GoTEE

Introduction The GoTEE framework implements concurrent instantiation of TamaGo based unikernels in privileged and unprivileged modes, interacting with each other through monitor mode and custom system calls. With these capabilities GoTEE implements a TamaGo based Trusted Execution Environments TE...

CVE-2017-11610

CVE-2017-11610 Unauthenticated Reverse Shell RCE for Supervisor 3.0a1 - 3.3.2 Standalone Python ≥3.6 Unauthenticated RCE exploit for Supervisor 3.0a1 to 3.3.2, rewritten from this Metasploit module. Explanatory post here. Tested with Python 3.7 on this target runing Supervisor 3.3.2 Usage:...

CVE-2017-11610

Supervisord Remote Command Execution Vulnerability Script CVE-2017-11610 Vulnerability Overview Supervisor is a process management tool written in Python, which can be used to start, restart auto-restart programs, and stop processes not just Python processes on UNIX-like systems Windows is not...

GoTEE-example

Introduction The GoTEE framework implements concurrent instantiation of TamaGo based unikernels in privileged and unprivileged modes, interacting with each other through monitor mode and custom system calls. With these capabilities GoTEE implements a TamaGo based Trusted Execution Environments TE...

XML-RPC Server - Remote Code Execution

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisor namespace lookups. id: CVE-2017-11610 info: name: XML-RPC Serve...

Linux Distros Unpatched Vulnerability : CVE-2026-90586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in...

UBUNTU-CVE-2026-90586

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

CVE-2026-90586

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

CVE-2026-90586 Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

CVE-2026-90586

The Zephyr RTOS Xtensa MMU userspace port is vulnerable to an uninitialized pointer issue because the thread->arch.ptables pointer is not initialized during thread setup. The function arch_mem_domain_thread_add() in arch/xtensa/core/ptables.c treats a non-NULL value in this field as a predicat...

CVE-2026-90586 Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

CVE-2026-90586: zephyrproject zephyr: The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread->arch.ptables during thread…

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

PT-2026-141162

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while arch mem domain thread add in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For...

CVE-2026-121428

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...

CVE-2026-121428

AzuraCast versions through 0.23.8 are vulnerable to Remote Code Execution (RCE) due to a Supervisor configuration injection flaw in the station timezone field. Authenticated station managers can exploit the profile edit API by submitting a timezone string containing newlines. This allows the inje...

CVE-2026-121428 AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...

CVE-2026-121428 AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...

EUVD-2026-115960

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...

CVE-2026-121428 AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...

CVE-2026-121428: AzuraCast: AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to…

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...