Finding Vulnerabilities Via LLM-Augmented Semantics-Aware Type-Checking

Vulnerability detection via static analysis traditionally relies on security experts encoding insecure coding patterns into algorithmic rules. However, this approach often focuses on syntactic patterns and overlooks deeper semantic information in the code, such as the meanings of variable and...

GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE

A newly disclosed zero-day flaw in GeoServer is seeing active exploitation efforts, per watchTowr. The vulnerability, which has yet to be assigned a CVE identifier, is an SQL injection vulnerability in the open-source platform that can lead to remote code execution RCE. The security defect remain...

CVE-2026-19025

A flaw was found in HDF5. An attacker can craft a malicious HDF5 file that, when opened and read by an application, exploits a validation bypass. This bypass, related to mismatched chunk-layout dimensionality and dataspace rank, leads to a divide-by-zero error, causing a denial of service DoS and...

SUSE CVE-2026-68164

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

SUSE CVE-2026-68165

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

SUSE CVE-2026-68388

In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3simplefallocaterange can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled,...

JLSEC-2026-1305

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A floating point exception FPE due to an integer divide by zero was found in Exiv2 versions v0.27.4 and earlier. The FPE is triggered when Exiv2 is used to print the metadata...

ALPINE-CVE-2026-53792

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially craft...

AZL-95786 CVE-2026-53792 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially craft...

CVE-2026-53792

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially craft...

CVE-2026-53792 rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially craft...

CVE-2026-53792

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially craft...

CVE-2026-53792 rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially craft...

CVE-2026-53792 rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially craft...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

brutus v1.11.0

Brutus "Et tu, Brute?" — The last words before credentials fall. Modern credential testing tool in pure Go Installation • Quick Start • Pipeline • Protocols • Enumeration • Proxy • Library Overview Brutus is a multi-protocol authentication testing tool designed to address a critical gap in...

SUSE CVE-2026-68106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, widthinmb or heightinmb becomes 0, leading to fsinmb being 0. This causes a division by zero when calculating numdpbbuffer in H264...

CVE-2026-52054

findopt zero-length PPP option -- infinite loop...

PT-2026-80547

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A floating point exception FPE due to an integer divide by zero was found in Exiv2 versions v0.27.4 and earlier. The FPE is triggered when Exiv2 is used to print the metadata...

PT-2026-71630

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An out-of-bounds read exists in the sender-side block matching logic. A malicious receiver can trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a...