3737 matches found
CVE-2026-119345
Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep th...
EUVD-2026-117556
Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep th...
CVE-2026-119345
Prior to version 0.9.0 , Cocos AI is vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition within its intra-handshake attested TLS implementation. The system performs attestation only once during the initial connection establishment. An attacker capable of modifying the attester's wor...
CVE-2026-119345 Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep th...
CVE-2026-119345 Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep th...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
CVE-2026-109619: PHP stale session state, isolated lab reprodu...
CVE-2026-102664
ProxySQL versions prior to 3.0.10 , 3.1.10 , and 4.0.10 are vulnerable to an uninitialized heap read during MySQL compressed packet decompression via the zlib path. The root cause is located in decompress_mysql_payload() within lib/mysql_data_stream.cpp, which fails to verify that the actual outp...
CVE-2026-99230
A flaw was found in the Linux kernel's iouring subsystem. When cancelable commands are removed, recycled request objects can retain stale list pointers instead of being cleanly reinitialized. A local attacker can trigger this issue by submitting specific asynchronous I/O requests, causing the...
CVE-2026-87043 sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready
The entropy-device random number generator in subsys/random/randomentropydevice.c returned early with -ENODEV from randget as soon as deviceisready failed, before reaching the non-cryptographic system-timer fallback further down the same function. Because zimplsysrandget returns void and discards...
CVE-2026-87043
The Zephyr RTOS entropy-device random number generator in subsys/random/random_entropy_device.c is vulnerable to an uninitialized read due to premature error handling. When device_is_ready() fails, rand_get() returns -ENODEV early, skipping the system-timer fallback. Because the sys_rand_get() sy...
kernel: ipvs: do not propagate one-packet flag to synced conns
A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When a synced connection is established, it can incorrectly inherit a "one-packet" flag from its destination. This misconfiguration causes the connection's expiry process to mishandle its cleanup, leaving behind stale memory...
EUVD-2026-116593
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmedsentat. Attackers who obtain an old confirmation link from a...
CVE-2026-121735
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmedsentat. Attackers who obtain an old confirmation link from a...
CVE-2026-121735
The blueprintUE self-hosted edition before version 4.3.4 is vulnerable to an insufficient session expiration vulnerability (CWE-613). The root cause is that the UserModel::findUserIDWithConfirmedToken function ignores the confirmed_sent_at field, allowing for the use of stale confirmation tokens ...
CVE-2026-121735 blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmedsentat. Attackers who obtain an old confirmation link from a...
GHSA-9PPR-WFW9-XVR2 Netfoil doesn't decrement TTL
Summary TTL was not decremented, so stale records would continue to be served...
kernel: ipvs: do not propagate one-packet flag to synced conns
A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When a synced connection is established, it can incorrectly inherit a "one-packet" flag from its destination. This misconfiguration causes the connection's expiry process to mishandle its cleanup, leaving behind stale memory...
kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable
A flaw was found in the Linux kernel's netfilter synproxy module. When handling TCP timestamp options, a stale pointer can be used after memory reallocation. This can result in memory corruption, where data is written to a freed memory area, or lead to packets being sent with an incorrect checksu...
kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable
A flaw was found in the Linux kernel's netfilter synproxy module. When handling TCP timestamp options, a stale pointer can be used after memory reallocation. This can result in memory corruption, where data is written to a freed memory area, or lead to packets being sent with an incorrect checksu...