CVE-2026-108789

A vulnerability exists in deepseek-ai deepseek-harness up to version 0.1.1-rc.2 . The flaw specifically affects the agent function within the dsh-workflow-worker-thread component. The root cause involves improper enforcement of behavioral workflow and business logic errors (CWE-841, CWE-840), whi...

CVE-2026-108789 deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly...

Linux kernel recv_done p9_cm_event_handler Data Compromise

The vulnerability of the recvdone and p9cmeventhandler functions in the net/9p/transrdma.c file of the Linux kernel is related to the implementation of incorrect thread management. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibilit...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791741836)

"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791741836 advisory. - In the Linux kernel, the following vulnerability has been resolved: vhost: fix hung thread due to erroneous iotlb entries In...

CVE-2026-108952: Access of Resource Using Incompatible Type

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rxringbuffer as a Serial V2 rtserialrxfifo in functionenable. A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members...

CVE-2026-108789: Improper Enforcement of Behavioral Workflow

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly...

Linux same_client_has_lease() Function Use-After-Free

The vulnerability of the sameclienthaslease function in the fs/smb/server/oplock.c component of the Linux operating system is related to the improper implementation of thread management. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibili...

slowloris

slowloris.py - Slowloris simple en Python ¿Qué es Slowloris? Slowloris es básicamente un ataque de Denegación de Servicio HTTP que afecta a servidores con hilos. Funciona así: 1. Comenzamos a hacer muchas solicitudes HTTP. 2. Enviamos encabezados periódicamente cada 15 segundos para mantener las...

KaynStrike

KaynStrike A User Defined Reflective Loader for Cobalt Strike Beacon that spoofs the thread start address and frees itself after entry point was executed. Thread Start Address spoofing Reflective Loader cleanup Proof How to use this Just load the KaynStrike.cna agressor script and build a stagele...

idacode

IDACode IDACode facilita la ejecución y depuración de scripts de Python en su entorno IDA sin salir de Visual Studio Code. La extensión de VS Code se puede encontrar en el marketplace. IDACode aún se encuentra en una etapa muy temprana y se espera que haya errores. Por favor, abra un nuevo issue ...

keystone

Keystone Engine Keystone ist ein leichtgewichtiges, plattform- und architekturübergreifendes Assembler-Framework. Es bietet einige unvergleichliche Funktionen: Multi-Architektur, mit Unterstützung für Arm, Arm64 AArch64/Armv8, Ethereum Virtual Machine, Hexagon, Mips, PowerPC, RISC-V, Sparc, Syste...

CVE-2026-19737: NULL Pointer Dereference

i2sesp32triggercheck in drivers/i2s/i2sesp32.c validates the requested direction only for I2SDIRBOTH. The I2SDIRRX and I2SDIRTX branches read devcfg-rx.data-configured / devcfg-tx.data-configured without first checking the stream pointers. The device instantiation macro I2SESP32STREAMINIT sets bo...

vulns

Segnalazioni di vulnerabilità Avvisi di HN Security. https://hnsecurity.it/ Solaris HNS-2022-01-dtprintinfo. Diverse vulnerabilità in Solaris dtprintinfo e libXm/libXpm CVE-2022-46285, CVE-2023-24039, CVE-2023-24040. Zyxel HNS-2022-02-zyxel-zysh. Diverse vulnerabilità in Zyxel zysh CVE-2022-26531...

CVE-2026-19575

A type confusion vulnerability exists in the device_deinit() system call within the Zephyr kernel (kernel/device.c ). The verification handler z_vrfy_device_deinit() incorrectly uses K_OBJ_ANY , causing k_object_validate() to skip type comparisons. This allows a user-mode thread to pass an arbitr...

K000163606: Apache Tomcat vulnerability CVE-2026-78383

Security Advisory Description Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1...

CVE-2026-107574

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N...

CVE-2026-107572

Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the match...

CVE-2026-107579 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by...

CVE-2026-107575

Progressive Robot hMailServer versions 6.3.4 and 6.3.5 are vulnerable to an inefficient algorithmic complexity flaw in the SPF macro expansion. A remote unauthenticated attacker can consume worker-thread time by publishing a crafted SPF record where the domain-spec expands via macros to a name ex...

CVE-2026-107575 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels...