508 matches found
criPPLe
criPPLe Windows kernel driver that removes Process Protection PP and Process Protection Light PPL. This was made with the help of Zero-Point Security's "Offensive Driver Development course" This kernel driver removes the process protection from a given pid, it gets a pointer to the process's...
Astra Linux - Vulnerability in libjdom1-java, libjdom2-java
A XXE vulnerability exists in SAXBuilder in JDOM through version 2.0.6, allowing attackers to cause a denial of service through a crafted HTTP request...
Astra Linux – Vulnerability in exiv2
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was discovered in Exiv2 versions v0.27.4 and earlier. This infinite loop occurs when Exiv2 is used to modify the metadata of a specially crafted image file. ...
Astra Linux – Vulnerability in Tomcat9
There is a vulnerability related to improper input validation in Apache Tomcat. Tomcat did not restrict HTTP/0.9 requests to only the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, users could bypass this constraint on GET requests by...
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
Vulnerability The hybrid ML-KEM 768 + X25519 key exchange implementation in russh/src/kex/hybridmlkem.rs does not validate that the remote peer's X25519 public key is not the zero point all-zero 32-byte value. This allows a remote peer to force the X25519 contribution to the combined shared secre...
GHSA-W3JG-PJXF-73P4 Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
Vulnerability The hybrid ML-KEM 768 + X25519 key exchange implementation in russh/src/kex/hybridmlkem.rs does not validate that the remote peer's X25519 public key is not the zero point all-zero 32-byte value. This allows a remote peer to force the X25519 contribution to the combined shared secre...
CVE-2026-102824
The Russh Rust SSH client and server library (prior to version 0.63.0 ) contains a vulnerability in the hybrid ML-KEM 768 and X25519 key exchange implementation. The root cause is a missing zero-point validation in russh/src/kex/hybrid_mlkem.rs, which allows the library to accept an all-zero 32-b...
CVE-2026-102824 Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybridmlkem.rs accepts an all-zero 32-byte peer X25519 public key in both serverdh and computesharedsecret, forcing the X25519 contribution to the combined shared secre...
CVE-2026-102824 Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybridmlkem.rs accepts an all-zero 32-byte peer X25519 public key in both serverdh and computesharedsecret, forcing the X25519 contribution to the combined shared secre...
Astra Linux – Vulnerability in Thunderbird
Ribose RNP before version 0.16.3 may hang when the input is malformed...
Security Bulletin: Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path
Summary Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can...
SUSE CVE-2026-70628
FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...
CVE-2026-66686
Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...
CVE-2026-19010
Technical details about CVE-2026-19010 are not publicly available in the provided documents; monitor for updates.
CLSA-2026-1773360975 TuxCare security update for ms (2 CVEs)
TuxCare rebuilt ms to address 2 CVEs. Fixed in 0.3.0-tuxcare.1...
JLSEC-2026-1118
A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikonloadpaddedpackedraw of the file src/decoders/decoderslibraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument loadflags/rawwidth can lead to out-of-bounds read. It is possible to launch the...
CVE-2026-15601 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...
CLEANSTART-2026-SC64306 Security fixes in prom-mysqld-exporter-fips 0.18.0-r3
Package prom-mysqld-exporter-fips version 0.18.0-r3 fixes 10 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...
CLEANSTART-2026-OH83140 Security fixes in trust-manager-fips 0.20.3-r0
Package trust-manager-fips version 0.20.3-r0 fixes 6 vulnerabilities: CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2025-61730, CVE-2025-61726...