PoC Week 2026-11-02
The most featured CVEs in this week’s security newsletters, with public Proof-of-Concepts, ordered by mention count.
For the most up-to-date and accurate info, visit the NIST links. Always audit PoCs thoroughly before running them. I don’t vouch for any links in this list: follow them with caution.
CVE-2026-111497
- Severity: 8.1 HIGH
- Impacted Products: Google Brotli 1.0.3 through 1.0.9, 1.1.0, 1.2.0, Node.js, Bun
- Description: Google Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0 are affected by an out-of-bounds write vulnerability in the decompression module that can lead to remote code execution. Downstream runtimes, proxies, and applications bundling or linking the library, including Node.js, Bun, Python Brotli packages, Microsoft .NET, Envoy Proxy, Istio, PHP for Windows, and Palo Alto Networks PAN-OS, are exposed to this flaw when decompressing untrusted Brotli data.
- Remediation:
- More Info: NVD - CVE-2026-111497
- PoC:
CVE-2026-109619
- Severity: 8.1 HIGH
- Impacted Products: PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, PHP 8.5 before 8.5.12, PHP 5.4 through 8.1
- Description: PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12, as well as legacy unsupported PHP branches from 5.4 through 8.1, contain a cross-request use-after-free vulnerability in worker request lifecycle and global state management across multiple server application programming interfaces (SAPIs), including Apache mod_php and PHP-FPM.
- Remediation:
- [R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2, 6.8.0, 6.9.1: SC-202610.2 - Security Advisory | Tenable®
- [R1] Stand-alone Security Patch Available for Tenable Enclave Security Versions 1.7.0, 1.8.0, 1.9.1: SC-202610.2 - Security Advisory | Tenable®
- Important: php security update
- More Info: NVD - CVE-2026-109619
- PoC:
CVE-2026-109618
- Severity: 8.1 HIGH
- Impacted Products: PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, PHP 8.5 before 8.5.12, PHP 5.4 through 8.1
- Description: PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12, as well as legacy unsupported PHP branches from 5.4 through 8.1, contain an Out-of-Memory (OOM) bailout state corruption and Use-After-Free (UAF) / uninitialized pointer dereference vulnerability in the core Zend Engine and extensions.
- Remediation:
- [R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2, 6.8.0, 6.9.1: SC-202610.2 - Security Advisory | Tenable®
- [R1] Stand-alone Security Patch Available for Tenable Enclave Security Versions 1.7.0, 1.8.0, 1.9.1: SC-202610.2 - Security Advisory | Tenable®
- Important: php security update
- More Info: NVD - CVE-2026-109618
- PoC:
CVE-2026-86950
- Severity: 8.8 HIGH
- Impacted Products: iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1, iOS 27
- Description: An out-of-bounds write vulnerability exists in the Apple CoreGraphics framework across iOS, iPadOS, and macOS. The flaw is caused by insufficient bounds checking when parsing graphical data within files.
- Remediation:
- More Info: NVD - CVE-2026-86950
- PoC:
CVE-2026-97785 NEW
- Severity: 10.0 CRITICAL
- Impacted Products: AAD App Proxy
- Description: Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
- Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
- More Info: NVD - CVE-2026-97785
- PoC:
CVE-2026-97229
- Severity: 10.0 CRITICAL
- Impacted Products: GitLab Community Edition (CE) 19.2.0 prior to 19.2.8, GitLab Enterprise Edition (EE) 19.2.0 prior to 19.2.8, GitLab Community Edition (CE) 19.3.0 prior to 19.3.5, GitLab Enterprise Edition (EE) 19.3.0 prior to 19.3.5, GitLab Community Edition (CE) 19.4.0 prior to 19.4.2
- Description: An integer overflow vulnerability exists in the CI/CD regular expression compiler in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.2.0 prior to 19.2.8, 19.3.0 prior to 19.3.5, and 19.4.0 prior to 19.4.2. The flaw occurs due to insufficient validation of regular expression repetition quantifiers and compiled bytecode program sizes when processing CI/CD configuration files.
- Remediation:
- More Info: NVD - CVE-2026-97229
- PoC:
CVE-2026-91403 NEW
- Severity: 9.1 CRITICAL
- Impacted Products: Oracle Java SE, Oracle GraalVM, OpenJDK
- Description: Oracle Java SE, Oracle GraalVM, and OpenJDK are vulnerable to cryptographic trust validation weaknesses within the Java Secure Socket Extension (JSSE) component. This issue stems from the inclusion of root certificate authorities that trust intermediate certificates associated with weak private keys, allowing attackers to conduct man-in-the-middle attacks against TLS connections.
