tiny_tracer

tinytracer A Pin Tool for tracing: API calls, including input and output of selected functions defined local functions, and functions from statically linked libraries selected instructions: RDTSC, CPUID, INT inline system calls, including parameters of selected syscalls transition between section...

PoC-CVE-2025-63406

CVE-2025-63406 – Prueba de Concepto PoC de Investigación de Seguridad Este repositorio contiene una Prueba de Concepto PoC orientada a la investigación relacionada con el problema de seguridad CVE-2025-63406 , que afecta a la plataforma GroupOffice. El propósito de este proyecto es estudiar y...

The vulnerability of Google Chrome’s ViewTransitions component, which allows a hacker to gain unauthorized access to protected information

The vulnerability of the ViewTransitions component in Google Chrome browser is related to the use of an unauthorized intermediate policy file. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

SUSE CVE-2026-62436

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

CVE-2026-64545 net, bpf: check master for NULL in xdp_master_redirect()

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdpmasterredirect xdpmasterredirect dereferences the result of netdevmasterupperdevgetrcu without a NULL check, but that helper returns NULL when the receiving device has no upper-master...

CVE-2026-64474

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

Linux Distros Unpatched Vulnerability : CVE-2026-64474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states...

CVE-2026-48014

Summary: CVE-2026-48014 affects Shopware open commerce platforms prior to 6.6.10.18 and 6.7.10.1, where Admin API order state transition routes (/api/_action/order/{orderId}/state/{transition} and related endpoints) could bypass ACL checks. The routes did not declare PlatformRequest::ATTRIBUTE_AC...

CVE-2026-48014 Shopware: Admin API ACL Bypass in Order State Transition Endpoints

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/action/order/orderId/state/transition and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare...

BIT-JOOMLA-2026-48955 Joomla! Core - [20260709] - Incorrect Access Control in com_workflow

An improper access check allows unauthorized users to access workflow stage and transition information...

CVE-2026-48955

The CVE concerns Joomla! Core, specifically the com_workflow component. Affected: Joomla core workflows. Root cause: improper access check allows unauthorized users to access workflow stage and transition information. Impact: disclosure of workflow stage/transition details due to weak access cont...

CVE-2026-48955 Joomla! Core - [20260709] - Incorrect Access Control in com_workflow

An improper access check allows unauthorized users to access workflow stage and transition information...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/rds: There is no shortcut for exiting from RDSCONNERROR. RDS connections have a state called “rdsconnpath::cpstate”, and they transition between states based on the expected state “rdsconnpathtransition”. There is one excepti...

CVE-2026-48782 pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix, CVE-2026-46678...

CVE-2026-11646

An use after free flaw was found in the ViewTransitions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517168239...

SUSE CVE-2026-11646

Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-35246

Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-11646

Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-11646

Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-11646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT...