printix-CVE-2022-25089

CVE-2022-25089 La pesadilla completa de un administrador de sistemas: usuarios cambiando el registro desde cualquier lugar y en todas partes sin autenticación. Explora la documentación » Ver demo . Reportar error . Solicitar función Tabla de contenidos Sobre el proyecto Construido con Empezando...

Nginx UI - Broken Access Control

Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover. id: CVE-2026-33032 info: name: Nginx UI - Broken Access Control author: DhiyaneshDk severity: critical description: | Network attackers can fully control ngi...

ed25519-unsafe-libs

ed25519-unsafe-libs Ataque de oráculo a la función de firma con doble clave pública sobre Ed25519 Una lista de librerías de firmas ed25519 potencialmente inseguras que permiten una api pública donde la clave secreta y la clave pública pueden proporcionarse de forma independiente como entradas de ...

CVE-2026-0073-Android-client-TLS-auth-bypass

CVE‑2026‑0073 es un error lógico en el demonio ADB de Android adbd que permite a un atacante eludir la autenticación mutua TLS y abrir un shell remoto en un dispositivo que tenga la depuración inalámbrica habilitada y que se haya emparejado con cualquier ordenador al menos una vez. La causa raíz ...

CVE-2022-26923

CVE-2022-26923 – Certifried Exploit Abuso de AD CS Automatización de la explotación de CVE-2022-26923 Certifried que permite una elevación de privilegios mediante el abuso de Active Directory Certificate Services AD CS y Resource-Based Constrained Delegation RBCD, lo que lleva al volcado del hash...

CUAHarm

Measuring Harmfulness of Computer-Using Agents 🤗 Hugging Face 📄 Paper 📋 Introduction CUAHarm is a benchmark designed to evaluate the safety risks of Computer-Using Agents CUAs - AI agents that can autonomously control computers to perform multi-step actions. Key Features 🔍 CUAHarm Dataset : A...

CVE-2026-73208

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...

CVE-2026-80562

In the Linux kernel, the following vulnerability has been resolved: gpio: ml-ioh: use rawspinlockt for the register lock iohirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger -...

AZL-97689 CVE-2026-80528 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current-journalinfo handlereply stores a cephmdsrequest pointer in current-journalinfo while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098997)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098997 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in sndac97controllerregister If ac97addadapter fails, putdevice is...

CVE-2026-79676

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open instead of nltk.pathsec.open, allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose...

CVE-2026-79673 Ech0 before 4.4.3 Scope Bypass via profile:read Token

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that...

The vulnerability of the setup_port() and destroy_port() functions in the drivers/infiniband/core/sysfs.c driver of the Linux operating system’s kernel allows a malicious actor to cause a service failure.

The vulnerability of the setupport and destroyport functions in the drivers/infiniband/core/sysfs.c driver of the Linux operating system’s InfiniBand kernel is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Avoid using prinfo with a spin lock in cblistinitgeneric. prinfo is called with the rtp-cbsgbllock spin lock locked. Since prinfo calls printk, which may sleep, this will result in a bug like the following: 0.206455...

Astra Linux – Vulnerability in ntfs-3g

The file handle created in fuselibopendir, and later used in fuselibreaddir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mISDN: fixed an issue involving misuse of putdevice in mISDNregisterdevice. We should not release references to putdevice before calling deviceinitialize...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: virtio-mmio: Do not break the lifecycle of vmdev. vmdev has a separate lifecycle because it has a struct device embedded within it. Therefore, having a release callback for it is correct. However, allocating the vmdev structure...

CVE-2026-74468

A flaw was found in the Linux kernel's GPIO PCH driver. On systems configured with PREEMPTRT, a local attacker could trigger a specific interrupt handler pchirqtype in a non-sleepable context. This improper use of a spinlock, which attempts to acquire a sleeping lock in an atomic context, can lea...

DEBIAN-CVE-2026-70654

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vipssourcereadtomemory in libvips/iofuncs/source.c. The...

CVE-2026-70654

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vipssourcereadtomemory in libvips/iofuncs/source.c. The...