CVE-2026-98232 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsicdlenable scsicdlenable uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its...

CVE-2026-98232

The Linux kernel contains a vulnerability in the scsi core where scsi_cdl_enable() fails to properly validate MODE SENSE length fields. A target can report a total length shorter than its mode header and block descriptors, causing an unsigned subtraction wrap that allows buf_data to point beyond ...

CVE-2026-98232 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsicdlenable scsicdlenable uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its...

CVE-2026-98205

The Linux kernel contains a vulnerability in the evdev subsystem where the EVIOCSABS handler copies a user-supplied size into an uninitialized on-stack input_absinfo structure. Because the size is controlled by userspace, a short size allows trailing parts of the structure to retain stale stack b...

CVE-2026-98205 Input: evdev - zero absinfo before partial copy in EVIOCSABS

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct inputabsinfo: if copyfromuser&abs, p, mintsizet, size,...

CVE-2026-98205 Input: evdev - zero absinfo before partial copy in EVIOCSABS

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct inputabsinfo: if copyfromuser&abs, p, mintsizet, size,...

EUVD-2026-93133

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct inputabsinfo: if copyfromuser&abs, p, mintsizet, size,...

EUVD-2026-93129

In the Linux kernel, the following vulnerability has been resolved: Input: zero ffeffect before compat copy in inputffeffectfromuser In the compat path inputffeffectfromuser aliases the caller's native struct ffeffect with the smaller struct ffeffectcompat and copies only the compat sized prefix:...

CVE-2026-98201 Input: zero ff_effect before compat copy in input_ff_effect_from_user

In the Linux kernel, the following vulnerability has been resolved: Input: zero ffeffect before compat copy in inputffeffectfromuser In the compat path inputffeffectfromuser aliases the caller's native struct ffeffect with the smaller struct ffeffectcompat and copies only the compat sized prefix:...

CVE-2026-98201

A vulnerability exists in the Linux kernel within the compat path of the input_ff_effect_from_user() function. The issue arises because the function aliases a native struct ff_effect with a smaller struct ff_effect_compat and only copies the compat-sized prefix using copy_from_user(). Consequentl...

CVE-2026-98201 Input: zero ff_effect before compat copy in input_ff_effect_from_user

In the Linux kernel, the following vulnerability has been resolved: Input: zero ffeffect before compat copy in inputffeffectfromuser In the compat path inputffeffectfromuser aliases the caller's native struct ffeffect with the smaller struct ffeffectcompat and copies only the compat sized prefix:...

CVE-2026-103436

A flaw was found in apcupsd. This vulnerability allows a remote attacker to cause an information disclosure when querying Common Gateway Interface CGI monitoring scripts. When processing status lines with fewer data tokens than expected, the parsing logic fails to populate a destination buffer...

lwip-snmpv3-stack-overflow-cve-2026-8836-critical-embedded-rce

CVE-2026-8836 — PoC de desbordamiento de pila en lwIP SNMPv3 Exploit de prueba de concepto para CVE-2026-8836, un desbordamiento de búfer crítico basado en pila en el manejador USM SNMPv3 de lwIP. Vulnerabilidad CVE : CVE-2026-8836 CVSS : 9.8 Crítico Componente : snmpparseinboundframe en...

CVE-2025-9961

CVE-2025-9961 TP-Link AX10/AX1500 CWMP Desbordamiento de búfer RCE Descripción general Desbordamiento de búfer basado en pila en CWMP TR-069 que conduce a la ejecución remota de código. Campo| Valor ---|--- Producto| TP-Link AX10, AX1500 Afectados| AX10 B"Malicious ACS" B -- C"SetParameterValues"...

CVE-2026-105778

A vulnerability has been found in Tenda AC5 02.03.01.111multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack...

CVE-2026-105778 Tenda AC5 Wifi setWifi stack-based overflow

A vulnerability has been found in Tenda AC5 02.03.01.111multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack...

CVE-2026-105778

The Tenda AC5 router, running firmware version 02.03.01.111_multi , is vulnerable to a stack-based buffer overflow in the Wifi Handler component. Specifically, a flaw in the /goform/setWifi file allows an attacker to trigger the overflow by manipulating the wifiPwd argument. This vulnerability ca...

EUVD-2026-92987

A vulnerability has been found in Tenda AC5 02.03.01.111multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack...

CVE-2026-12485

🚨 CVE-2026-12485 - Ejecución Remota de Código RCE Crítica sin Autenticación GeoVision GV-I/O Box 4E – Firmware v2.09 Fecha de divulgación: 23 de junio de 2026 CWE: CWE-121 – Desbordamiento de búfer basado en pila Vector de ataque: Red sin autenticación Una vulnerabilidad de desbordamiento de búfe...

The Hidden DoS Vector in SQL Parsers

SQL parsers are critical components of the modern data stack. They validate queries before they reach the database, transpile between dialects, and lint codebases for style violations. Increasingly, they also power AI-driven SQL generation in LLM-integrated data tools. Our research focused on two...