Linux Distros Unpatched Vulnerability : CVE-2026-87117

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to versi...

Linux Distros Unpatched Vulnerability : CVE-2026-66081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade...

iOS26.6-CVE-2026-65343

CVE-2026-65343 — AppleKeyStore 越界读取（KASLR 绕过） 组件： AppleKeyStore 内核扩展 — LibSerSEPControlDeserialize 受影响版本： iOS / iPadOS 26.6 23G71 及更早版本 修复版本： iOS / iPadOS 26.6.1 23G83 类型： SEP 控制消息反序列化中的越界读取 影响： 内核指针泄露 → 从沙盒、无权限进程中绕过 KASLR（通过 DYLDINTERPOSE ACM 句柄捕获） 致谢 发现者：Drinor Selmanaj Sentry、Surya Narayan...

d-os-descriptor

d-os-descriptor 概述 USB小工具子系统在compositesetup函数（composite.c）的OS描述符处理部分存在安全问题。处理精心构造的控制传输请求消息会因空指针解引用或内存损坏而导致设备崩溃。 描述 compositesetup中针对接口接收者的OS描述符处理部分实现如下。 case USBRECIPINTERFACE: if windex != 0x5 || wvalue 8 break; interface = wvalue & 0xFF; buf6 = windex; count = countextproposdesccfg, interface;...

CVE-2026-43499-S26

CVE-2026-43499 — Android GKI 6.12 pselect / configfs 内核漏洞利用 针对 Android GKI 6.12 系列（三星和 Pixel 设备）的 Linux 内核漏洞利用，目标是 CVE-2026-43499 ：rtmutexstartproxylock 中 removewaiter 的回滚存在缺陷，它使用了 current 而不是 waiter::task，导致等待者的 piblockedon 指向其（稍后被弹出的）内核栈上的 rtmutexwaiter。结合 pselect 的 fdset 栈覆写以及由消费者 schedsetattr...

PoC-CVE-2025-69420

CVE-2025-69420 — OpenSSL TimeStamp Response 类型混淆 PoC OpenSSL 中 CVE-2025-69420 的仅崩溃实验室复现器。该 PoC 加载一个有效的 RFC 3161 时间戳响应，在内存中将签名的 ESS 属性从 VASN1SEQUENCE 更改为 VASN1NULL，并调用 TSRESPverifyresponse。 在受影响的构建上，osslessgetsigningcertv2 或 osslessgetsigningcert 未经验证活动类型即将 ASN1TYPE 联合体作为序列访问。UBSan 报告通过空 ASN1STRIN...

CVE-2026-66081

A flaw was found in Apache Thrift's C GLib bindings. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input that triggers the access of an uninitialized pointer. This access can cause the application to crash, resulting in a Denial of Service DoS...

tpwn

tpwn cve-2015-???? poc os x 10.10.5 内核本地权限提升 该漏洞已在 10.11 中被修复 完整 writeup etason 感谢 @ unthreadedjb 提供的 hax 安装 NULLGuard 以保护自己免受 tpwn 和其他 NULL 指针解引用漏洞的影响。...

OPENSUSE-SU-2026:22013-1 Security update for openexr

This update for openexr fixes the following issue: - CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted EXR file containing an unknown-type attribute with dataSize set to zero is processed bsc1282700...

CVE-2026-66859

NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66081

Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PoC-CVE-2025-69421

CVE-2025-69421 仅崩溃复现器 本仓库包含一个最小的畸形 PKCS12 文件，可在隔离的实验室环境中复现 CVE-2025-69421。 生成的 PFX 包含 EncryptedData，其 EncryptedContentInfo 省略了可选的 encryptedContent 字段。易受影响的 OpenSSL 版本可能会将 NULL ASN1OCTETSTRING 指针从 PKCS12unpackp7encdata 传递给 PKCS12itemdecryptd2iex，而后者在未进行 NULL 检查的情况下解引用该指针。...

CVE-2026-66081

Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66081

A flaw exists in the Apache Thrift c_glib bindings (versions before 0.25.0 ) where the read_message_begin function leaves output parameters unset for non-versioned messages. This results in an Access of Uninitialized Pointer vulnerability. A remote, unauthenticated attacker can exploit this by se...

CVE-2026-66081 Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages

Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91588

Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91584

NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66859 Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route

NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66859

NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66859

Apache Thrift versions prior to 0.25.0 are vulnerable to a NULL Pointer Dereference and Use of Uninitialized Variable within the c_glib bindings . Specifically, the c_glib multiplexed processor can be triggered to crash when it encounters a message it cannot route. The impact of this vulnerabilit...