CVE-2021-4034

CVE-2021-4034 本仓库包含用于 cve-2021-4034 的单文件漏洞利用程序，该漏洞是 Polkit 本地权限提升漏洞。请谨慎使用！ 漏洞描述 CVE-2021-4034，通常被称为 Pwnkit ，是 Polkit 中 pkexec 组件的一个内存损坏漏洞。Polkit 是用于在类 Unix 系统中定义和处理授权的工具包。该漏洞源于对环境变量的不当处理，允许本地用户以 root 用户身份执行任意代码。 核心问题在于 pkexec 在解析环境变量之前未能正确地对其进行清理。这导致在某些情况下出现越界 写入条件，最终允许本地权限提升。该漏洞自 2009 年 pkexec...

CVE-2026-74737

A flaw was found in the Linux kernel's am65-cpsw-nuss Ethernet driver. When processing incoming network packets, the driver incorrectly extracts the MAC Port ID from the Source Tag, using 16 bits instead of the intended lower 8 bits. This error can lead to the driver accessing out-of-bound memory...

CVE-2026-74737 net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted usi...

CVE-2026-74737 net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted usi...

PT-2026-82117

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the packet reception path where the MAC Port ID is extracted from the RX DMA Descriptor metadata. The helper function cppi5 desc get tags ids incorrectly assigns a...

SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:3686-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3686-1 advisory. - CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow bsc1268298. -...

SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:3687-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3687-1 advisory. - CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow bsc1268298. -...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source project that provides a graphical login to remote machines using the Microsoft Remote Desktop Protocol RDP. xrdp v0.9.21 contains a “Out of Bound Read” issue in the xrdpmmtransprocessdrdynvcchannelclose function. There are no known solutions to this problem. Users are advis...

SUSE SLES15 Security Update : 389-ds (SUSE-SU-2026:3678-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3678-1 advisory. - CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow bsc1268298. -...

SUSE-SU-2026:3687-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow bsc1268298. - CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure bsc1268065. ...

Security update for 389-ds

This update for 389-ds fixes the following issues: CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow bsc1268298. CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure bsc1268065...

SUSE-SU-2026:3678-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2026-11774: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow bsc1268298. - CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure bsc1268065. ...

CVE-2026-65609

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

CVE-2026-68108

A flaw was found in the drm/amdgpu/vce component of the Linux kernel. Malicious VCE Video Codec Engine command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead...

AZL-94838 CVE-2026-68401 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix out-of-bound writes in ffasetupandtransmit Sashiko locally reports multiple out-of-bound issues in ffasetupandtransmit: 1 Writing epmemaccess-reserved can write out of bounds for FFA versions 1.2 as...

Microsoft Excel heap buffer overflow vulnerability (CNVD-2026-31553)

Microsoft Excel is a spreadsheet processing component within the Microsoft Office suite, primarily used for data calculation, analysis, and visualization. Microsoft Excel has a heap buffer overflow vulnerability, which stems from improper handling of certain data, leading to out-of-bound writes t...

SUSE-SU-2026:22564-1 Security update for apache2

This update for apache2 fixes the following issues - CVE-2026-29167: modldap per-dir use-after-free bsc1267976. - CVE-2026-29170: modproxyftp XSS bsc1267977. - CVE-2026-34355: modproxyhtml buffer overflow bsc1267978. - CVE-2026-34356: malicious backend servers can lead to a heap-based buffer...

SUSE-SU-2026:2759-1 Security update for apache2

This update for apache2 fixes the following issues - CVE-2026-29167: modldap per-dir use-after-free bsc1267976. - CVE-2026-29170: modproxyftp XSS bsc1267977. - CVE-2026-34355: modproxyhtml buffer overflow bsc1267978. - CVE-2026-34356: malicious backend servers can lead to a heap-based buffer...

Security update for apache2

This update for apache2 fixes the following issues CVE-2026-29167: modldap per-dir use-after-free bsc1267976. CVE-2026-29170: modproxyftp XSS bsc1267977. CVE-2026-34355: modproxyhtml buffer overflow bsc1267978. CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow...

GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilities

Summary Multiple exploitable out-of-bounds read vulnerabilities exist in the Websocket Server functionality of GeoWebPlayer versions: 1.1.1.0. A specially crafted websocket message can lead to a arbitrary code execution. An attacker can stage a malicious webpage to trigger these vulnerabilities...