CVE-2026-61688 SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...

CVE-2019-8601

Explotando CVE-2019-8601 Este es un exploit para una vulnerabilidad de WebKit que fue descubierta originalmente por Fluoroacetate durante la competencia pwn2own en Vancouver. Aunque no descubrí este error, escribí este exploit para practicar mis habilidades de desarrollo de exploits. El artículo...

CVE-2026-84961

A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security TLS certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently...

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

GHSA-W7WX-5Q49-R59W CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

henkaku

Compilación Solo se admite Linux. Necesitarás: Python 3 Vita SDK Uglify JS paquete node-uglify de Ubuntu 16.04 versión probada 2.4.15 Otras herramientas estándar que ya deberías tener instaladas, como openssl, dd, cat, touch Todas las herramientas deben estar en tu PATH. Ejecuta ./build.sh para...

cve-2020-9373-netgear-r6400

CVE-2020-9373 — Netgear R6400 upnpd Stack Overflow Research A complete three-phase study of the historical Netgear R6400 router vulnerability CVE-2020-9373 UPnP upnpd stack buffer overflow, SSDP on UDP port 1900, unauthenticated RCE/DoS. Three Phases 1. Phase 1 · Reproduction : firmware unpacking...

RAGSieve

RAGSieve Reference implementation for “RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation.” RAGSieve detects knowledge-poisoning documents at two control points in a retrieval-augmented generation RAG system. RAGSieve-Query RSQ is an online...

AZL-99489 CVE-2026-80872 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

DEBIAN-CVE-2026-80872

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

CVE-2026-80872

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

The hidden work of modernizing Malwarebytes

Most of the work that keeps a security product trustworthy is invisible. Users see a scan complete, a threat blocked, an update applied overnight. They don’t see the platform underneath. Runtimes, managed libraries, native drivers, and Windows requirements must all stay current and work together...

CVE-2026-41567

CVE-2026-41567 1day Un 1-day para la fuga de Docker CVE-2026-41567. Es una demostración de fuga de Docker usando xz / unpigz troyanizados. Se puede modificar fácilmente para usarse de forma remota es decir, solo tienes que cambiar la IP predeterminada de docker por una C2 remota. Más información...

CVE-2026-80872

CVE-2026-80872 affects the Linux kernel 's ALSA HDA TAS2781 driver (I2C and SPI variants). The TAS2781 driver queues RCA firmware loading via request_firmware_nowait(), whose async callback uses driver-private HDA state. During component unbind, controls and DSP state are removed immediately, and...

CVE-2026-80872 ALSA: hda/tas2781: Cancel async firmware request at unbind

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

EUVD-2026-71502

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

CVE-2026-80872 ALSA: hda/tas2781: Cancel async firmware request at unbind

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

CVE-2026-80872

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

Security Bulletin: Watson Machine Learning on Cloud Pak for Data is affected by net/url (Publicly disclosed vulnerability) ( CVE-2025-47912)

Summary Watson Machine Learning on Cloud Pak for Data is affected by CVE-2025-47912 Vulnerability Details CVEID:CVE-2025-47912 DESCRIPTION: The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6...

DEBIAN-CVE-2026-80828

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usbaudioresume jumps to errout when sndusbpcmresume or sndusbmixerresume fails. The error path skips th...