Search: rx.the

When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bridge/bridge_input.c decides how each frame received on a bridge member interface is handled. For frames that must also be delivered to the local stack, the code called eth_bridge_handle_locally() and returned NET_OK. That helper does not consume the packet — it only calls bridge_iface_recv() (via virtual_recv()), which returns NET_CONTINUE without taking ownership of pkt. The NET_OK verdict then propagates through ethernet_recv() up to processing_data() in subsys/net/ip/net_core.c, where NET_OK is interpreted as "the packet was consumed, do not free it." Because no consumer actually took ownership, the RX net_pkt is never returned to the pool and is leaked. The concretely reproducible leak occurs for frames whose EtherType has no registered L3 handler when CONFIG_NET_ETHERNET_FORWARD_UNRECOGNISED_ETHERTYPE is set (default y when CONFIG_NET_SOCKETS_PACKET is enabled): the fall-through L3 dispatch does not overwrite the NET_OK verdict, so ethernet_recv() returns NET_OK and the buffer is never released. Any device on a bridged L2 segment can emit broadcast/multicast frames carrying an arbitrary EtherType with no authentication. Each such frame permanently consumes one buffer from the finite RX pool (CONFIG_NET_PKT_RX_COUNT), so a brief broadcast flood exhausts the pool and the device can no longer receive traffic until it is rebooted — a persistent denial of service. There is no confidentiality or integrity impact. The fix makes eth_bridge_handle_locally() propagate the real net_verdict and return NET_CONTINUE for locally-kept frames, writing the bridge interface back through a new dst_iface out-parameter so the packet follows the normal receive path and is unreferenced exactly once.

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

A cross-site scripting (XSS) vulnerability exists in the Select schema plugin of @pdfme/schemas versions before 5.5.9. The vulnerability arises from improper sanitization of option values before inserting them into HTML using innerHTML, allowing attackers to execute arbitrary JavaScript in users' browsers via crafted templates.

A command injection vulnerability exists in D-Link DIR-825M version 1.1.8 in the sub_456CF4 function of /boafrm/formSysCmd. This flaw allows remote attackers with limited privileges to manipulate the sysCmd argument and execute arbitrary system commands. The vulnerability has a CVSS 3.1 score of 7.4, indicating a high impact on confidentiality, integrity, and availability. Exploit code has been publicly disclosed, but no known active exploitation in the wild is reported. No patch or official remediation information is currently available.

The PyPI package 'tronlinker' version 0.0.1 is identified as malicious software designed to exfiltrate private keys. It appears related to the cryptocurrency Tron (TRX) ecosystem. The package may impersonate legitimate libraries by cloning their readme files and has been repeatedly uploaded to PyPI under similar names. There are no known reports of active exploitation in the wild at this time.

The npm package 'cloudfcrxz' was found to contain malicious code or dependencies with malicious code. Installing or running this package can lead to a full compromise of the affected computer. Secrets and keys stored on the compromised system should be rotated immediately from a different, clean machine. Removal of the package alone may not eliminate all malicious software introduced by it.

The npm package 'cloufcrxz' was found to contain malicious code or a dependency with malicious code. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system should be rotated immediately from a different machine. Removing the package alone may not fully remediate the compromise due to potential persistent malicious software.

CVE-2026-82550 is a medium severity vulnerability in Linux Foundation Magma version 1.9.0. It involves improper input validation in the NGSetupRequest Handler component when manipulating the NG-IoT-DefaultPagingDRX argument. The flaw allows remote exploitation without requiring privileges or user interaction. Public exploit code is available, but no official patch or remediation has been announced by the vendor.

The PyPI package 'trongridor' version 0.0.1 is identified as malicious software designed for private key exfiltration, likely targeting cryptocurrency assets related to Tron (TRX). The package mimics legitimate libraries by cloning their readme files and has been repeatedly uploaded to PyPI under similar names. There are no known active exploitations in the wild at this time.