- Remediation:
- More Info: NVD - CVE-2026-91403
- PoC:
CVE-2026-83938 NEW
- Severity: 10.0 CRITICAL
- Impacted Products: Microsoft Azure Kubernetes Configuration Service
- Description: Impact* A missing authentication vulnerability exists in Microsoft Azure Kubernetes Configuration Service. An unauthenticated remote attacker could exploit this issue over a network to bypass authentication controls and elevate privileges across the managed cloud service boundary. Detailed Description Microsoft Azure Kubernetes Configuration Service provides centralized cluster configuration and GitOps management for Azure Kubernetes Service and Azure Arc-enabled Kubernetes environments.
- Remediation:
- More Info: NVD - CVE-2026-83938
- PoC:
CVE-2026-111444 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: Wheels 4.1.2, Wheels 4.2.0
- Description: Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals.
- Remediation:
- More Info: NVD - CVE-2026-111444
- PoC:
CVE-2026-110264
- Severity: 10.0 CRITICAL
- Impacted Products: GitLab Community Edition, GitLab Enterprise Edition
- Description: GitLab Community Edition (CE) and Enterprise Edition (EE) contain an integer overflow vulnerability in the bundled Onigmo regular expression engine within Ruby when compiling regular expressions with a large number of range repeat quantifiers. Unauthenticated remote attackers can exploit this flaw by supplying a specially crafted document that triggers excessive range repeat compilation, resulting in an out-of-bounds memory write and arbitrary code execution as the service user.
- Remediation:
- More Info: NVD - CVE-2026-110264
- PoC:
CVE-2026-110063 NEW
- Severity: 10.0 CRITICAL
- Impacted Products: VM Inspector for Azure Virtual Machines
- Description: Improper link resolution before file access (’link following’) in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
- Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
- More Info: NVD - CVE-2026-110063
- PoC:
CVE-2026-105014 NEW
- Severity: 9.1 CRITICAL
- Impacted Products: Azure Pipelines
- Description: Improper neutralization of special elements used in a command (‘command injection’) in Azure Pipelines allows an unauthorized attacker to execute code over a network.
- Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
- More Info: NVD - CVE-2026-105014
- PoC:
CVE-2026-96656
- Severity: 7.2 HIGH
- Impacted Products: Plex Media Server
- Description: An arbitrary file write and dynamic library injection vulnerability exists in the transcoding and codec loading subsystem of Plex Media Server due to unsanitized passthrough of the
TranscoderH264Optionsserver preference tolibx264and unverified loading of shared libraries from theCodecsdirectory. - Remediation:
- More Info: NVD - CVE-2026-96656
- PoC:
CVE-2026-96655
- Severity: 4.3 MEDIUM
- Impacted Products: Plex Media Server
- Description: A server-side request forgery (SSRF) vulnerability exists in the Universal Transcoder HTTP service of Plex Media Server due to missing validation of the
pathquery parameter. An authenticated remote attacker can exploit this issue to induce the server and its transcoder subprocess to issue arbitrary outbound HTTP requests and ingest attacker-controlled XML media manifests and video streams. - Remediation:
- More Info: NVD - CVE-2026-96655
- PoC:
CVE-2026-96652
- Severity: 5.8 MEDIUM
- Impacted Products: Plex Media Server prior to version 1.43.3.10861
- Description: A server-side request forgery (SSRF) vulnerability exists in Plex Media Server prior to version 1.43.3.10861 within the Companion player timeline HTTP handlers (
/player/timeline/poll,/player/timeline/subscribe, and/player/timeline/unsubscribe). - Remediation:
- More Info: NVD - CVE-2026-96652
- PoC:
CVE-2026-9586
- Severity: 9.8 CRITICAL
- Impacted Products: Sangoma Switchvox SMB Edition versions prior to 8.4.0.2
- Description: Sangoma Switchvox SMB Edition is affected by an unauthenticated SQL injection vulnerability in its phone application and provisioning subsystem. A remote attacker can exploit this issue to achieve arbitrary code execution on the underlying PBX appliance.
