CVE-2026-89698 nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

EUVD-2026-76610

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

CVE-2026-89489

CVE-2026-89489 affects the Linux kernel on the OpenRISC (or1k) architecture. The sys_or1k_atomic() syscall (number 244) swaps two user-supplied pointers via hand-written assembly but fails to validate them with access_ok() , and the four memory operations lack exception table entries. An unprivil...

EUVD-2026-76395

In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1katomic syscall sysor1katomic syscall 244 in the "or1k" ABI takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0r4 l.lwz...

secpub

Cisco Nexus OS NX-OS - Problemas de "inyección" de comandos / saneamiento. Descubierto por: Peter Adkins [email protected] Acceso: Local; se requiere acceso autenticado. Seguimiento e identificadores: CVE - CVE-2011-2569 Sistemas operativos afectados: Cisco Nexus OS NX-OS Participación del...

cve-2024-31317

Exploración de CVE-2024-31317 CVE-2024-31317 proporciona acceso sin privilegios a cualquier uid y ámbito SELinux disponible para aplicaciones de Android legítimas. Esto proporciona acceso al uid 1000 system y uid 2000 shell, y puede activarse completamente desde una aplicación sin privilegios,...

GeoServer Demo Request Endpoint - Server Side Request Forgery

It is possible to achieve Server Side Request Forgery SSRF via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to...

CVE-2023-2002

Linux 蓝牙：未授权管理命令执行 CVE-2023-2002 在 Linux 内核的蓝牙子系统中处理 HCI 套接字的 ioctl 系统调用时，发现了一个权限检查不足的问题。这导致没有适当 CAPNETADMIN 权限的任务可以轻易地将 HCI 套接字标记为受信任。受信任的套接字旨在允许发送和接收管理命令和事件，例如与新设备配对或连接。因此，无特权的用户可以获得一个受信任的套接字，从而导致未授权执行管理命令。利用此漏洞只需要存在一组常用的 setuid 程序（例如 su、sudo）。 原因 该漏洞的直接原因如下代码片段： root@kitploit: static int...

PT-2026-90414

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd genl rqstp address fields to sockaddr storage struct nfsd genl rqstp declares rq daddr and rq saddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsd genl rpc status compose msg cast...

PT-2026-90106

In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decap and validate pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet,...

Vulnerable-Docker-Engine

CVE-2021-41091 Este exploit ofrece un análisis detallado de la vulnerabilidad de seguridad CVE-2021-41091 y proporciona una guía paso a paso sobre cómo utilizar el script de exploit para lograr una escalada de privilegios en un host. Resumen de la Vulnerabilidad CVE-2021-41091 es una falla en Mob...

CVE-2023-42791_CVE-2024-23666

Fortimanager 授权检查不足 CVE-2024-23666 与无限制文件上传 CVE-2023-42791 利用脚本 提供两个利用这些漏洞的脚本： rce.py：从低权限访问 FortiManager 获得反向 Shell 或添加任意管理员。 ManagerGate.py：允许连接到远程管理的 FortiGate SSH 服务。仍需要 SSH 密码，但可从 FortiManager 配置备份中找到。...

CVE-2022-1972-infoleak-PoC

CVE-2022-1972 信息泄露 PoC 针对 CVE-2022-1972 的信息泄露利用。 您可以在我们的博客上找到相关的分析文章。 环境要求 必须为非特权用户提供可用的用户命名空间。 root@kitploit: $ sysctl kernel.unprivilegedusernsclone kernel.unprivilegedusernsclone = 1 构建 root@kitploit: make...

CVE-2026-68833

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack...

CVE-2026-28867-PoC

CVE-2026-28867 工作原理 该漏洞的存在是因为内核在实现 tcpsysctlinfo 时，对连接执行全局查找，但未验证发起调用的进程是否拥有该套接字，或是否具有 root 等提升权限。 影响 无特权的攻击者可以获取当前的 32 位序列号（如 SND.NXT 和 RCV.NXT），包括针对 root 或系统守护进程（如 apsd、trustd、cloudd）。...

CVE-2022-0847

CVE-2022-0847 Linux “Dirty Pipe” vulnerability gives unprivileged users root access...

serviceDetector

serviceDetector Detectar si un servicio está instalado a ciegas y/o en ejecución si expone named pipes en una máquina remota sin utilizar privilegios administrativos locales. Acerca de En más detalle, ejecutar este script se conecta al servicio SMB del objetivo 445/tcp de forma remota y hace lo...

AZL-99530 CVE-2026-80824 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed async URBs, but that drain path reads back through the same object:...

CVE-2026-74237

GFI Exinda AI versions before 7.6.5 contain an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command from user-supplied server and options parameters without sanitization, allowing injection of arbitrary iperf flags. An ...

Linux Distros Unpatched Vulnerability : CVE-2026-80824

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed asy...