Latest vulnerabilities published by Sqlite

Ce dépôt présente une analyse technique approfondie de la CVE-2026-98432, une vulnérabilité de type Use-After-Free (UAF) dans la pile TCP IPv4 du noyau Linux, accompagnée d'un outil de détection réseau nommé netprobe.

TL;DR Google has promoted Chrome 157 to the stable channel with 213 security fixes. This Chrome security update brings version 157.0.8103.38 to Linux and 157.0.8103.38/.39 to Windows and Mac. Seven of the flaws are rated critical. Chrome 157 patches seven critical memory bugs in graphics and rendering code, plus 77 high-severity flaws. Google has not said any of them are exploited in the wild.

https://blog.gslin.org/archives/2026/11/01/13313/linux-%e9%80%99%e6%ac%a1-mptcp-%e7%9a%84-use-after-free-%e6%bc%8f%e6%b4%9e-cve-2026-98432/ Linux 這次 MPTCP 的 Use-after-free 漏洞 (CVE-2026-98432) #advisory #kernel #linux #mitigation #mptcp #multipath #network #patch #security #sysctl #tcp #ubuntu #UseAfterFree #vulnerability

Cet article constitue une analyse technique approfondie de la vulnérabilité CVE-2026-98432, affectant le noyau Linux dans son chemin de traitement TCP IPv4. CVE-2026-98432 est un use-after-free dans le chemin de handshake TCP IPv4 du noyau Linux.

Cet article constitue une analyse technique approfondie de la vulnérabilité CVE-2026-98432, affectant le noyau Linux dans son chemin de traitement TCP IPv4. CVE-2026-98432 est un use-after-free dans le chemin de handshake TCP IPv4 du noyau Linux.

TL;DR Google released Chrome 155.0.8059.84/.85 on October 15, 2026, with fixes for 10 vulnerabilities. This Chrome security update patches one critical use after free bug in Prerender and six high-severity flaws. Google reports no exploitation in the wild. Why It Matters Memory bugs in a browser can let a malicious web page run code or crash the tab. Notably, three of the seven critical and high bugs sit in V8, Chrome's JavaScript engine.

TL;DR Google released Chrome 155.0.8059.79/.80 on October 13, 2026, with fixes for 37 security flaws. This Chrome security update includes seven critical bugs, led by a buffer overflow in the ANGLE graphics layer. Google has not reported any of these bugs as exploited. Why It Matters Chrome is the world's most used browser, so its bugs reach a huge audience. Browser memory flaws are a common first step in attack chains.

TL;DR Google has promoted Chrome 155 to the Stable channel with 247 security fixes. The Chrome 155 security update patches four Critical use-after-free bugs and at least 53 High-severity flaws. Google has not reported any of them as exploited in the wild. Why It Matters A batch of 247 fixes is unusually large for one browser release. Chrome runs on billions of devices, so each memory bug is a wide target.

TL;DR A researcher published RustyTux, a working proof-of-concept for a Linux kernel privilege escalation flaw. It abuses an ESP-in-TCP use-after-free race in the strparser and espintcp code. Both the vulnerability details and the exploit code are now public. No exploitation in the wild has been confirmed. Why This Linux Kernel Privilege Escalation Matters The espintcp module ships in kernels from many major distributions.

TL;DR A Linux kernel vulnerability, tracked as CVE-2026-68162, affects the SCTP networking code. It rates CVSS 7.8. Researchers at NebuSec have published proof-of-concept exploit code that escalates a local user to root on Ubuntu 26.04. Why It Matters Root access gives an attacker full control of a machine. This Linux kernel vulnerability turns a low-privileged local account into that outcome. With public exploit code now available, the risk to unpatched systems rises quickly.

TL;DR A critical Redis vulnerability, tracked as CVE-2026-81934, allows remote code execution on TLS-enabled servers. It carries a CVSS score of 9.2. Full technical details and working proof-of-concept exploit code are now publicly available. Why It Matters Redis powers caching and data storage for countless applications. This Redis vulnerability needs no authentication and no prior access. A remote attacker can run arbitrary commands as the Redis server user.

Una macchina virtuale dovrebbe essere una fortezza isolata dal sistema che la ospita. Con #Zapscape, però, quell'isolamento può saltare: una nuova, ennesima, vulnerabilità #useafterfree in #KVM può permettere di passare dal guest all'host e arrivare persino all'esecuzione di codice con privilegi root. E in alcuni scenari il salto può essere ancora più diretto: da semplice utente locale a root. Vediamo come funziona Zapscape e perché la nested virtualization rende tutto ancora più "interessante".

TL;DR Researchers published full details and proof-of-concept exploit code for CVE-2026-53361, a use-after-free in the Linux kernel AF_UNIX garbage collector. The flaw allows an unprivileged local user to escape a container and corrupt kernel memory. Multiple stable and enterprise kernels are affected, and patches are now available. Why It Matters This CVE-2026-53361 container escape bug needs no special privileges. Any local user with a shell can trigger it.

TL;DR Researchers published proof-of-concept exploit code for a Redis RCE vulnerability. The heap use-after-free lets a remote user run system commands as the Redis server process. Redis fixed the flaw in version 8.8.2. Why it matters Redis powers caching and messaging for countless apps. A single compromised server can expose application data, session tokens, and internal network access. This Redis RCE vulnerability turns normal commands into full server takeover.

TL;DR CVE-2026-52912 is a use-after-free flaw in the Linux kernel's netfilter nf_queue code. It carries a CVSS score of 7.8. Researchers at Nebula Security have publicly disclosed the vulnerability details and released proof-of-concept exploit code that escalates to root. Why It Matters Local attackers care about one thing: getting root. This flaw gives them a path. A public exploit lowers the bar for real…

TL;DR Google shipped a Chrome Stable channel update with seven security fixes. The most severe, CVE-2026-76017, is a critical use-after-free flaw in Chromoting. Google reports no exploitation in the wild for any of the seven bugs. Why It Matters Chrome runs on billions of desktops worldwide. A memory-safety bug there gives attackers a wide target. This critical use-after-free flaw earns the update urgent attention.

TL;DR A researcher released proof-of-concept exploit code for CVE-2026-68138, a race condition in the Linux kernel traffic-control code. The flaw lets a local user escalate to root on affected systems. Public details and a working PoC are now available on GitHub. The bug carries a CVSS score of 7.0. Why It Matters This CVE-2026-68138 privilege escalation bug needs no administrator rights to start.

Google has released Chrome 149 to fix 18 security vulnerabilities, including four critical and 14 high-severity flaws, with most of the issues tied to use-after-free bugs that could potentially enable remote code execution. The update is now rolling out for Windows, macOS, and Linux, and Google has not reported any active...