1939 matches found
CVE-2026-84965
An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently larg...
CVE-2026-85091
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gzvacate function when processing non-blocking gzwrite operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf or gzvprintf after a write stall, causing an...
CVE-2026-80751 pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prevo in mtkmfgattachdev mtkmfgattachdev reads prevo on the first iteration of its loop, in "if prevo && prevo-freq == o-freq", before prevo is assigned at the end of the loop body. On that fir...
CVE-2026-14666
A flaw in PostgreSQL allows users to bypass row-level security RLS due to incomplete tracking of user role and database ownership changes. Active sessions may continue using cached, outdated security policies, enabling unauthorized read or write access to data. Exploitation requires the attacker ...
kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer
A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...
kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer
A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...
CVE-2026-85091 zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gzvacate function when processing non-blocking gzwrite operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf or gzvprintf after a write stall, causing an...
EUVD-2026-70301
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gzvacate function when processing non-blocking gzwrite operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf or gzvprintf after a write stall, causing an...
CVE-2026-85091
zlib versions 1.3.1.2 through 1.3.2 are affected by a heap buffer overflow in the gz_vacate() function. The root cause is an unchecked memmove() that writes beyond the internal input buffer boundary when processing non-blocking gzwrite() operations with stale external buffer pointers . An attacke...
aws-key-disabler
AWS Lambda - IAM 访问密钥禁用器 AWS 密钥禁用器是一个 Lambda 函数，用于在设定时间后禁用 AWS IAM 用户访问密钥，以减少旧访问密钥带来的风险。 AWS Lambda 架构 面向最终用户的 SysOps 输出 开发者工具链 当前限制 包含扫描输出（json）的报告将发送给单个指定的系统管理员账户，请参考 /grunt/package.json 构建配置文件中的 reportto 属性。 密钥仅被禁用，不会删除或替换 前提条件 该脚本运行需要以下组件。 安装了 npm 的 Node.js https://nodejs.org/en/ 已安装 Gruntjs...
CVE-2026-53670 PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...
EUVD-2026-70244
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...
kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer
A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...
PoC-CVE-2020-9715
CVE-2020-9715 EDR 验证 PoC Adobe Acrobat Reader DC 的 EScript.api ESObject 缓存中存在释放后使用漏洞。仅限授权红队进行EDR测试。 漏洞 Adobe Acrobat Reader DC = 2020.009.20063。EScript 引擎缓存数据 ESObject 时，使用的键保留了原始编码（ANSI 或 Unicode）。删除操作始终构造 Unicode 键，因此 ANSI 命名的条目永远不会从缓存中清除。在 GC 释放底层对象后，过期的缓存条目变成悬空指针。 PoC 的功能 1. 在 PDF 中嵌入一个具有 ANS...
CVE-2026-34828
CVE-2026-34828 listmonkにおけるパスワードリセットおよびパスワード変更後のセッション永続化 はじめに listmonkオープンソースのニュースレター兼メーリングリスト管理ツールをレビューしているときに、シンプルなセキュリティ上の問いを胸にこの問題を発見しました: ユーザーがパスワードを変更またはリセットしたとき、アプリケーションは実際に発行済みセッションを終了させるのか? このケースでは、答えは「いいえ」でした。 発行済みの認証済みセッションは、以下の両方の後も有効なままでした: パスワードリセット パスワード変更...
CVE-2026-80047
A vulnerability in Hugging Face Transformers versions = 4.49.0 and = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...
CVE-2026-80047 Hugging Face Transformers library writes remote code to disk prior to consent check
A vulnerability in Hugging Face Transformers versions = 4.49.0 and = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...
EUVD-2026-69144
A vulnerability in Hugging Face Transformers versions = 4.49.0 and = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...
CVE-2026-80721
A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream implementation. This vulnerability occurs because the system does not properly clear references to connection handles hcon after a connection is deleted. This oversight can lead to unpredictable system behavior or instability...
kernel: net: bridge: stop fast-leave after deleting a port group
A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a sta...