CVE-2026-111158

A flaw was found in libmseed. A heap-based out-of-bounds read vulnerability exists in the ms3detect function when processing truncated record buffers. By tricking a user or application into parsing a specially crafted input, an attacker can cause the library to read past allocated memory...

CVE-2026-89786

A flaw was found in the ext4 filesystem component of the Linux kernel. The ext4readinlinedir function can read a directory entry header beyond the allocated buffer, leading to an out-of-bounds read. A local attacker could exploit this vulnerability by interacting with the filesystem, potentially...

CVE-2026-85745

A flaw was found in MariaDB. An authenticated database user can exploit an out-of-bounds read vulnerability by supplying a specially crafted spatial geometry to the STArea function. This issue allows reading beyond allocated memory buffers, leading to unauthorized information disclosure of intern...

CVE-2026-39113

CVE-2026-39113: Heap Buffer Overflow in SQLite's Optional SQLAR Extension Executive Summary CVE-2026-39113 is a heap buffer overflow in SQLite's optional SQLAR extension. In an application that has loaded the extension, an attacker who can invoke sqlaruncompress with a controlled compressed blob...

GIGABYTE-H510M-K-V2-BIOS-SMM-Reverse-Engineering-CVE-2025-7026-7027-7028-7029-Research

GIGABYTE H510M K V2 BIOS SMM Reverse-Engineering & CVE-2025-7026/7027/7028/7029 Research Static reverse-engineering of a GIGABYTE H510M K V2 H510MKV2.F3 BIOS image: full UEFI firmware-volume extraction analysis of the PI-spec SMM Core memory allocator and a targeted hunt for the four SMM...

EXPLOIT-CVE-2026-22778

CVE-2026-22778 — vLLM RCE in video processing Vulnerable lab + proof of concept for CVE-2026-22778 CVSS 9.8, an unauthenticated remote code execution chain in vLLM's multimodal ingestion path. | ---|--- CVE| CVE-2026-22778 Advisory| GHSA-4r2x-xpjr-7cvv Affected| vLLM = 0.8.3, vLLM turned...

secdim-assurance-drift-challenge

SecDim Challenge Builder Repro — Assurance Drift Working reproduction for a proposed security challenge inspired by CVE-2026-88861 , published 10 September 2026. Security concept The application correctly verifies a signed session and correctly checks the admin role, but it collapses two...

CVE-2026-105667 J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...

CVE-2026-105667 J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...

CVE-2026-102607-ZoneMinder

Security Vulnerability Report: OS Command Injection in ZoneMinder exportEvents Summary An authenticated OS Command Injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec,...

CVE-2026-105279 J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identit...

CVE-2026-105279 J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identit...

CVE-2013-2028-Exploit

CVE-2013-2028 Exploit Vulnerability Details Vulnerable software: Nginx 1.3.9 Vulnerable function: ngxhttpparsechunked CVE-2013-2028 is an integer overflow vulnerability in Nginx's HTTP chunked transfer encoding parser. Under the conditions targeted by this laboratory environment, the vulnerabilit...

CVE-2026-80099

CVE-2026-80099 PoC Unauthenticated authentication bypass and RCE exploit targeting Newfold WordPress plugins that bundle wp-module-data. Overview This tool exploits a Bearer token validation flaw in the Newfold wp-module-data module. When a WordPress site using an affected Newfold plugin is not...

kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

A flaw was found in the Linux kernel, specifically within the RDMA Remote Direct Memory Access vmwpvrdma module. This vulnerability is a double free, which means the system attempts to release the same memory resource twice. This can occur in an error handling path within the pvrdmaallocucontext...

kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()

A flaw was found in the Linux kernel's nfnetlinkcthelper component. This vulnerability, an out-of-bounds read, occurs in the nfnlcthelperdumptable function when a network connection tracking helper is removed during a dump operation, leading to a bypassed bounds check. A local attacker could...

kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

A flaw was found in the Linux kernel's handling of IPv6 extended headers. Specifically, the ipv6hopjumbo function, which processes jumbo payloads, can modify internal packet buffer skb pointers. However, the network header nh pointer is not recomputed after these modifications. This oversight cou...

kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks RPL segment routing header SRH decompression function, ipv6rplsrhdecompress. An integer overflow occurs when processing a specially crafted IPv6 packet, causing the header length calculation to truncate...

kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

A flaw was found in the Linux kernel's SCSI target subsystem. This vulnerability, a buffer overflow, occurs in the tgptgpmembersshow function when processing long iSCSI IQN names. An attacker could potentially exploit this by providing a specially crafted input, leading to the disclosure of...

kernel: ipv6: fix use-after-free in ip6_finish_output2()

A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the ip6finishoutput2 function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive...