Published vulnerability research
Archive / All years
Every published finding, from newest to oldest.
CVE-2026-58099
A race in kqueue copy-on-fork marker handling could access freed kernel memory, potentially allowing an unprivileged local user to escalate privileges.
CVE-2026-58100
A race in kqueue copy-on-fork descriptor handling could read beyond the child's file descriptor table, potentially allowing an unprivileged local user to escalate privileges.
CVE-2026-58098
Semaphore identifier reuse after sequence-number wraparound could cause semop(2) to access kernel heap memory out of bounds, potentially allowing an unprivileged local user to escalate privileges.
GHSA-v34g-p68p-f5cm
A guest-kernel UDP heap overflow could be chained with an integer overflow in the host 9p backend to escape Ant's Linux x86-64 KVM sandbox and execute attacker-controlled commands in the host Ant process.
CVE-2026-58095
An incorrect length calculation in mp_Enddisc() could allow a malicious PPP peer to overflow a global result buffer through a received multilink endpoint discriminator option.
CVE-2026-58096
Missing minimum-length validation in LcpDecodeConfig() could allow a malicious PPP peer to trigger an out-of-bounds write with an undersized multilink endpoint discriminator option.
CVE-2026-58097
Missing length validation in mp_SetEnddisc() could allow a local user with access to the ppp(8) command interface to overflow a buffer through a user-supplied PSN endpoint value.
CVE-2026-58085
An authentication-validation flaw in the FreeBSD WireGuard driver that could allow forged or modified transport packets to be accepted under specific network conditions.
GHSA-9c9q-5rj5-mjj2
An authenticated console user could retrieve another tenant's uploaded document preview when the file identifier was known because the preview path did not enforce tenant ownership.