BIT-THRIFT-2026-94642 Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception

Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-83663 Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

Security update for fetchmail

This update for fetchmail fixes the following issue: CVE-2026-94184: stack-based buffer overflow in NTLM authentication can lead to remote code execution or process termination bsc1282055. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:4605-1 Security update for fetchmail

This update for fetchmail fixes the following issue: - CVE-2026-94184: stack-based buffer overflow in NTLM authentication can lead to remote code execution or process termination bsc1282055...

SUSE-SU-2026:4604-1 Security update for fetchmail

This update for fetchmail fixes the following issue: - CVE-2026-94184: stack-based buffer overflow in NTLM authentication can lead to remote code execution or process termination bsc1282055...

SUSE-SU-2026:24131-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283672. Changes for google-osconfig-agent: - Update to version...

SpawnWith

SpawnWith An experimental Beacon Object File BOF that provides an alternative to the spawnas and inject commands. This exposes a new command, spawnwith pid listener, that performs the following: 1. Obtain a handle to the target process. 2. Obtain a handle to the process' primary token. 3. Duplica...

CVE-2023-36003-POC

Privilege escalation using the XAML diagnostics API CVE-2023-36003 This is a POC Proof of Concept of a privilege escalation vulnerability using the XAML diagnostics API. The vulnerability was patched in December's Patch Tuesday, and the CVE assigned to it is CVE-2023-36003. Usage The POC is a C++...

invoker

Invoker Utilidad de pruebas de penetración y herramienta de evaluación antivirus. Construido con Visual Studio Community 2022 v17.5.4 64 bits y probado en Windows 10 Enterprise OS 64 bits. Hecho con fines educativos. ¡Espero que sea de ayuda! Este repositorio comenzó a tener firmas conocidas y no...

CLEANSTART-2026-BD59133 Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's

Security vulnerability affects the apache2 package. Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's...

CLEANSTART-2026-SY05950 carefully crafted request body can cause a read to a random memory area which could cause the process to crash

Security vulnerability affects the apache2 package. A carefully crafted request body can cause a read to a random memory area which could cause the process to crash...

CLEANSTART-2026-ZC63840 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details...

CVE-2026-107852: Insufficient Verification of Data Authenticity

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

CVE-2026-95702: Use After Free

Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The...

Linux Distros Unpatched Vulnerability : CVE-2026-44036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet and DcmXMLParseHelper::parseSequence in the XML-to-DICOM converter...

Linux Distros Unpatched Vulnerability : CVE-2026-107676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when...

PT-2026-109183

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

openSUSE 16 Security Update : distribution (openSUSE-SU-2026:22039-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22039-1 advisory. This update for distribution fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an...

SUSE SLES12 Security Update : fetchmail (SUSE-SU-2026:4567-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4567-1 advisory. This update for fetchmail fixes the following issue: - CVE-2026-94184: stack-based buffer overflow in NTLM authentication can lead to remote...

CVE-2026-107854: Authorization Bypass Through User-Controlled Key

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...