CVE-2026-49878

In wpashandlerobustavscsrecvaction of robustav.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-92600

In wpashandlerobustavscsrecvaction of robustav.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49878

In wpashandlerobustavscsrecvaction of robustav.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49878

A logic error in the wpas_handle_robust_av_scs_recv_action function within robust_av.c results in a possible out-of-bounds write . This vulnerability could potentially lead to remote code execution requiring System execution privileges . Exploitation does not require user interaction. No specific...

MAL-2026-17624 Malicious code in documenclient (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffd20318a8d48dc20fee95097373ebd1039481031985164a651d2b68d366565a [email protected] publishes an npm package whose only shipped content is a heavily obfuscated PowerShell script embedded in the README. The script...

CVE-2026-90364

A flaw was found in the Linux kernel's ACPI Advanced Configuration and Power Interface processor initialization. During the setup process, if certain driver registration or CPU hotplug state configurations fail, a cpufreq notifier may remain improperly registered. This improper resource cleanup c...

CVE-2026-37719

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...

Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by a cross-site request forgery vulnerability (CVE-2026-8408)

Summary A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager CVE-2026-8408 Vulnerability Details CVEID:CVE-2026-8408 DESCRIPTION: IBM WebSphere Application Server is affected by a cross-site request forgery,...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 7.2.6 to 7.2.8, 6.1.188 to 6.2, 6.6.157 to 6.7, 6.12.110 to 6.13, 6.18.52 to 6.19, and 7.3-rc1. These vulnerabilities stem from the use of the IRQ-safe XArray auxiliary function during the creation of QP and CQ tables. As a result,...

USN-8871-1: Linux kernel (Raspberry Pi) vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

USN-8851-3: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system NFS server daemon; - IPv6 networking; - Netfilter; CVE-2025-38724, CVE-2026-53131, CVE-2026-532...

Windows Print Spooler RCE (PrintNightmare CVE-2021-34527)

Exploits CVE-2021-34527 PrintNightmare: abuses MS-RPRN RpcAddPrinterDriverEx to register a remote printer driver pointing at an attacker-controlled UNC DLL, executing code as SYSTEM when the Print Spooler service processes the install. !/usr/bin/env python3 -- coding: utf-8 -- """Windows Print...

Ruby on Rails YAML Deserialization RCE (CVE-2013-0156)

Exploits CVE-2013-0156 in Rails 3.x: XML requests with type=yaml deserialize attacker-controlled YAML into Ruby objects, reaching Kernelsystem via Gem gadgets. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails XML/YAML deserialization RCE CVE-2013-0156.""" from kittysploit import from...

kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

A flaw was found in the Linux kernel's netfilter component, specifically within the nfqueue functionality. When a bridged packet is queued to NFQUEUE, it can retain a reference to a bridge's private fake destination 'dst' even after the bridge teardown has begun. This can lead to a use-after-free...

kernel: ipvs: clear the svc scheduler ptr early on edit

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. During the ipvseditservice operation, the svc-scheduler pointer is cleared too late when unbinding an old scheduler. This improper handling allows packets to access previously freed scheduler data, leading to a use-after-fre...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: NFS: Fixed an oopsable condition in nfspageioaddrequest. Ensured that nfspageioerrorcleanup resets the mirror array contents, so that the structure reflects the fact that it is now empty. Also changed the test in...

Security Bulletin: Kernel privilege escalation and disclosure Vulnerabilities in Linux in IBM Cloud Pak System[CVE-2026-46300, CVE-2026-46333, CVE-2026-43284]

Summary Multiple vulnerabilities in the Linux kernel affect the underlying operating system used by Platform system Manager PSM and OS Image for Red Hat Enterprise Linux Systems shipped with Cloud Pak System, . These issues include a local privilege escalation flaw in the networking subsystem...

kernel: nvme: add missing SRCU grace period in error path

A flaw was found in the NVMe Non-Volatile Memory Express driver of the Linux kernel. The nvmeallocns function's error handling path fails to wait for all SRCU Sleepable Read-Copy Update readers to complete before freeing a namespace structure. This oversight allows a concurrent reader to access a...

kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active

A flaw was found in KVM Kernel-based Virtual Machine. When the Advanced Virtual Interrupt Controller AVIC is inhibited while a nested guest L2 is active, KVM fails to properly update x2APIC MSR intercepts for the primary guest L1. This allows the L1 guest to read the host's APIC state, send...

Security Bulletin: Due to AIX, IBM Cloud Pak System is affected by NULL pointer dereference vulnerability

Summary Due to AIX, IBM Cloud Pak System is affected by NULL pointer dereference vulnerability. Vulnerability was addressed in OS Image for AIX IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2025-49795 DESCRIPTION: A NULL pointer dereference vulnerability was found in libxm...