PwnKit

PwnKit 此仓库包含一个我开发的漏洞利用程序，用于理解 Polkit Pkexec 漏洞：CVE-2021-4034 Pkexec 本地权限提升。Polkit（原名 PolicyKit）是一个组件，其功能是控制类 Unix 操作系统上的权限。它以有序的方式提供了一种机制，让无特权进程能够与有特权进程通信。该漏洞允许任何用户——系统上的普通用户，无管理权限——达到系统最高权限。 该漏洞发生在 pkexec 的 main 函数处理命令行参数时，当参数为 0 时。该函数尝试访问参数列表，最终试图访问 argvvoid（一个命令行参数控制器），也就是说，当 pkexec...

kernel: xfrm: ah6: validate routing header segments_left

A flaw was found in the Linux kernel's xfrm subsystem, specifically within the AH6 Authentication Header for IPv6 module. The ipv6rearrangerthdr function does not properly validate the segmentsleft field in routing headers when processing raw IPv6 HDRINCL packets. This oversight allows an attacke...

CVE-2026-82459

A flaw was found in Apache Thrift. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted network traffic to an affected application. Due to an integer underflow in the 32-bit C++ THeaderTransport component, processing this malformed data triggers an...

httpd: httpd: Denial of Service via crafted HTTP response bodies in mod_proxy_html

A flaw was found in the modproxyhtml module of Apache HTTP Server. An attacker who controls or manipulates HTTP response bodies processed by the proxy can trigger an out-of-bounds memory write. This issue can cause the server process to crash, resulting in a Denial of Service DoS...

CVE-2026-56449

A flaw was found in the modproxyhtml module of Apache HTTP Server. An attacker who controls or manipulates HTTP response bodies processed by the proxy can trigger an out-of-bounds memory write. This issue can cause the server process to crash, resulting in a Denial of Service DoS. Mitigation...

CVE-2026-63209

A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads t...

CVE-2026-85228

A flaw was found in Deep Java Library. Due to an integer overflow during tensor buffer validation, a remote, unauthenticated attacker can send a crafted tensor payload to trigger out-of-bounds memory access. Successful exploitation can allow an attacker to obtain sensitive data from adjacent...

thrift: thrift: Denial of Service via integer underflow in THeaderTransport

A flaw was found in Apache Thrift. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted network traffic to an affected application. Due to an integer underflow in the 32-bit C++ THeaderTransport component, processing this malformed data triggers an...

SUSE CVE-2026-63209

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode is subsequently...

CLEANSTART-2026-KF94035 Out-of-bounds memory operations in org

Security vulnerability affects the apache-nifi package. Out-of-bounds memory operations in org...

CentOS Linux 7 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-python / libxml2-static Multiple Vulnerabilities (CENTOS7:CLSA-2026:1781619427)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1781619427 advisory. - A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content,...

Rocky Linux 9 [CIQ] Security Update: libX11 / libX11-common / libX11-debuginfo / libX11-debugsource / etc Multiple Vulnerabilities (crlsa-2024_2145)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242145 advisory. libX11: out-of-bounds memory access in XkbReadKeySyms CVE-2023-43785 libX11: stack exhaustion from infinite recursion in PutSubImage CVE-2023-43786 libX11:...

Rocky Linux 9.6 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778003374)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778003374 advisory. - A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling...

Linux Distros Unpatched Vulnerability : CVE-2026-63209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict allows an attacker to bypass...

AlmaLinux 9.6 [TuxCare] Security Update: xorg-x11-server-Xwayland / xorg-x11-server-Xwayland-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778069531)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778069531 advisory. - A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling,...

AlmaLinux 9.2 [TuxCare] Security Update: net-snmp / net-snmp-agent-libs / net-snmp-devel / net-snmp-gui / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1745053614)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745053614 advisory. - net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in t...

Rocky Linux 9.6 [TuxCare] Security Update: xorg-x11-server-Xwayland / xorg-x11-server-Xwayland-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778069531)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778069531 advisory. - A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling...

Rocky Linux 8 [CIQ] Security Update: xorg-x11-server-Xwayland / xorg-x11-server-Xwayland-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_11656)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202611656 advisory. xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling CVE-2026-33999 xorg: xwayland: X.Org X server:...

MongoDB Compass < 1.39.4 Out-of-bounds Memory Access

The version of MongoDB Compass installed on the remote host is prior to 1.39.4. It is, therefore, affected by a vulnerability in the bundled Electron runtime, which was updated to version 24.8.2 in this release: - Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.110 allowed ...

Rocky Linux 9 [CIQ] Security Update: exfatprogs / exfatprogs-debuginfo / exfatprogs-debugsource (crlsa-2024_2437)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20242437 advisory. exfatprogs: exfatprogs allows out-of-bounds memory access CVE-2023-45897 Tenable has extracted the preceding description block directly from the CIQ security...