- Remediation:
- More Info: NVD - CVE-2026-9586
- PoC:
CVE-2026-9198
- Severity: 9.8 CRITICAL
- Impacted Products: Langflow OSS
- Description: Langflow OSS allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
- Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
- More Info: NVD - CVE-2026-9198
- PoC:
CVE-2026-71362
- Severity: 9.1 CRITICAL
- Impacted Products: Adobe Commerce
- Description: Adobe Commerce is affected by an incorrect authorization vulnerability that allows a remote attacker to escalate privileges. An attacker can exploit this issue without requiring user interaction to gain unauthorized access to sensitive resources.
- Remediation:
- More Info: NVD - CVE-2026-71362
- PoC:
CVE-2026-68820 NEW
- Severity: 7.0 HIGH
- Impacted Products: Microsoft Windows
- Description: Microsoft Windows contains a use-after-free vulnerability in the Ancillary Function Driver for WinSock (afd.sys). A local, authenticated attacker can exploit this flaw to elevate their privileges on an affected system.
- Remediation:
- More Info: NVD - CVE-2026-68820
- PoC:
CVE-2026-66384
- Severity: 5.3 MEDIUM
- Impacted Products: JFrog Artifactory
- Description: JFrog Artifactory is affected by a path traversal vulnerability in its container and Docker remote repository caching service. This flaw allows an authenticated remote user to write data outside of the intended cache directory on the host filesystem.
- Remediation:
- More Info: NVD - CVE-2026-66384
- PoC:
CVE-2026-65400
- Severity: 9.8 CRITICAL
- Impacted Products: Apple macOS
- Description: Apple macOS contains an authentication bypass vulnerability in its Screen Sharing component that allows a network-based attacker to authenticate without providing valid credentials. This issue is caused by improper state management during the authentication protocol.
- Remediation:
- More Info: NVD - CVE-2026-65400
- PoC:
CVE-2026-64849
- Severity: Unknown
- Impacted Products: MLflow, prior to version 3.15.0
- Description: MLflow prior to version 3.15.0 is vulnerable to server-side request forgery (SSRF) in its webhook delivery mechanism. An unauthenticated attacker can exploit this flaw to bypass URL validation and perform unauthorized HTTP requests to internal services and cloud metadata endpoints.
- Remediation:
- More Info: NVD - CVE-2026-64849
- PoC:
CVE-2026-63077 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: JetBrains TeamCity prior to 2025.11.7, JetBrains TeamCity prior to 2026.1.3
- Description: JetBrains TeamCity is affected by an unauthenticated remote code execution vulnerability in its agent polling protocol prior to versions 2025.11.7 and 2026.1.3. An attacker can exploit this flaw to execute arbitrary system commands on the server.
- Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
- More Info: NVD - CVE-2026-63077
- PoC:
CVE-2026-59822
- Severity: 8.2 HIGH
- Impacted Products: LiteLLM prior to version 1.84.0
- Description: LiteLLM prior to version 1.84.0 contains an improper authentication vulnerability in its Model Context Protocol (MCP) streamable HTTP endpoints. An unauthenticated remote attacker can exploit this flaw using a fabricated Authorization header to bypass authentication controls and gain access to protected backend tools and models.
- Remediation:
- https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c
- fix(mcp): tighten public-route detection and OAuth2 fallback gating by stuxf · Pull Request #26463 · BerriAI/litellm · GitHub
- MCP Authentication Bypass via OAuth2 Passthrough Fallback · Advisory · BerriAI/litellm · GitHub
- More Info: NVD - CVE-2026-59822
- PoC:
CVE-2026-56291
- Severity: 10.0 CRITICAL
- Impacted Products: Balbooa Forms for Joomla
- Description: The Balbooa Forms extension for Joomla is affected by an unauthenticated arbitrary file upload vulnerability that allows for remote code execution. This flaw exists because the extension fails to validate file types or verify user authorization on its frontend upload endpoints.
- Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
- More Info: NVD - CVE-2026-56291
- PoC:
CVE-2026-56290
- Severity: 9.8 CRITICAL
- Impacted Products: Joomla extension Page Builder CK
- Description: The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
- Remediation:
- More Info: NVD - CVE-2026-56290
- PoC:
CVE-2026-55255
- Severity: 9.9 CRITICAL
- Impacted Products: Langflow
- Description: Langflow is affected by an Insecure Direct Object Reference (IDOR) vulnerability in the
/api/v1/responsesendpoint. This flaw allows an authenticated attacker to execute AI workflows belonging to other users by providing a victim’s flow identifier in the request. - Remediation:
- https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625291060e
- fix(security): close IDOR in get_flow_by_id_or_endpoint_name (LE-639) by erichare · Pull Request #12832 · langflow-ai/langflow · GitHub
- IDOR Vulnerability in
/api/v1/responsesEndpoint Allows Authenticated Attackers to Access Another User’s Flow · Advisory · langflow-ai/langflow · GitHub
- More Info: NVD - CVE-2026-55255
- PoC:
CVE-2026-49869
- Severity: 9.8 CRITICAL
- Impacted Products: Kestra OSS prior to versions 1.0.45 and 1.3.21
- Description: Kestra OSS prior to versions 1.0.45 and 1.3.21 contains an authentication bypass vulnerability that allows unauthenticated remote code execution. The flaw exists due to improper URL path validation within the application’s authentication filter.
- Remediation:
- More Info: NVD - CVE-2026-49869
- PoC:
CVE-2026-48939 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: iCagenda for Joomla
- Description: The iCagenda extension for Joomla is affected by an improper access control vulnerability in its file attachment feature that allows for unauthenticated arbitrary file uploads. This flaw enables a remote attacker to upload and execute malicious PHP scripts on the hosting server.
- Remediation:
- More Info: NVD - CVE-2026-48939
- PoC:
CVE-2026-48908
- Severity: 9.8 CRITICAL
- Impacted Products: JoomShaper SP Page Builder for Joomla
- Description: JoomShaper SP Page Builder for Joomla is affected by an improper access control vulnerability that allows unauthenticated attackers to upload and execute arbitrary PHP code. This flaw stems from insufficient authorization checks on the extension’s file upload interface.
- Remediation:
- More Info: NVD - CVE-2026-48908
- PoC:
CVE-2026-48282
- Severity: 9.8 CRITICAL
- Impacted Products: Adobe ColdFusion
- Description: Adobe ColdFusion is affected by a path traversal vulnerability in its Remote Development Services (RDS) component that allows for arbitrary file writes and remote code execution. This flaw enables an unauthenticated attacker to bypass directory restrictions and place malicious files on the host system.
- Remediation:
- More Info: NVD - CVE-2026-48282
- PoC:
CVE-2026-42018
- Severity: 7.5 HIGH
- Impacted Products: JFrog Artifactory prior to version 7.146.8
- Description: JFrog Artifactory is affected by an improper authentication vulnerability where internal anonymous-user tokens may be returned to unauthenticated callers even when anonymous access is disabled. This flaw can allow remote attackers to gain unauthorized access to sensitive resources.
- Remediation:
- More Info: NVD - CVE-2026-42018
- PoC:
CVE-2026-21589
- Severity: Unknown
- Impacted Products: Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Jira Service Management Data Center
- Description: Multiple Atlassian products, including Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Jira Service Management Data Center, Jira Software Data Center, Crucible, and Fisheye, are affected by a path traversal vulnerability that permits arbitrary file access. An unauthenticated remote attacker can exploit this flaw to read specific files located within the web application root directory.
- Remediation:
- CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products | Atlassian Support | Atlassian Documentation
- [BAM-26567] Arbitrary File Access in Bamboo Data Center - Create and track feature requests for Atlassian products.
- [BSERV-20604] Arbitrary File Access in Bitbucket Data Center - Create and track feature requests for Atlassian products.
- More Info: NVD - CVE-2026-21589
- PoC:
CVE-2026-20349 NEW
- Severity: 7.5 HIGH
- Impacted Products: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software
- Description: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software are affected by a denial-of-service vulnerability in the Remote Access SSL VPN service. An unauthenticated, remote attacker can exploit this issue by sending a specially crafted HTTP request to cause an affected device to reload unexpectedly.
- Remediation:
- More Info: NVD - CVE-2026-20349
- PoC:
CVE-2026-19490
- Severity: 10.0 CRITICAL
- Impacted Products: Citrix NetScaler ADC, Citrix NetScaler Gateway
- Description: Citrix NetScaler ADC and NetScaler Gateway contain an authentication bypass vulnerability that allows an unauthenticated remote attacker to gain unauthorized access to protected resources. The issue affects appliances configured as a Gateway or as an AAA virtual server under specific configurations.
