Overview
Description
In the Linux kernel, the following vulnerability has been resolved:
sctp: don't free the ASCONF's own transport in DEL-IP processing
sctp_process_asconf() caches the transport the ASCONF chunk is processed
against in asconf->transport (== chunk->transport, set once in sctp_rcv()).
For an ASCONF located through its Address Parameter by
__sctp_rcv_asconf_lookup(), that cached transport corresponds to the
Address Parameter, which need not be the packet's source address.
sctp_process_asconf_param() rejects a DEL-IP for the packet source address
(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport.
A single ASCONF can therefore carry, in order:
[Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]
where L differs from the source. The DEL-IP for L passes the D8 check and
calls sctp_assoc_rm_peer() on the transport that asconf->transport still
points at, freeing it (RCU-deferred). The following wildcard DEL-IP then
reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and
sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed
transport (->ipaddr, ->state) and plants the dangling pointer into
asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping
only the pointer that is no longer on the list, removes every real
transport, leaving the association with a transport_count of 0 and
primary_path/active_path pointing at freed memory.
Reject a DEL-IP that targets the transport the ASCONF is being processed
against, mirroring the existing source-address guard, so the wildcard
branch can never reuse a freed transport.
Statistics
- 3 Posts
- 15 Interactions
Last activity: 1 hour ago
Fediverse
The SCTPhantom vulnerability, CVE-2026-64564, affects Linux SCTP code and can be exploited for root access and container escape.
https://linuxiac.com/18-year-old-linux-kernel-vulnerability-enables-root-access-and-container-escape/
Overview
- MSI
- Radix AXE6600
08 Aug 2026
Published
08 Aug 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
1.35%
KEV
Description
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.
Statistics
- 2 Posts
- 1 Interaction
Last activity: 10 hours ago
Fediverse
CVE-2026-71987: MSI Radix AXE6600 (v781521) suffers from a CRITICAL OS command injection vulnerability (CVSS 9.3). Remote, unauthenticated code execution possible with root privileges. Restrict device access and monitor! https://radar.offseq.com/threat/cve-2026-71987-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-46b78b0439cf6545 #OffSeq #CVE202671987 #Infosec #RouterSecurity
Overview
- WordPress
- WordPress
07 Aug 2026
Published
07 Aug 2026
Updated
CVSS v4.0
HIGH (8.9)
EPSS
0.77%
KEV
Description
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.
This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
Statistics
- 2 Posts
- 12 Interactions
Last activity: 7 hours ago
Overview
- hapifhir
- org.hl7.fhir.core
07 Aug 2026
Published
07 Aug 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.28%
KEV
Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.
Statistics
- 1 Post
- 1 Interaction
Last activity: 15 hours ago
Overview
- wupsales
- AI Copilot – Content Generator
08 Aug 2026
Published
08 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.61%
KEV
Description
The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover by saving and executing a malicious workflow containing a wp_create_user action node specifying role=administrator. This vulnerability is exploitable by unauthenticated attackers on any site where the [aiwu-form] shortcode or public chatbot is rendered on a frontend page, as the waic-nonce value is emitted into publicly accessible JavaScript (WAIC_DATA.waicNonce) on those pages, rendering the nonce check a non-functional authorization barrier.
Statistics
- 1 Post
- 1 Interaction
Last activity: 9 hours ago
Fediverse
CVE-2026-14526 - Critical auth bypass in AI Copilot WordPress plugin. Unauthenticated attackers can create admin accounts and take over sites. CVSS 9.8. Unpatched. Disable plugin now. #CVE #WordPress #infosec
Overview
- D-Link Corporation
- DWR-M961
08 Aug 2026
Published
08 Aug 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
2.09%
KEV
Description
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.
Statistics
- 1 Post
- 1 Interaction
Last activity: 13 hours ago
Overview
- Dell
- OpenManage Server Administrator Managed Node (Patch) for Windows
07 Aug 2026
Published
08 Aug 2026
Updated
CVSS v3.1
HIGH (7.7)
EPSS
0.31%
KEV
Description
Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
Statistics
- 1 Post
- 1 Interaction
Last activity: 12 hours ago
Overview
- thomaspoignant
- scim-patch
07 Aug 2026
Published
07 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
0.25%
KEV
Description
`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch,
`Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. Version 0.9.1 contains a patch. A workaround is available. Calling `Object.freeze(Object.prototype)` (and the same on `Array.prototype`, `Function.prototype`) at process startup neutralizes this class of bug — assignment to a frozen prototype becomes a silent no-op in sloppy mode or a `TypeError` in strict mode. Node's `--frozen-intrinsics` flag does this for built-ins automatically.
Statistics
- 1 Post
- 1 Interaction
Last activity: 16 hours ago
Overview
- MSI
- Radix AXE6600
08 Aug 2026
Published
08 Aug 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
1.35%
KEV
Description
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.
Statistics
- 1 Post
Last activity: 21 hours ago
Fediverse
MSI Radix AXE6600 routers (v781521) impacted by CVE-2026-71989: CRITICAL OS command injection (CVSS 9.3) in porTrigger/alg enables unauthenticated root command execution. Patch status unknown. Details: https://radar.offseq.com/threat/cve-2026-71989-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-0ff15d6b83145a7e #OffSeq #Vuln #CVE202671989 #RouterSecurity
Overview
- Kingston
- FURY CTRL RGB Control Software
10 Aug 2026
Published
10 Aug 2026
Updated
CVSS v4.0
HIGH (8.5)
EPSS
Pending
KEV
Description
A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys of the component Driver. Performing a manipulation results in improper privilege management. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Statistics
- 1 Post
Last activity: 2 hours ago
Fediverse
Kingston FURY CTRL RGB Control Software v2.0.65.0 hit by HIGH severity vuln (CVE-2026-19381, CVSS 8.5). Local attackers can escalate privileges via NTIOLib_KSFX.sys. Exploit code is public; no patch yet. Restrict local access, monitor systems. https://radar.offseq.com/threat/cve-2026-19381-improper-privilege-management-in-kingston-fury-ctrl-rgb-control-software-9a62169aad70214d #OffSeq #Vuln #Kingston