CVE-2026-53637 Sylius: Cart FormComponent allows modification or deletion of an already-completed order

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale...

CVE-2026-53638

Sylius (open-source eCommerce framework built on Symfony) is affected by an authorization bypass in the shop account API. The endpoint PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}—used by an authenticated customer to change the payment method of an unpaid order—fails to val...

CVE-2022-39197

CVE-2022-39197 CVE-2022-39197 "ID": "CVE-2022-39197", "STATE": "RESERVED"...

CVE-2026-49883

In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

redxor

LinuxマルウェアC2 'RedXOR' - 検出例 このパッケージは、Zeekを使用してLinuxバックドア「redXOR」をステートベースの手法で検出する方法を示すデモンストレーションです。 参考文献: Corelight blog https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/ 従来のIOC（例: C2...

CVE-2026-28606

In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49883

In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-74050

In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49883

In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-72955

A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentiall...

CVE-2026-53360-POC

CVE-2026-53360: KVM SEV-SNP PSC 힙 버퍼 오버런 KVM의 SEV-SNP 페이지 상태 변경PSC 처리에서 발생하는 힙 읽기 및 쓰기 오버플로우에 대한 개념 증명입니다. 악의적인 SEV-SNP 게스트가 호스트 커널로 하여금 PSC 항목 배열을 슬랩 할당 영역 끝까지 탐색하게 만듭니다. 이로 인해 인접한 kmalloc-cg-32 객체의 레이아웃이 유출되고, 제어된 작은 값이 그 객체에 기록되며, 게스트는 이를 원하는 만큼 반복할 수 있습니다. 전체 분석:...

kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM nSVM module. When a nested virtual machine L2 guest executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor L1, KVM incorrectly uses vmcb02 instead of vmcb01 for managing guest state...

IPI-exposure-signal

IPI露出シグナル これは、私たちの論文「Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure」のコードリポジトリです。 ArXiv版と論文リンク: https://arxiv.org/abs/2608.02657 このリポジトリは、潜在的なIPI露出シグナルのプロービングパイプライン（AgentDojoトレース収集、IPIリスクラベリング、隠れ状態のフィーチャー化、IPI露出プローブのトレーニング/評価）を実装しています。 引用 root@kitploit:...

PT-2026-88632

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2026-88756

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

PT-2026-88745

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2026-88648

Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-84173

In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or...

CVE-2026-84173

Eclipse Ankaios versions v0.5.1 through v1.0.1 contain an authorization flaw in the agent-side Control Interface authorizer . When a multi-segment allow rule begins with a wildcard (e.g., *.workloads.some_workload), an authenticated workload can submit a CompleteStateRequest or UpdateStateRequest...

CVE-2026-84173

In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or...