CVE-2026-23010-CCSDS-Telecommand-Replay-Without-Sequence-Number

CVE-2026-23010 – 시퀀스 번호 없는 CCSDS 텔레커맨드 재전송 프로그램 코드Python 위성 시뮬레이터 root@kitploit: satellitesim.py - Spacecraft that executes telecommands without checking sequence number class Satellite: def initself: self.executed = set def receivetcself, cmdid, seqnum: Vulnerability: ignores seqnum, allowing...

mountain_goat

Привет, я горный козёл и я забодаю ваши TCP-соединения, потому что это довольно козлиное занятие. Это PoC, демонстрирующий методы эксплуатации CVE-2016-5696 Off-Path TCP Exploits: Global Rate Limit Considered Dangerous от авторов Yue Cao, Zhiyun Qian, Zhongjie Wang, Tuan Dao, Srikanth V...

CVE-2026-28867-PoC

CVE-2026-28867 Как это работает Уязвимость существует из-за того, что реализация ядра tcpsysctlinfo выполняет глобальный поиск соединения без проверки того, что вызывающий процесс владеет сокетом или обладает повышенными привилегиями, такими как root. Воздействие Непривилегированный злоумышленник...

CVE-2023-33105-Transient-DOS-in-WLAN-Host-and-Firmware

CVE-2023-33105: WLAN 호스트 및 펌웨어의 일시적 DOS 개요 이 리포지토리는 Qualcomm 장치에서 확인된 취약점인 CVE-2023-33105의 익스플로잇 코드를 포함합니다. 이 익스플로잇은 인증 프레임을 활용하여 잘못된 트랜잭션 시퀀스 번호를 가진 대량의 개방형 인증 프레임을 전송함으로써 대상 액세스 포인트AP에 대한 서비스 거부DoS 공격을 수행합니다. CVE ID : CVE-2023-33105 Qualcomm 보안 게시판 : 2024년 3월 게시판 요구 사항 Python 3.x Scapy Termcolo...

EUVD-2025-210802

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the sequence or acknowledgment numbers...

CVE-2026-16599 Denial of Service in GNU wget

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network...

PT-2026-81317

Name of the Vulnerable Software and Affected Versions GNU wget versions prior to 1.25.0 Description GNU wget is susceptible to a denial of service in its FTP OPIE/S-KEY authentication functionality. The issue occurs because the software uses a server-supplied sequence number from the FTP challeng...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: DCCP: Fixed out-of-bounds access in the DCCP error handler. There was a previous attempt to fix out-of-bounds access in the DCCP error handlers, but that fix assumed that the error handlers only wanted to access the first 8...

CVE-2026-58087

The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...

EUVD-2026-62364

The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...

CVE-2026-58087

CVE-2026-58087 is a heap out-of-bounds access in the GETALL and SETALL commands of FreeBSD's semctl(2) system call. The root cause is a sequence-number wrap after 0x8000 create/destroy cycles: an unprivileged local user can rapidly destroy and recreate semaphore sets at the same index, causing a ...

CVE-2026-58087 Heap out-of-bounds access in semctl(2)

The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...

PT-2026-78319

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The GETALL and SETALL commands in the semctl function contain a flaw in how they handle semaphore sets. The process records the number of semaphores, releases th...

EUVD-2026-58978

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd "ipvs: avoid kmemcachezalloc in ipvsconnnew" changed ipvsconnnew to allocate an ipvsconn object with kmemcachealloc. The function then initializes many fields...

PT-2026-72209

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip vs seq structs in ip vs conn new Commit 9a05475cebdd "ipvs: avoid kmem cache zalloc in ip vs conn new" changed ip vs conn new to allocate an ip vs conn object with kmem cache alloc. The function then initializ...

PT-2026-72837

In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg handle in send queue ordered In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be that the mh-seq is not ordered according the oldest seq number. This...

CVE-2026-68329

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Wait for completion instead of returning early in iommucompletionwait needsync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. It is set whenever a command is queued with sync == true and clear...

CVE-2026-68329

CVE-2026-68329 affects the Linux kernel’s iommu/amd path. A race in iommu_completion_wait() can cause it to return before all previously queued commands complete, enabling a use-after-free window where stale page-table translations may be used. The issue stems from need_sync being read locklessly...

CVE-2026-64024

A flaw was found in the Linux kernel's Transmission Control Protocol TCP networking stack. This vulnerability arises from a stale per-CPU variable that can retain a previously used Initial Sequence Number ISN when certain packets are dropped. A remote attacker could exploit this by sending...

SUSE CVE-2026-64024

In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcptwisn leak enabling ISN prediction Blamed commit moved the TIMEWAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcpconnrequest for the sam...