoLens versions prior to 1.2.3 Description Multiple read and link endpoints fail to re-authorize secondary datasets accessed through relationships, layer references, mosaic sources, or request bodies. This allows users to access data from...

PT-2026-80245

Summary A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. Details A host embeds bound "Service" objects that guest scripts call across the wasm boundary through the transport dispatcher. The dispatcher passed the...

PT-2026-76937

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.14 Description An issue exists where the access field in the core group blueprint is not properly guarded by the security@: admin.super restriction. This allows a delegated admin.users operator to escalate their...

CVE-2026-50142: Integer Overflow or Wraparound

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heifcontextreadfrommemory with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seqboxes.cc, Boxstsz::parse applies maxsequenceframes only to...

PT-2026-77161

Name of the Vulnerable Software and Affected Versions libmodplug versions prior to 0.8.9.2 Description An out-of-bounds read exists in the pat smplooped function within src/load pat.cpp. The issue occurs because the function only validates the upper bound of the sample index against MAXSMP and...

Linux Distros Unpatched Vulnerability : CVE-2026-72145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/tpmi: use cleanup helpers in memwrite In memwrite, the temporary array...

Linux Distros Unpatched Vulnerability : CVE-2026-68462

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets...