CVE-2026-47753

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateInstanceFromBackup in internal/server/storage/backend.go contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploadin...

CVE-2026-47753 Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateInstanceFromBackup in internal/server/storage/backend.go contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploadin...

CVE-2026-48756 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

CVE-2026-48756 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

CVE-2026-48756 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to axios (CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037, CVE-2026-42038, CVE-2026-42039, CVE-2026-42040, CVE-2026-42041, CVE-2026-42042, CVE-2026)

Summary Axios is vulnerable to Prototype Pollution / Transport Hijacking ,HTTP Request/Response Splitting via Gadget ,NOPROXY Protection Bypass ,Denial of Service DoS via Uncontrolled Recursion ,SSRF via Incomplete Proxy Bypass ,JSON API Response Manipulation via Prototype Pollution,XSRF Token...

Malicious code in totp-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5 Package advertises itself as a TOTP utility but its postinstall script node./index.js --setup 2/dev/null || true and its exported validateSecret API...

MAL-2026-14379 Malicious code in totp-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5 Package advertises itself as a TOTP utility but its postinstall script node./index.js --setup 2/dev/null || true and its exported validateSecret API...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to picomatch-2.2.2.tgz (CVE-2026-33671, CVE-2026-33672)

Summary picomatch is vulnerable to a Inefficient Regular Expression Complexity DOS, Improperly Controlled Modification of Object Prototype Attributes / Prototype Reference attacks. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch i...

CVE-2026-74552

A flaw was found in the Linux kernel's hwmon lm90 driver. A local user can trigger a null pointer dereference by reading sysfs attributes before the driver's registration is complete. This can lead to a system crash, resulting in a denial of service...

python-inquestlabs

EINGESTELLT November 2025 inquestlabs Eine Pythonic-Schnittstelle und ein Befehlszeilenwerkzeug für die Interaktion mit der InQuest Labs API. Beachten Sie, dass für die Interaktion mit dieser API kein API-Schlüssel erforderlich ist. Ein API-Schlüssel bietet jedoch die Möglichkeit, den Lookback zu...

CVE-2026-74443

A flaw was found in the Linux kernel's drm/vmwgfx component. A local attacker could exploit a vulnerability in the vmwcmddma function, where an undersized header in a Direct Memory Access DMA command body causes a pointer to underflow. This allows the attacker to overwrite authenticated fields of...

Security Bulletin: IBM Security Verify Governance has multiple vulnerabilities

Summary Multiple security vulnerabilities in dependent components have been addressed in the latest update to IBM Security Verify Governance and its re-branded version, IBM Verify Identity Governance. Vulnerability Details CVEID:CVE-2026-1561 DESCRIPTION: IBM WebSphere Application Server - Libert...

Security Bulletin: Multiple vulnerabilities affect IBM License Metric Tool

Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication...

RtlHijack

RtlHijack Un repository con script per dimostrare primitive di lettura e scrittura alternative utilizzando le funzioni Rtl in modo non convenzionale. RtlFillMemory.c RtlFillMemory accetta tre argomenti: un puntatore alla memoria di destinazione, il numero di byte da scrivere e un singolo valore...

mariadb-13-rce-lab

MariaDB 13.0.1-rc RCE Lab Esecuzione di codice in remoto sull'immagine Docker non modificata e stock di MariaDB 13.0.1-rc come uid 999 mysql. Due varianti di exploit: Variante| File| Requisiti| Note ---|---|---|--- SQL puro consigliata| exploitpuresql.py| un account MariaDB a bassi privilegi + TC...

blackbox-fuzzing

IoT डिवाइसों की ब्लैकबॉक्स-फ़ज़िंग: उदाहरण के रूप में TL-WR902AC राउटर का उपयोग यह मेरे टर्म पेपर का HTML संस्करण है जिसे PDF के रूप में डाउनलोड किया जा सकता है यहाँ. परिचय फ़ज़िंग सॉफ़्टवेयर में बग खोजने का "सबसे प्रभावी तरीकों" में से एक बन गई है। इसी या समान दावों के साथ, कई वर्तमान...

CVE-2026-74509

A flaw was found in the Linux kernel's Bluetooth subsystem. Specifically, the hcisync component, which manages Bluetooth advertising data, is susceptible to a Use-After-Free UAF vulnerability. This occurs when a pointer to advertising data becomes invalid but is still accessed, particularly durin...

process-injection-playground

Linux Process Injection Playground Una raccolta completa di tecniche di process injection per Linux, che dimostra vari metodi per iniettare codice in processi in esecuzione. Questi esempi sono pensati per scopi educativi, ricerca sulla sicurezza e comprensione della manipolazione dei processi Lin...

RLSA-2026:57254 Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154create CVE-2024-56602 kernel: ip6gre: Use cached t-net in...