Cve

CVE-2026-105723 Field Detail CVE CVE-2026-105723 CVSS 7.5 (HIGH) Product microsoft/windows_10_1607 Published 2026-10-13 Homelab Impact 🔴 High Description Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network. References https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105723

CVE-2026-93302 Field Detail CVE CVE-2026-93302 CVSS 8.2 (HIGH) Product wolfssl/wolfssl Published 2026-09-27 Homelab Impact 🔴 High Description MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEER_CERT and load CA certificates with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The peer must know the certificates being loaded to either of those APIs to take advantage of the issue. When OPENSSL_COMPATIBLE_DEFAULTS is also defined this widens the affected API to include all CA certificate loading. Both macros are defined when using autoconf builds such as (nginx, haproxy, stunnel, wpas, apache httpd, hitch, bind, rsyslog, ffmpeg, all, distro). When the certificate is listed as a trusted peer certificate the issue previously allowed for a malicious (D)TLS server to bypass authentication once knowing which CA’s the client would accept. This also affects mutual authentication cases where the client knows which CA’s the server has loaded. If building with any of these configurations and using (D)TLS where the loaded CA’s could be known and authentication of the peer is desired, users should either: update to the latest wolfSSL version, apply the fix patch, or use the configure flag –disable-openssl-compatible-defaults and not load CA’s with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert() to mitigate the issue. ...

Overview Attribute Value CVE CVE-2026-64564 Name SCTPhantom Type Use-After-Free (UAF) → Local Privilege Escalation + Container Escape CVSS 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Affected Linux kernel 2.6.25 → 7.1.x (introduced 2007, ~18 years) Fixed 6.6.148, 6.12.101, 6.18.42, 7.1.6, mainline 7.2-rc5 Researcher Tencent Zhuque Lab (via Corvus AI pipeline) PoC ✅ Public (reproducible exploit demonstrated) CISA KEV ❌ Not yet listed Patch ✅ Upstream (mainline commit 9b2854f86f0b) What Is SCTPhantom? SCTPhantom is a use-after-free in the Linux kernel’s SCTP (Stream Control Transmission Protocol) Dynamic Address Reconfiguration implementation. An attacker who can reach the SCTP stack can trigger a stale-pointer dereference that leads to full root on the host — and, critically, escape a container to compromise the underlying host. ...

CVE-2026-69264 Field Detail CVE CVE-2026-69264 CVSS 9.8 (CRITICAL) Product flowiseai/flowise Published 2026-08-04 Homelab Impact 🔴 High Description Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import, the attacker can break out of the Python string literal, hand a JavaScript string to js.eval, dynamically import Node built-in modules such as fs and child_process, and execute arbitrary file I/O or OS commands as the Flowise process. The two validator paths around this code, validatePythonCodeForDataFrame and validateCustomReadCSVFunction, are never applied to the bootstrap template. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a CSV Agent node with a crafted csvFile; once the chatflow is exposed via POST /api/v1/prediction/:id, any unauthenticated request triggers host remote code execution. This issue is fixed in version 3.1.3. ...

CVE-2026-70477 Field Detail CVE CVE-2026-70477 CVSS 9.8 (CRITICAL) Product flowiseai/flowise Published 2026-08-04 Homelab Impact 🔴 High Description Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed Pyodide environment. The specific flaw exists within the run method of the CSV_Agents class, where untrusted data is used to construct an LLM prompt and the resulting pythonCode is validated by validatePythonCodeForDataFrame before execution. An attacker can leverage this to execute arbitrary code in the context of the service account. This issue is fixed in 3.1.3. ...

CVE-2026-43871 Field Detail CVE CVE-2026-43871 CVSS 7.5 (HIGH) Product apache/thrift Published 2026-07-27 Homelab Impact 🔴 High Description Loop with Unreachable Exit Condition (‘Infinite Loop’) vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. References https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 https://lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qby http://www.openwall.com/lists/oss-security/2026/07/24/33

CVE-2026-44181 Field Detail CVE CVE-2026-44181 CVSS 10.0 (CRITICAL) Product jupyter/enterprise_gateway Published 2026-07-16 Homelab Impact 🔴 High Description Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, prior to 3.3.0, the environment variables (KERNEL_XXX) used during the rendering of the Kubernetes manifest are vulnerable to Server Side Template Injection (SSTI). By including Jinja2 template expressions it is possible to execution Python code and OS Commands in the Enterprise Gateway service. The code can use or steal the Kubernetes service account token, which can steal Kubernetes secrets and be used to fully compromise the Kubernetes cluster by scheduling a privileged pod or a pod with a hostPath volume mount. This issue has been fixed in version 3.3.0. ...

CVE-2026-44182 Field Detail CVE CVE-2026-44182 CVSS 10.0 (CRITICAL) Product jupyter/enterprise_gateway Published 2026-07-16 Homelab Impact 🔴 High Description Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g., duplicate securityContext keys, where the last one prevails), and inject document boundaries (— for new documents, … for end-of-document) to generate multiple resources, potentially creating arbitrary types, such as privileged pods. The Jinja2 template for the Kubernetes manifest contains several kernel_xxx variables, such as kernel_working_dir that are used when rendering the manifest and are all vectors for YAML injection. This issue has been fixed in version 3.3.0. ...

GhostLock: The 15-Year-Old Linux Kernel Bug AI Found Hiding in Plain Sight TL;DR An AI-powered security agent discovered a Linux kernel vulnerability that has existed in every major distribution since 2011. It allows any unprivileged local user to gain full root access with a 97% success rate. There is no practical mitigation — patch your kernel. Attribute Detail CVE CVE-2026-43499 CVSS 3.1 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE CWE-416 (Use After Free) Affected Linux 2.6.39 through 7.0 Fixed Linux 7.1 (commit 3bfdc63936dd) Stable backports 6.1.177, 6.6.144, 6.12.95, 6.18.36, 7.0.13 Not backported 5.15.y, 5.10.y LTS Discovered by VEGA AI Agent (Nebula Security) Bounty $92,337 (Google kernelCTF) Prerequisites Local access, no special privileges, CONFIG_FUTEX_PI=y What Is GhostLock? GhostLock (CVE-2026-43499) is a use-after-free vulnerability in the Linux kernel’s real-time mutex (rtmutex) priority-inheritance code. Specifically, it lives in the remove_waiter() function in kernel/locking/rtmutex.c. ...

CVE-2026-45063 Field Detail CVE CVE-2026-45063 CVSS 9.1 (CRITICAL) Product sensiolabs/symfony Published 2026-07-14 Homelab Impact 🔴 High Description Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER[‘SSL_CLIENT_S_DN’] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12. ...