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through version 3.9 contains a cross-site scripting (XSS) vulnerability. It fails to sanitize or escape custom header/footer script values saved via its post metabox. This allows users with contributor-level access and above to inject JavaScript that executes in the browsers of administrators reviewing the post and visitors after publication.

This update includes the following RPMs: glibc: * compat-libpthread-nonshared-2.43-8.3.hum1 (aarch64, x86_64) * glibc-2.43-8.3.hum1 (aarch64, x86_64) * glibc-all-langpacks-2.43-8.3.hum1 (aarch64, x86_64) * glibc-benchtests-2.43-8.3.hum1 (aarch64, x86_64) * glibc-common-2.43-8.3.hum1 (aarch64, x86_64) * glibc-devel-2.43-8.3.hum1 (aarch64, x86_64) * glibc-doc-2.43-8.3.hum1 (noarch) * glibc-gconv-extra-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-aa-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-af-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-agr-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ak-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-am-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-an-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-anp-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ar-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-as-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ast-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ayc-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-az-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-be-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-bem-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ber-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-bg-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-bhb-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-bho-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-bi-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-bn-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-bo-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-br-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-brx-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-bs-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-byn-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ca-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ce-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-chr-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ckb-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-cmn-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-crh-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-cs-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-csb-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-cv-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-cy-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-da-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-de-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-doi-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-dsb-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-dv-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-dz-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-el-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-en-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-eo-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-es-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-et-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-eu-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-fa-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ff-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-fi-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-fil-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-fo-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-fr-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-fur-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-fy-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ga-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-gbm-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-gd-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-gez-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-gl-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-gu-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-gv-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ha-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-hak-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-he-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-hi-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-hif-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-hne-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-hr-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-hsb-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ht-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-hu-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-hy-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ia-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-id-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ig-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ik-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-is-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-it-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-iu-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ja-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-ka-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-kab-2.43-8.3.hum1 (aarch64, x86_64) * glibc-langpack-kk-2.43-8.3.hum1 (aar

CVE-2026-82481 is a high-severity vulnerability in the mirage cohttp package for OCaml, affecting versions prior to 6.3.0. It involves an incorrect behavior order where validation is performed before canonicalization, leading to a directory traversal flaw. This vulnerability allows an attacker to potentially access unauthorized directories. The CVSS 4.0 base score is 8.7, indicating a significant impact. No known exploits are reported in the wild. The vulnerability is fixed starting from version 6.3.0.

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB), BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP (with sufficient MAC header room to insert the temporary HBH jumbo header). However, commit b1a78b9b9886 ("net: add support for ipv4 big tcp") loosened the check in skb_gro_receive(), leading to several issues: 1. skb_gro_receive() checked skb_headroom(p) instead of the actual space before the MAC header (p->mac_header). Because skb_headroom(p) includes mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check with p->mac_header < 8 bytes. When ipv6_gro_complete() inserts the temporary HBH jumbo header, the memmove() starts before skb->head, causing an out-of-bounds write and wrapping skb->mac_header. 2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q / ETH_P_8021AD) to aggregate beyond 64KB because p->protocol != ETH_P_IPV6 was true. 3. It checked p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark, allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate beyond 64KB. Fix skb_gro_receive() to strictly enforce: - NAPI_GRO_CB(skb)->proto == IPPROTO_TCP - Not encapsulated (!NAPI_GRO_CB(skb)->encap_mark && !p->encapsulation) - Protocol must be either ETH_P_IP or ETH_P_IPV6 - If ETH_P_IPV6, p->mac_header must be at least sizeof(struct hop_jumbo_hdr) Returning -E2BIG from skb_gro_receive() ensures that packets which cannot become BIG TCP are cleanly flushed at <= 64KB and delivered intact without dropping. This issue does not exist in mainline (7.0+) because the subsystem was rewritten in commit 81be30c1f5f2 ("net/ipv6: Drop HBH for BIG TCP on RX side"), making this fix relevant only for older stable branches like 6.18.y.

