Brotli2Bitcoin is a purposely vulnerable web application exposed to the internet as a live hacking challenge with a $1,000 bitcoin bounty for achieving remote code execution (RCE). The challenge is streamed live, showing all attack attempts in real time. The scope is limited strictly to brotli2bitcoin.com, with authorized testing and rules to prevent denial of service or attacks outside the target. The first verified RCE that runs a specific command and reports the flag wins the bitcoin prize. This is a controlled security research exercise rather than an active threat or vulnerability disclosure.
CVE-2026-74915 is a vulnerability in Imagination Technologies Graphics DDK involving an out-of-range pointer offset (CWE-823). A specially crafted web page with unusual WebGPU content can cause an out-of-bounds read or write crash in the GPU GLES user-space shared library. On platforms where the graphics workload process has system privileges, this vulnerability could potentially enable further exploitation on the device.
CVE-2026-74912 is a vulnerability in Imagination Technologies Graphics DDK involving an out-of-range pointer offset due to integer truncation when mapping GPU buffer pages within the 0GB to 4GB range. This issue arises on GPU systems where the fix for CVE-2026-49746 is applied, limiting the mapping range of graphics buffers and causing errors that restrict kernel mode driver functionality.
CVE-2026-19199 is an integer overflow vulnerability in the Imagination Technologies Graphics DDK kernel mode driver. The flaw occurs during page-to-byte conversion of an allocation size, causing an undersized kernel buffer allocation. This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, potentially leading to disclosure of sensitive kernel data.
CVE-2026-18629 is an integer overflow vulnerability in Imagination Technologies Graphics DDK. It occurs when unusual GPU shader code causes arithmetic operations to overflow, leading to incorrect memory size calculations and memory allocation failures. If these failures are not handled properly, the GPU compiler process may dereference a NULL pointer, causing a crash. On some platforms where the compiler runs with system privileges, this crash could potentially be leveraged for further exploits.
CVE-2026-65587 is an out-of-bounds write vulnerability in Imagination Technologies Graphics DDK. It occurs when a web page with unusual WebGPU content is loaded into the GPU GLES render process, causing the GPU user-space driver to write data beyond the intended memory offset. This can lead to memory corruption and potentially crash the browser or GPU process.
CVE-2026-65586 is a use-after-free vulnerability in Imagination Technologies Graphics DDK. It involves improper GPU system calls by non-privileged software that can free memory still in use, allowing replacement of memory buffers and causing arbitrary memory reads or writes to physical memory pages. This occurs because a memory buffer managed by the CPU driver and accessed by GPU firmware can be freed while still in use, leading to unauthorized GPU access to memory not managed by the CPU driver.
php2shell comprises two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. Exploitation requires tailoring the attack to the specific PHP environment, making widespread mass exploitation difficult. However, network appliances running identical builds are vulnerable to a single calibrated exploit. Exploitation has been confirmed in the wild, including attacks on PAN-OS firewall management servers. Patching is available and strongly recommended, especially for internet-facing management interfaces and end-of-life PHP versions.
CVE-2026-65584 is a stack-based buffer overflow vulnerability in Imagination Technologies Graphics DDK. It arises from improper GPU system calls by non-privileged users, causing a stack overflow in the kernel when processing resolved Linux/Android fence synchronization checkpoints. This overflow leads to kernel memory corruption and typically results in a denial-of-service via a kernel crash. The flaw is due to copying excessive data beyond the allocated stack array from an internal buffer.
CVE-2026-118475 is an out-of-bounds read vulnerability in Eye of GNOME on Red Hat Enterprise Linux 7. It occurs when parsing a specially crafted PNG image with malformed color profile metadata, leading to reading beyond allocated buffer boundaries. This can cause the application to crash (Denial of Service) or potentially expose sensitive memory contents. Exploitation requires user interaction to open a malicious image in an interactive desktop session, limiting impact to the local user's permissions.
CVE-2026-112922 is a vulnerability in Ghostscript affecting Red Hat Enterprise Linux 10. It involves an out-of-bounds read triggered by processing specially crafted PDF or PostScript documents with malicious mesh shading data. Exploitation can cause application crashes leading to Denial of Service (DoS) or limited information disclosure. The vulnerability requires local user interaction to exploit and has a low severity rating. Currently, no mitigation or patch meeting Red Hat's criteria is available.
A security vulnerability (CVE-2026-8932) in libcurl, part of the curl packages provided by Red Hat, allows a security feature bypass due to improper mutual TLS (mTLS) connection reuse. This issue affects Red Hat Enterprise Linux 9 and related variants. The vulnerability has been rated as moderate in severity by Red Hat Product Security. An update addressing this issue is available in Red Hat Enterprise Linux 9.8 and Extended Update Support 9.8 packages.
CVE-2026-15466 is a use-after-free vulnerability in Imagination Technologies Graphics DDK. It arises from a race condition in the destruction path of hardware performance counters buffer, where improper GPU system calls by non-privileged users can cause the reference counter to be decremented non-atomically. This allows other code paths to access freed kernel heap memory, leading to potential read and/or write use-after-free conditions.
CVE-2026-91920 is a vulnerability in the ChunkReader component of the Undertow web server used by Red Hat build of Apache Camel for Spring Boot 4. The flaw arises from an incomplete bounds check on chunk sizes in HTTP chunked transfer encoding, allowing a crafted 15-digit chunk size to overflow internal state flags. This can cause premature termination of the request body and interpretation of remaining data as a separate smuggled HTTP request. Exploitation requires precise TCP segmentation control. The vulnerability is rated medium severity with a CVSS score of 6.5.
CVE-2026-107238 is a high-severity vulnerability in the Veeam Management Pack for Microsoft System Center Collector service that allows an authenticated domain user to execute code remotely with LocalSystem privileges on affected servers. This vulnerability enables privilege escalation to the highest system level, potentially compromising the entire server. No specific affected versions or patch information is provided in the available data.
CVE-2026-92744 is a high-severity vulnerability in a privilege manager agent that under certain conditions allows a remote unauthenticated attacker to execute arbitrary code with LocalSystem privileges. The vulnerability has a CVSS 4.0 base score of 8.7, indicating significant impact. No affected versions or patch information are provided, and no known exploits are reported in the wild.
This vulnerability allows a member of the Veeam Virtualization Extensions Users group to execute remote code on servers running the Veeam Management Pack for Microsoft System Center Collector service. It is identified as CVE-2026-107239 with a high severity score of 8.8. The vulnerability involves a path traversal issue (CWE-23) that could lead to remote code execution. No affected versions or patch information are provided, and there are no known exploits in the wild at this time.
An authenticated, low-privileged Nessus user on Linux with scan-creation rights can read arbitrary text files on the scanner host by running a custom Unix compliance audit. This allows reading files with the privileges of the nessusd process without requiring higher privileges or user interaction.
Spreadsheet::XLSX versions before 0.19 for Perl contain a vulnerability that allows arbitrary code execution. The flaw arises from the use of string eval on number format conditions in ExcelFmt during workbook parsing. An attacker can craft a malicious XLSX file with a specially formatted number condition to execute arbitrary Perl code when the file is processed.
A vulnerability in Apple Xcode allows an app to read arbitrary files due to improper handling of symlinks. This issue is resolved in Xcode version 27.2 with improved symlink handling.