- Remediation:
- More Info: NVD - CVE-2026-19490
- PoC:
CVE-2026-18577
- Severity: 6.8 MEDIUM
- Impacted Products: N-able N-central 2026.3.1
- Description: N-able N-central is affected by an authentication bypass vulnerability resulting from an incomplete patch for CVE-2026-18556. This flaw allows a remote, unauthenticated attacker to bypass authentication controls and achieve complete administrative account takeover on vulnerable systems.
- Remediation:
- More Info: NVD - CVE-2026-18577
- PoC:
CVE-2026-16232 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: Check Point SmartConsole
- Description: Check Point SmartConsole is affected by an authentication bypass vulnerability in its application token login process. This flaw allows an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges.
- Remediation:
- More Info: NVD - CVE-2026-16232
- PoC:
CVE-2026-15410
- Severity: 7.2 HIGH
- Impacted Products: SMA1000 Appliance Management Console
- Description: Post-authentication improper control of generation of code (‘Code Injection’) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
- Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
- More Info: NVD - CVE-2026-15410
- PoC:
CVE-2026-15409
- Severity: 10.0 CRITICAL
- Impacted Products: SMA1000 Appliance
- Description: A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
- Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
- More Info: NVD - CVE-2026-15409
- PoC:
CVE-2026-114625 NEW
- Severity: 9.9 CRITICAL
- Impacted Products: Arista VeloCloud Orchestrator
- Description: Arista VeloCloud Orchestrator (VCO) on-premises deployments contain an SQL injection vulnerability within the web-based management interface. An authenticated attacker with basic tenant privileges can exploit this flaw to escalate privileges to a local superuser operator role, invoke restricted internal orchestrator functionality, and impact the underlying VCO host.
- Remediation:
- More Info: NVD - CVE-2026-114625
- PoC:
CVE-2026-106173
- Severity: 9.8 CRITICAL
- Impacted Products: Fortinet FortiSIEM 7.5.0
- Description: A path traversal vulnerability exists in the
phQueryMasterdaemon of Fortinet FortiSIEM 7.5.0 that allows an unauthenticated remote attacker to write arbitrary files and execute arbitrary code or commands. - Remediation:
- More Info: NVD - CVE-2026-106173
- PoC:
CVE-2026-105134
- Severity: 7.2 HIGH
- Impacted Products: Ahsay Cloud Backup Suite (AhsayCBS) 7, Ahsay Cloud Backup Suite (AhsayCBS) 8, Ahsay Cloud Backup Suite (AhsayCBS) 9 (prior to version 9.15.2 hotfix build 70), Ahsay Cloud Backup Suite (AhsayCBS) 10 (up to and including version 10.3.4 server build 25, prior to hotfix build 45)
- Description: An operating system command injection vulnerability exists in the Replication Receiver component of Ahsay Cloud Backup Suite (
AhsayCBS) across release branches 7, 8, 9 (prior to version 9.15.2 hotfix build 70), and 10 (up to and including version 10.3.4 server build 25, prior to hotfix build 45). - Remediation:
- More Info: NVD - CVE-2026-105134
- PoC:
CVE-2026-101767 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: Oracle E-Business Suite 12.2.3 through 12.2.15
- Description: An SQL injection vulnerability exists in the Core component of Oracle Application Object Library within Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw resides in the Thin Client Framework (TCF) servlet endpoint at
/OA_HTML/AppsTCFServer, implemented byoracle.apps.fnd.tcf.SocketServer, which is permitted through the default Oracle E-Business Suite URL firewall configuration without authentication. - Remediation:
- More Info: NVD - CVE-2026-101767
- PoC:
CVE-2026-98432 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: Linux kernel
- Description: The Linux kernel is affected by a use-after-free vulnerability in its IPv4 networking subsystem. A race condition during the concurrent handling of TCP connection requests or request socket migration allows socket options to be deallocated while still referenced by another processing thread.
- Remediation:
- More Info: NVD - CVE-2026-98432
- PoC:
CVE-2026-97631 NEW
- Severity: 8.8 HIGH
- Impacted Products: TianoCore EDK II
- Description: TianoCore EDK II is affected by an out-of-bounds write vulnerability in its PXE Base Code driver during network boot operations over IPv4 and IPv6. An unauthenticated network attacker who sends crafted ICMP error messages can corrupt firmware memory prior to the operating system loading.
- Remediation:
- More Info: NVD - CVE-2026-97631
- PoC:
References
This list was scraped from the quite amazing and highly recommended newsletters below:
Thanks for reading! For corrections, omissions (e.g. newsletter recs) feel free to get in touch.