The WP Ultimate CSV Importer WordPress plugin versions before 9.0 contain a vulnerability where imported field values are not properly sanitized and escaped before being used in SQL statements. This flaw could allow users with high privileges, such as administrators, to perform SQL injection attacks. The vulnerability has a medium severity rating with a CVSS score of 4.1. There is no information about an available patch or official fix at this time.

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable by unauthenticated attackers to obtain administrator access and to take over existing accounts. No version that fully addresses the issue is available at the time of this advisory. Mitigation: deactivate and remove the MemberHero WordPress plugin through 6.9 until a version that fully resolves this issue is released. If the MemberHero WordPress plugin through 6.9 must stay active, disable public registration, restrict access to the registration functionality, and monitor the site for unexpected administrator accounts.

An access control vulnerability exists in the getTracerouteCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. This flaw allows unauthenticated attackers to retrieve traceroute diagnostic logs by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.

An incorrect access control vulnerability exists in the getSyslogCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. This flaw allows unauthenticated attackers to retrieve syslog-related configuration information by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.

Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data message whose payload was exactly 16 bytes (an empty plaintext plus a bare Poly1305 tag, i.e. a keepalive) was accepted and returned immediately, before wg_decrypt_packet() was ever called. The Poly1305 authentication tag was therefore never verified; the only preceding gates were a cleartext receiver-index lookup (get_peer_keypair_for_index() on the attacker-supplied data_hdr->receiver) and a non-cryptographic keypair validity/expiry check. The path is reachable entirely from the network: inbound UDP on the WireGuard port is dispatched by wg_input() to handle_transport_data() and then wg_process_data_message(). The 32-bit receiver index is transmitted in cleartext in WireGuard handshake and data messages, so an on-path observer learns it directly and an off-path attacker can brute-force it against the UDP port. Given an active receiving-valid session for that index, an attacker could send a 16-byte garbage payload and have it accepted without possessing the session key. On acceptance the unauthenticated message caused the management layer to observe a spoofed NET_EVENT_VPN_CONNECTED signal (setting peer->first_valid and notifying any net_mgmt listener) and incremented the keepalive-RX statistic. The impact is limited to integrity of this status signal: no plaintext is decrypted or injected, no key is disclosed, and the early-return path did not update the peer endpoint or liveness timers, so there is no traffic-injection, session-takeover, or availability consequence. The fix removes the pre-decrypt early return so a 16-byte payload flows through wg_decrypt_packet(), which verifies the Poly1305 tag over the empty plaintext, followed by the existing anti-replay check; only an authenticated, non-replayed message is then recognised as a keepalive. Forged keepalives now fail the tag check and are counted as decrypt failures.

Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGE_TRANSPORT_DATA packet succeeded, the code committed several peer-state changes — update_peer_addr() (endpoint roaming update), the keypair->last_rx/peer->last_rx liveness timers, and keypair_update() (promote next→current and destroy the previous keypair) — and only afterward called wg_check_replay(). On a replayed packet the replay check returned -EINVAL, but none of the preceding mutations were rolled back. The AEAD tag authenticates content but not freshness, so a replayed-but-authentic transport packet decrypts correctly. An attacker who captures one valid ciphertext off the wire (an on-path or shared-medium observer) can re-inject it from an arbitrary spoofed source address. Reaching the handler requires no credentials: it is driven directly from inbound UDP datagrams via the dispatch in subsys/net/lib/wireguard/wg.c. Because the state mutations committed before the replay check, the replay repoints the peer endpoint to the attacker-chosen source address (roaming hijack), redirecting the victim's subsequent outbound tunnel traffic until the legitimate peer's next packet re-corrects it; it also prematurely destroys the previous keypair and refreshes the RX liveness timer. The tunnel payload stays encrypted under the session keypair, so this is an integrity/availability impact (traffic redirection and session disruption), not payload disclosure. The fix moves wg_check_replay() to immediately after a successful decrypt, before any peer-state mutation, matching the WireGuard specification and the Linux reference implementation.