php2shell-scan

php2shell-scan Go A deliberately limited, read-only sec...

Updated iperf package fixes security vulnerabilities

Iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion. CVE-2026-71217 Unbounded peer-controlled allocation in iperf3 jsonread allows unauthenticated remote memory exhaustion. CVE-2026-71218 Iperf3 3.21 esnet/iperf contains a...

Node.js HTTP/2 Reentrant Send Use-After-Free Checker

Node.js contains an HTTP/2 reentrant send heap use-after-free vulnerability. This offline proof of concept checker assesses operator-supplied Node.js version evidence for potentially affected 22.x, 24.x, and 26.x releases...

Microsoft Windows 10 20H2 HTTP.sys Use-After-Free

Microsoft Windows 10 versions 2004 and 20H2 and Windows Server versions 2004 and 20H2 contain an HTTP.sys use-after-free vulnerability. The supplied proof of concept sends a malformed Accept-Encoding header to trigger a crash on an unpatched listener. https://packetstorm.news/download/237474...

Amazon Linux 2023 : libreswan (ALAS2023-2026-3253)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3253 advisory. A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate...

Amazon Linux 2023 : tigervnc, tigervnc-icons, tigervnc-license (ALAS2023-2026-3262)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3262 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-3267)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3267 advisory. During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object. CVE-2026-92392 Tenable h...

Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2026-3261)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3261 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2026-3260)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3260 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again...

Amazon Linux 2023 : firefox (ALAS2023-2026-3281)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3281 advisory. Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. CVE-2026-100766 Sandbox...

MiracleLinux 9 : kernel-5.14.0-687.59.1.el9_8 (AXSA:2026-2149:105)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2149:105 advisory. kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send...

Exploit for Use After Free in Microsoft

CVE-2021-31166 PoC — Safe Triage Tools Author: testerxmaht...

Exploit for CVE-2026-64560

RootKit · Jailbreak Assistant Flutter + Shizuku ⚠️ Rea...

python: Fix of CVE-2026-6100

CVE-2026-6100: fix a use-after-free in the bz2 and zlib modules when a decompressor object is reused after a MemoryError; the input pointer to the released caller buffer is no longer kept, so a later decompressobj.flush as done by gzip.GzipFile at EOF cannot read it...

curl:curl_fuzzer_proto_smtp: Heap-use-after-free in Curl_client_cleanup

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=4561124654383104 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerprotosmtp Job Type: libfuzzerasancurl Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x7bd59f9e43b...

kernel: net/sched: serialize qdisc_rtab_list against concurrent get/put

A flaw was found in the Linux kernel's networking scheduler component. A race condition exists in the handling of rate tables qdiscrtablist due to a lack of proper locking during concurrent operations. A local attacker could exploit this by sending specially crafted network filter requests, leadi...

kernel: net/iucv: fix use-after-free of a severed iucv_path

A flaw was found in the Linux kernel. This use-after-free vulnerability exists in the net/iucv component. When a peer severs a connection, message notifications that still reference the freed connection path remain in a queue. A subsequent attempt to process these stale notifications can lead to...

kernel: ipvs: reload ip header after head reallocation

A flaw was found in the Linux kernel's IP Virtual Server IPVS module. When processing network packets, a buffer reallocation can leave an IP header pointer referencing freed memory. An attacker could exploit this use-after-free condition to cause a Denial of Service DoS by crashing the system or...

kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release()

A flaw was found in the Linux kernel's USB subsystem usbfs. An unprivileged local attacker with read/write access to a /dev/bus/usb node could exploit a use-after-free vulnerability. This occurs because the usbdevice structure is prematurely freed before all pending operations are completed...

kernel: fuse: re-lock request before replacing page cache folio

A flaw was found in the Linux kernel's Filesystem in Userspace FUSE component. The fusetrymovefolio function, responsible for managing page cache folios, fails to re-lock a request after initially unlocking it on a successful path. This oversight allows another function, fusechanabort, to...