kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The...

ROS-20260506-73-0025

Vulnerability in tomcat10 related to a flaw in http request handling. Exploitation of the vulnerability could allow a remote attacker to send a hidden http request http request smuggling attack...

OESA-2026-2173 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmptagvalidation icmptagvalidation unconditionally dereferences the result of rcudereferenceinetprotosproto without checki...

EUVD-2026-24641

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial OOB in getfileallinfo for compound requests When a compound request consists of QUERYDIRECTORY + QUERYINFO FILEALLINFORMATION and the first command consumes nearly the entire maxtranssize, getfileallinfo woul...

SUSE: Security Advisory (SUSE-SU-2026:0741-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-23095

In the Linux kernel, the following vulnerability has been resolved: gue: Fix skb memleak with inner IP protocol 0. syzbot reported skb memleak below. 0 The repro generated a GUE packet with its inner protocol 0. gueudprecv returns -guehdr-protoctype for "resubmit" in ipprotocoldeliverrcu, but thi...

AlmaLinux 9 : openssl (ALSA-2026:1473)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:1473 advisory. openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS12 file CVE-2025-11187 openssl: OpenSSL: Remote code execution or Deni...

curl: MQTT Protocol Packet Injection via Unchecked CONNACK Remaining Length

I'm not sure if this is a vulnerability or intended behavior, but I noticed that curl MQTT implementation accepts CONNACK packets with Remaining Length values greater than 2, which appears to violate the MQTT v3.1.1 specification. According to the MQTT spec, CONNACK packets should have a Remainin...

SUSE-RU-2026:20056-1 Recommended update for shim

This update for shim fixes the following issues: This update for shim fixes the following issues: shim is updated to version 16.1: - shimstartimage: fix guid/handle pairing when uninstalling protocols - Fix uncompressed ipv6 netboot - fix test segfaults caused by uninitialized memory -...

Qt 缓冲区错误漏洞

Qt is a cross-platform application development framework from the Qt open source. A buffer error vulnerability exists in versions prior to Qt 6.8.2 that stems from improper handling of Bluetooth ATT commands, which could result in an out-of-bounds read or divide-by-zero error...

EUVD-2016-10383

Malware in sbrugna...

EUVD-2021-17494

Malware in sbrugna...

EUVD-2007-6376

Malware in sbrugna...

EUVD-2017-14633

Malware in sbrugna...

EUVD-2025-28123

Malicious code in bioql PyPI...

EUVD-2023-23896

Malicious code in bioql PyPI...

EUVD-2025-9028

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-22739

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affects Firefox ESR 91.5,...

CVE-2025-38192

CVE-2025-38192 is a Linux kernel vulnerability where an ingress NAT46 BPF program that flips IPv4/IPv6 can mutate skb->protocol to v6 while the dst remains IPv4, leading to a NULL pointer dereference in ip6_rcv_core. The fix is to clear the destination (dst) in all BPF helpers that change skb-...

Sony XAV-AX8500 安全漏洞

The SONY XAV-AX8500 is a car AV receiver with enhanced features. The SONY XAV-AX8500 suffers from a heap buffer overflow vulnerability that stems from an improper implementation of the Bluetooth L2CAP protocol, which can be exploited by an attacker to execute arbitrary code...