Overview
Description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: account for fraggap on the paged allocation path
In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as
alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;
datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and the copy writes past skb->end into the trailing
skb_shared_info.
An unprivileged user can trigger this via a UDPv6 socket using
MSG_MORE together with MSG_SPLICE_PAGES.
The bad accounting was introduced by commit 773ba4fe9104 ("ipv6:
avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix
__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative
copy value caused -EINVAL to be returned. That later commit allowed
MSG_SPLICE_PAGES to proceed in this case, making the corruption
triggerable.
The non-paged branch sets alloclen to fraglen, which already accounts
for fraggap because datalen does. Bring the paged branch in line by
adding fraggap to alloclen and subtracting it from pagedlen.
After this adjustment, copy no longer collapses to -fraggap on the
paged path, so remove the stale comment describing that old arithmetic.
Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES
case, remove the MSG_SPLICE_PAGES exception from the negative copy check.
Statistics
- 3 Posts
- 3 Interactions
Last activity: 10 hours ago
Fediverse
Critical CVE-2026-53362 Linux kernel privilege escalation actively exploited. Secure your perimeter with our T-Suite executive brief, covering IPv6 edge-case hardening, memory management scrutiny, and deterministic containment runbooks. Command the wire with The Cyber Mind Co™. 🛡️
https://thecybermind.co/jily
Bluesky
OpenAI Agents Exploited Linux Kernel Flaw on Company’s Own Systems
CISA has added the exploited flaw, CVE-2026-53362, to its KEV catalog, alongside a JFrog vulnerability exploited by OpenAI agents.
Telegram AI Digest
#ai #aiagents #openai
Overview
- PaperCut
- PaperCut MF/NG
28 Aug 2026
Published
29 Aug 2026
Updated
CVSS v4.0
CRITICAL (9.4)
EPSS
0.46%
KEV
Description
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
Statistics
- 3 Posts
Last activity: 14 hours ago
Fediverse
PaperCut Under Active Attack: Full Technical Analysis of the Pre-Auth RCE Chain (CVE-2026-81578 + CVE-2026-82078)
Active exploitation of PaperCut NG/MF pre-auth RCE (CVE-2026-81578, CVE-2026-82078). Full chain analysis, IOCs, detection & emergency patch guidancehttps://thecybersecguru.com/news/papercut-cve-2026-81578-cve-2026-82078-pre-auth-rce-analysis/
📰 PaperCut Zero-Day RCE Actively Exploited; Emergency Patches Released
🚨 URGENT: PaperCut warns of an actively exploited zero-day RCE vulnerability chain affecting all NG/MF versions. The pre-auth flaws (CVE-2026-81578, CVE-2026-82078) allow full server takeover. Patch immediately! #Cybersecurity #ZeroDay #PaperCut
Overview
- PaperCut
- PaperCut MF/NG
28 Aug 2026
Published
29 Aug 2026
Updated
CVSS v4.0
HIGH (8.8)
EPSS
0.39%
KEV
Description
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
Statistics
- 3 Posts
Last activity: 14 hours ago
Fediverse
PaperCut Under Active Attack: Full Technical Analysis of the Pre-Auth RCE Chain (CVE-2026-81578 + CVE-2026-82078)
Active exploitation of PaperCut NG/MF pre-auth RCE (CVE-2026-81578, CVE-2026-82078). Full chain analysis, IOCs, detection & emergency patch guidancehttps://thecybersecguru.com/news/papercut-cve-2026-81578-cve-2026-82078-pre-auth-rce-analysis/
📰 PaperCut Zero-Day RCE Actively Exploited; Emergency Patches Released
🚨 URGENT: PaperCut warns of an actively exploited zero-day RCE vulnerability chain affecting all NG/MF versions. The pre-auth flaws (CVE-2026-81578, CVE-2026-82078) allow full server takeover. Patch immediately! #Cybersecurity #ZeroDay #PaperCut
Overview
- MongoDB
- BI Connector ODBC Driver
28 Aug 2026
Published
28 Aug 2026
Updated
CVSS v4.0
MEDIUM (6.0)
EPSS
0.20%
KEV
Description
An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.
Statistics
- 1 Post
- 2 Interactions
Last activity: 13 hours ago
Overview
- iot-ecology
- rust-iot-platform
29 Aug 2026
Published
29 Aug 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
Pending
KEV
Description
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.
Statistics
- 1 Post
- 1 Interaction
Last activity: 3 hours ago
Overview
- MongoDB
- BI Connector
28 Aug 2026
Published
28 Aug 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
0.24%
KEV
Description
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.
Statistics
- 1 Post
- 1 Interaction
Last activity: 14 hours ago
Overview
- MongoDB
- BI Connector
28 Aug 2026
Published
28 Aug 2026
Updated
CVSS v4.0
HIGH (8.3)
EPSS
0.24%
KEV
Description
A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, proceeds without a valid result, ending the schema refresh routine. The mongosqld process continues running without a usable schema, so SQL clients are unable to obtain results until an operator removes the view or excludes its namespace from sampling.
Statistics
- 1 Post
- 1 Interaction
Last activity: 17 hours ago
Overview
Description
IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Statistics
- 1 Post
- 1 Interaction
Last activity: 10 hours ago
Overview
- Graylog2
- graylog2-server
28 Aug 2026
Published
28 Aug 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.36%
KEV
Description
Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3.
Statistics
- 1 Post
- 1 Interaction
Last activity: 16 hours ago
Overview
Description
free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by internal/sbi/processor/ue_authentication.go creates an AusfUeContext, and AddAusfUeContextToPool executes ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext), unconditionally replacing the active context for that SUPI. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI, causing all attempts to share one logical authentication context URL while K_aut, XRES, and EapID are repeatedly overwritten. A valid EAP-AKA' response for an earlier challenge is then checked against the latest context, causing AT_MAC verification to fail and denying authentication to the selected subscriber while the request flood continues. No fixed version is available as of this review.
Statistics
- 1 Post
- 1 Interaction
Last activity: 11 hours ago