CVE-2026-107183

llama.cpp before b11393 contains a use-after-free and double free vulnerability in commonchatpegmapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling currenttool pointer. Attackers can submit a chatparser in a POST /completion request emitting a tool-id...

openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()

A flaw was found in OpenSSL. When processing a specially crafted PKCS7 or S/MIME Secure/Multipurpose Internet Mail Extensions signed message, a heap use-after-free vulnerability in the PKCS7verify function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an emp...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation 在 memory APIs 中缺少所有权检查，允许跨用户的内存读取和删除。 主要公告： GHSA-qv97-83w4-ff86 研究人员致谢： @chaitanyagarware 概览 字段| 值 ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 项目| vmDeshpande/ai-agent-automation 包| backend 生态系统| npm 严重性| 高 CVSS| 8.8,...

perl-DBI security update

An update is available for perl-DBI. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The perl-DBI package provides the standard database interface module for th...

RLSA-2026:76762 Important: perl-DBI security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: perl-DBI: perl-DBI: Denial of...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

CVE-2026-12166_CVE-2026-12167_CVE-2026-12168

Little Orbit GFAC ドライバー GFACSysx64.sys における複数のローカル権限昇格の脆弱性 | ---|--- CVE ID| CVE-2026-12166、CVE-2026-12167、CVE-2026-12168 ベンダー| Little Orbit 製品| GamersFirst Anti-Cheat GFAC ドライバー GFACSysx64.sys 影響を受けるバージョン| ドライバーバイナリにバージョン情報は埋め込まれていません。分析対象サンプル: SHA-256...

[SECURITY] [DLA 4826-1] puma security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4826-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA October 07, 2026 https://wiki.debian.org/LTS -...

Exploit for CVE-2026-13043

🕷️ CVE-2026-13043 - Panda / WatchGuard Kernel Memory Access...

SUSE-SU-2026:24115-1 Security update for qemu

This update for qemu fixes the following issues: Security issues fixed: - CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to bypass chipset DLCK protection and injecting code into System Management Mode memory bsc1282077. -...

heartbleed

HEARTBLEED：OpenSSL TLS 心脏出血漏洞 OpenSSL TLS 心跳扩展 - 内存泄露 - 多 SSL/TLS 版本漏洞扫描器与利用工具 需要： sudo apt-get install nmap lolcat Java sudo apt install default-jre default-jdk...

CVE-2026-19186

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

EUVD-2026-94229

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

CVE-2026-19186 Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

CVE-2026-103416

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TL...

CVE-2025-14847-MongoBleed

CVE-2025-14847 MongoBleed MongoDB zlib圧縮メモリ開示 — 分析、検出、および修正 概要 CVE-2025-14847は、一般にMongoBleed と呼ばれる、:contentReferenceoaicite:0index=0 Server に影響を与える高深刻度の情報漏洩脆弱性です。 この脆弱性により、リモートの未認証攻撃者 が、zlib圧縮されたネットワークメッセージの不適切な処理を悪用して、サーバーメモリから機密データを漏洩させる可能性があります。...

kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources()

A flaw was found in the Linux kernel's RDMA/rxe component. A local user could exploit a memory corruption vulnerability in the freerdatomicresources function by updating the maxdestrdatomic value before the old array is properly freed, leading to an out-of-bounds write. This issue can cause a...

CVE-2025-22457-vulnserver-lab

step 1 environment setting 權限&執行腳本 使用windows的話可以開wsl執行 chmod +x setupenvironment.sh ./setupenvironment.sh step 2：尋找動態數值 需要手動的步驟 由於記憶體位址和 IP 在不同環境中是動態的，需要手動找到它們，並更新 exploit.py 腳本。 2.0 先開啟兩個attacker docker和一個victim docker作為後續準備 docker exec -it atac /bin/bash docker exec -it vic /bin/bash 2.1 尋找...

Formbook-Payload-Extraction-XOR-Decryption-Net-Assembly-Analysis

1. x32dbg – 加密配置解密与内存分配 x32dbg 内存转储显示，Formbook 解密其配置数据，并使用 NtAllocateVirtualMemory 为其分配内存。 关键观察： NtAllocateVirtualMemory – 为解密后的载荷分配内存。 mov edx, dword ptr ds:esi+1C – 从 ESI 寄存器中获取加密数据的大小。 push 0x1000 – 使用 MEMCOMMIT 分配内存。 push 0 – 指定分配类型或保护标志。 mov edx, dword ptr ds:esi+4 – 获取另一个配置值。 lea ecx, ebp-4...

CVE-2026-98357

A flaw was found in the Linux kernel's iSCSI Extensions for Remote Direct Memory Access iSER target driver. This vulnerability can lead to arbitrary code execution or a Denial of Service DoS due to memory corruption. During connection teardown, background tasks process deferred control messages...