CVE-2026-43499

👻 CVE-2026-43499 — GhostLock 15年历史的GhostLock漏洞使大多数Linux发行版面临Root权限和容器逃逸风险 GhostLock 是 Linux 内核 rtmutex 子系统中的一个高危 Use-After-Free UAF 漏洞。该漏洞源于在 优先级继承 PI 处理过程中不正确的等待者清理操作，可能导致内核内存损坏、本地权限提升或拒绝服务。 📑 目录 概述 技术摘要 根本原因 攻击流程 影响 受影响版本 检测 缓解措施 时间线 参考资料 免责声明 📌 概述 🔍 技术摘要 漏洞存在于 Linux 内核的 实时互斥锁 rtmutex 实现中。...

kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

A flaw was found in the Linux kernel's Asynchronous Transfer Mode ATM networking component. A local attacker, by acting as a malicious signaling daemon, could send a specially crafted message containing an unvalidated pointer. This unvalidated pointer would be directly used by the kernel, leading...

CVE-2026-46331

🚨 CVE-2026-46331 - LinuxカーネルCOWバグ Linuxカーネル net/sched 部分的なコピーオンライト（COW）ページキャッシュ破損 -orange?style=for-the-badge Linuxカーネルの脆弱性で、トラフィック制御（tc）パケット編集サブシステムにおける不正確なコピーオンライト（COW）処理に起因します。 📖 概要 CVE-2026-46331 は、net/sched パケット編集（actpedit）サブシステムに影響を与えるLinuxカーネルの脆弱性です。 この脆弱性は、カーネルが実際のパケット編集オフセットが判明する前に...

EUVD-2026-68339

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument UUSERNAME causes sql injection. The...

CVE-2026-82611

A SQL injection vulnerability exists in the Customer::cusAuthentication function of the /login.php file (Customer Login Interface) in itsourcecode Online Medicine Delivery System 1.0 . Manipulation of the U_USERNAME parameter allows a remote, unauthenticated attacker to inject SQL queries. The ex...

CVE-2026-82611 itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument UUSERNAME causes sql injection. The...

CVE-2026-82611 itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument UUSERNAME causes sql injection. The...

DEBIAN-CVE-2026-82608

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get4bytes of the file src/modules/imsregistrarscscf/cxdxavp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has bee...

CVE-2026-82608

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get4bytes of the file src/modules/imsregistrarscscf/cxdxavp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has bee...

CVE-2026-82607

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppbajaxsimpleavatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. Th...

CVE-2026-82605

A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation leads to infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue. The...

UBUNTU-CVE-2026-82608

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get4bytes of the file src/modules/imsregistrarscscf/cxdxavp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has bee...

EUVD-2026-68338

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument empemail results in sql injection. It is possible to...

CVE-2026-82610 itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument empemail results in sql injection. It is possible to...

CVE-2026-82610

itsourcecode Online Medicine Delivery System 1.0 is affected by a SQL injection in the Employee::employeeAuthentication function within /rider/login.php (Login Interface component). Manipulation of the emp_email argument allows an unauthenticated remote attacker to inject SQL, resulting in low im...

CVE-2026-82610 itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument empemail results in sql injection. It is possible to...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress 未认证 XSS iframe 地图渲染漏洞 执行摘要 此仓库包含一个本地 Docker 实验室，用于复现和验证 CVE-2026-56011，这是一个影响 MapPress Maps for WordPress 的未认证跨站脚本（XSS）漏洞。 MapPress Maps for WordPress 是一个用于在 WordPress 页面和文章中渲染地图的插件。漏洞行为影响可通过 mappress=embed 请求参数访问的 iframe 地图渲染路径。 此实验室比较两个 MapPress 版本：...

mitigate-cve-2026-23869-react-server-component-loops

如何修复 CVE-2026-23869：缓解 React 服务端组件循环 保护现代企业前端应用需要持续监控服务端数据获取布局和框架组件生命周期。随着 CVE-2026-23869 的近期公开披露，工程团队正面临与 React 服务端组件内不受控制的渲染循环相关的严重漏洞。这一关键安全漏洞允许未经身份验证的网络请求触发递归渲染状态，从而瞬间耗尽后端服务器内存层。若未及时修补，一波自动化利用流量可能导致应用程序容器永久冻结，并在云基础设施中造成全面的网络拒绝服务日志。 为确保您的部署流水线安全，Web...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

Important: Red Hat Security Advisory: xmlrpc-c security update

An update for xmlrpc-c is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...