D-Link DIR-895L CVE-2026-100740 L2TP OOB Write Detection

Detects D-Link DIR-895L firmware A1102b07 and an exposed L2TP UDP/1701 service associated with CVE-2026-100740 Host Name AVP out-of-bounds write. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-100740 — D-Link DIR-895L L2TP Host Name AVP OOB write detection.""" from future import annotation...

D-Link DIR-895L L2TP Host Name AVP OOB Write (CVE-2026-100740)

Out-of-bounds one-byte NUL write in the L2TP control parser on D-Link DIR-895L firmware A1102b07 when the Host Name AVP length is 127 peerhostname128. Requires L2TP WAN role / exposed UDP 1701. Set confirm=true to send the crafted SCCRQ trigger on authorized lab targets only. !/usr/bin/env python...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

Copy Fail CVE-2026-31431 — Kubernetes Container Escape PoC...

CVE-2026-15390 Out-of-bounds write in Das U-Boot

Das U-Boot with CONFIGIPDEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit...

CVE-2026-15390

Das U-Boot is vulnerable to an out-of-bounds write when the CONFIG_IP_DEFRAG=y parameter is enabled. The root cause is a failure to clear the IP reassembly state after a complete datagram is delivered. An attacker capable of delivering fragmented IP traffic can achieve arbitrary code execution by...

CVE-2026-15390 Out-of-bounds write in Das U-Boot

Das U-Boot with CONFIGIPDEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit...

CVE-2026-8066

A directory traversal vulnerability exists in the file upload functionality of the Hitachi Energy RTU500 . This flaw allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Successful exploitation may lead to the unauthorized modification of device data...

EUVD-2026-88669

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in...

CVE-2026-8066

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in...

CVE-2026-102474 Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write o...

CVE-2026-102474 Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write o...

CVE-2026-102474

A heap out-of-bounds write vulnerability exists in dash within the conv_escape function. The printf builtin incorrectly reserves only four bytes for converting Unicode \u or \U escapes , even though multi-byte tokens may require five or six bytes. A local user can trigger this by supplying such e...

CVE-2026-102474

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write o...

CVE-2026-96440

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...

CVE-2026-91012

org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...

CVE-2026-96440

Flowring Agentflow 4.0 (versions prior to 2023/03/24) is vulnerable to a Path Traversal flaw in the /WebAgenda/download/uploadFile.jsp API endpoint. This vulnerability allows remote authenticated users to write files to arbitrary locations outside the intended upload directory by manipulating the...

EUVD-2026-88665

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...

CVE-2026-96440 Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...

CVE-2026-96440 Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...

CVE-2026-82455

This flaw has been rejected by upstream RubyGems maintainers Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or...