AIDE through 0.19.4 can ignore hashes containing a null byte
A local user can match a stored hash up to the first 0x00 byte and hide a changed file.
Stories per day · 30 days
2 RSS
Relatedaide1ai-generated1apache1authenticated1control-panel1detection-bypass1full-disclosure1hash-comparison1integrity-monitoring1mailing-list1nvd1oss-security1overflow1rainerscript1rce1rsyslog1syslog1vestacp1
14 stories, newest first · one card per story
Stories tagged #ghsa
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
oss-security contributors propose digests or a separate list to manage a flood of AI vulnerability reports.
VestaCP <= 0.9.8-26: authenticated config-parser eval sinks -> root RCE (VESTACP-2026-001)
Full Disclosure reports authenticated root RCE in VestaCP 0.9.8-26 via config-parser eval sinks.
rsyslog RainerScript replace() output length overflow (GHSA-48f2-29wv-5jgc)
rsyslog disclosed a RainerScript replace() output-length overflow that default small-message configurations do not expose.
[cups] Multiple security fixes in incoming new version 2.4.20
CUPS 2.4.20 will ship multiple security fixes under a revised disclosure policy.
Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers
Fortbridge showed authenticated WordPress HEIC uploads can exploit libheif and execute code in PHP-FPM.
Critical libheif Vulnerability Could Enable Remote Code Execution Through WordPress Image Uploads
A critical libheif heap overflow, fixed in 1.23.3, enabled authenticated WordPress RCE via crafted HEIC uploads.
Kiteworks Patches 126 Vulnerabilities in Massive Security Update
Kiteworks fixed 126 vulnerabilities, including critical account takeover and code execution, in releases before version 9.5.1.
1
ModSecurity Vulnerabilities Let Attackers Bypass Web Application Firewall Protections
New ModSecurity flaws let attackers bypass WAF rules via parsing mismatches, bad Base64 handling, and comment obfuscation.
1
Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests
ModSecurity flaws let attackers bypass WAF filename, transformation, and response-body checks.
2
Re: JIT buffer overflow fixed in libpcre2-10.49
A mailing-list reply points to the GitHub advisory for a JIT buffer overflow fixed in libpcre2 10.49.
JIT buffer overflow fixed in libpcre2-10.49
PCRE2 10.49 fixes a JIT out-of-bounds write that needs an attacker-controlled regular expression.
Re: Flatpak 1.18.1 fixes multiple vulnerabilities
MITRE assigned CVE-2026-96808 and CVE-2026-96807 to Flatpak flaws fixed in 1.18.1.
Re: xdg-dbus-proxy: GHSA-r7hp-698j-2h6c: broadcast message filtering bypass
xdg-dbus-proxy broadcast filtering bypass is now tracked as CVE-2026-93676.