Testing race conditions with memory access tracing and stack-based delay injection

Posted by Jann Horn Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: Confirming bug candidates that have been discovered manually or through static...

PT-2026-87052

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

ALSA-2026:64787 Moderate: xz security update

XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm LZMA, which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fixes: xz: XZ Utils:...

EulerOS 2.0 SP12 : lxc (EulerOS-SA-2026-3357)

According to the versions of the lxc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the findline function that allows an...

EulerOS 2.0 SP12 : nghttp2 (EulerOS-SA-2026-3286)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

EulerOS 2.0 SP12 : nghttp2 (EulerOS-SA-2026-3361)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

Fedora 44 : baresip / libre (2026-27c291e67c)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-27c291e67c advisory. Baresip v4.11.0 2026-08-25 - core: cleanup streamrtph ignore handling - audio: increase RTP timestamp also for underruns - aubuf: remove adaptive mode -...

PT-2026-87059

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth algo header value. When the algorithm cannot be mapped to a...

PT-2026-88179

🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — September 9, 2026 1️⃣ CPANEL EMAILTRACK SQL INJECTION LEADS TO ROOT A critical flaw in cPanel CVE-2026-67401 turns the EmailTrack feature into a full remote-code-execution path: a regular authenticated cPanel account with mail privileges can abuse...

Linux Distros Unpatched Vulnerability : CVE-2026-79603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used...

NewStart CGSL MAIN 7.02 : tongsuo Multiple Vulnerabilities (NS-SA-2026-0106)

The remote NewStart CGSL host, running version MAIN 7.02, has tongsuo packages installed that are affected by multiple vulnerabilities: - Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may...

cjose -- Use of Hard-coded Cryptographic Key

https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq reports: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm...

CVE-2026-68138

CVE-2026-68138 — Linux 内核 net/sched qdisc 速率表 UAF 跟踪站点 CVE-2026-68138 补丁状态跟踪器的来源：一个单页站点，记录哪些发行版已为 Linux 内核中 net/sched qdisc 速率表的释放后使用 / 双重释放（use-after-free / double-free）漏洞发布了修复。 事实所在 关于该漏洞的所有信息——CVE ID、受影响版本和已修复版本、上游修复提交、发现与披露致谢，以及当前各发行版的补丁状态——均属于跟踪器页面，而非本 README： 渲染页面：...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ テスト中 このPoCは活発にテストおよび改良中です。機能はリリースごとに変更される可能性があります。 CVE-2026-3180 WordPress Contest Gallery — 認証不要のブラインドSQLインジェクション CVE-2026-3180の概念実証評価ツール 作者: Sudeepa Wanigarathna · 発見: cardosource !IMPORTANT 認可された使用のみ。...

gradient-untangler

gradient-untangler A local research harness that searches for the exact tokens that make an open-weight language model start its answer the way you specify. Open-weight models ship as ordinary files: config.json, a tokenizer, and one or more .safetensors or .bin shards. A Hugging Face id is only ...

yj_nearbyglasses v1.0.10

yjnearbyglasses attempting to detect smart glasses nearby and warn you. ⚠ WARNING! ⚠ nearby-glasses-alert.pages.dev is NOT RELATED TO MY PROJECT. Many apps in Play Store and App Store look or are even called very similar to Nearby Glasses. They seem to hijack the name and try to make a quick prof...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-0865 DESCRIPTION: User-controlled header names and values containing newlines can allow injecting HTTP headers. CWE:CWE-74: Improper Neutralization of...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-39883 DESCRIPTION: OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin iore...

DIRTYFAIL

DIRTYFAIL Copy Fail および Dirty Frag Linux ページキャッシュ書き込み脆弱性ファミリーのための統合検出器および PoC ハーネス。 ██████╗ ██╗██████╗ ████████╗██╗ ██╗███████╗ █████╗ ██╗██╗ ██╔══██╗██║██╔══██╗╚══██╔══╝╚██╗ ██╔╝██╔════╝██╔══██╗██║██║ ██║ ██║██║██████╔╝ ██║ ╚████╔╝ █████╗ ███████║██║██║ ██║ ██║██║██╔══██╗ ██║ ╚██╔╝ ██╔══╝...

log4shell-scanner

log4shell-scanner 一个零依赖的 Log4Shell 防御性扫描器 —— 查找易受攻击的 log4j-core jar，并在日志和配置中发现 JNDI 利用模式。 为什么做这个项目 在我于 CERT-In 轮岗期间，我从事威胁识别、遏制、修复和威胁狩猎工作 —— 这正是 Log4Shell（CVE-2021-44228）在 2021 年 12 月大规模爆发时所需的工作流程：在整个服务器群中找出每一个易受攻击的 log4j-core 工件，并在日志中搜索 $jndi:... 利用尝试。本扫描器将这一防御性工作流程重现为一个单一、可移植、仅使用标准库的 Python...