EUVD-2026-86869

In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator mounts with forceuid or forcegid uid=/gid= mount options, they expect all files to appear owned by the specified user/group. However, severa...

CVE-2026-97562 smb: client: pin DFS superblock in iterator callback

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tconsupercb stores a raw superblock pointer, but cifsgetsuper takes its active reference only after iteratesuperstype has dropped sumount and its passive reference. Concurrent...

CVE-2026-97560

The Linux kernel contains a one-byte out-of-bounds (OOB) read vulnerability within the smb2_parse_native_symlink() function of the SMB client. The flaw occurs when parsing a share-root relative native symlink, where memcpy copies smb_target+1 (skipping the leading separator) but incorrectly uses ...

CVE-2026-97559

The Linux kernel contains a vulnerability in the SMB client where the functions replace_sids_and_copy_aces() and set_chmod_dacl() incorrectly use a u16 accumulator to track DACL size. This causes an integer wraparound when the rewritten DACL exceeds 64K (specifically reaching a wraparound with 86...

CVE-2026-97558 smb: client: fix cifsFileInfo reference leak in deferred close

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

CVE-2026-97558

The Linux kernel contains a vulnerability in the SMB client where a cifsFileInfo reference leak occurs during a deferred close operation. The issue stems from a race condition in cifs_close(): if deferred_close_scheduled becomes false while work is pending, subsequent cifs_open() calls may reuse ...

CVE-2026-97556

The Linux kernel contains a vulnerability in the SMB client where a reference count leak occurs when cifs_sb_tlink() fails, specifically in setups using the "-o multiuser" option. The cifs_oplock_break() function fails to release the file reference in this specific failure path, which can lead to...

EUVD-2026-86865

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

CVE-2026-97557

The Linux kernel contains a vulnerability in the CIFS (SMB) client where cifs_queue_oplock_break() unconditionally increments a file reference count before attempting to queue cifs_oplock_break(). If the work item is already queued, queue_work() returns false, causing the reference count to leak....

CVE-2026-97555 smb: client: fix heap overflow in DACL owner/group rewrite

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

CVE-2026-97555

A heap overflow vulnerability exists in the Linux kernel 's SMB client within the DACL owner/group rewrite process. When id_mode_to_cifs_acl rewrites an existing DACL, it incorrectly allocates a buffer based on the on-disk length. If the replacement SIDs obtained from the cifs.idmap upcall are lo...

CVE-2026-97554

A vulnerability exists in the Linux kernel SMB client within the cifs_posix_to_fattr() function. The issue stems from the function ignoring the return value of posix_info_parse() . When processing a malformed POSIX directory entry from an untrusted server (such as one with invalid SID lengths), t...

grdpwasm

grdpwasm 一个基于Web的RDP客户端，使用Go WebAssembly和grdp构建。直接从浏览器连接到Windows远程桌面服务器——无需插件。 架构 root@kitploit: Browser WASM ──WebSocket──► proxy Go ──TCP──► RDP Server 因为浏览器无法打开原始TCP套接字，一个轻量级的Go代理服务器将浏览器的WebSocket连接桥接到RDP服务器的TCP端口。 要求 Go 1.24 或更高版本 一个可访问的RDP服务器（Windows或任何兼容RDP的主机） 构建 root@kitploit: git clone...

prey-android-client

Aquí encontrarás todo el código fuente de las versiones actual y en desarrollo del cliente de Prey para dispositivos Android. Prey es una plataforma SaaS para el rastreo de dispositivos, monitoreo, protección de datos y administración de dispositivos. Su agente de código abierto se ejecuta en los...

ligolo-mp

Ligolo-MP：像VPN一样进行内网穿透，现在还能和朋友一起！ Ligolo-MP 是 Ligolo-ng 的进阶版本，采用客户端-服务器架构，使渗透测试人员能够通过多个并发隧道协同工作。它会自动管理所有 TUN 设备，同时提供清晰的图形界面来追踪一切。 功能特性 多人协作 自动 TUN 管理 自动恢复路由 无限并发中继 支持 SOCKS 和 HTTP 代理（包括 SSPI/SPNEGO 认证） 跨平台代理，兼容 Linux/FreeBSD/MacOS/Windows 7+ 路由至目标机器的环回地址（无需再端口转发） 监听器作为独立重定向器 动态 mTLS...

rdap

OpenRDAP es una implementación en Go de un cliente de línea de comandos RDAP. https://www.openrdap.org - página principal https://www.openrdap.org/demo - demo en vivo Características Cliente RDAP de línea de comandos Formatos de salida: texto, JSON, estilo WHOIS Tipos de consulta admitidos: ip...

CVE-2021-43032

CVE-2021-43032 En XenForo ≤ 2.2.7, un actor de amenazas con acceso al panel de administración puede guardar payloads de cross-site scripting en cualquier función de la aplicación que acepte código HTML. Un payload colocado dentro de la funcionalidad 'Advertising' se ejecutará globalmente en el la...

DetExploit

此 README 为英文版本。 如需查看日文版本，请参阅READMEJAPANESE.md。 信息 最后更新: 2019/10/04 您好，感谢您访问此仓库。 您可能注意到有一段时间没有提交记录……但开发工作仍在进行中！！！ 目前，我正在用 C++ 重写整个程序，以减小二进制文件大小并获得更多优势。 这是发布我们程序的重要步骤，请谅解……: 我已经准备了一些里程碑，您可以查看它们！！ root@kitploit: 日程 1. 从 Python 迁移到 C++ 以减小二进制文件大小 2. 通过 GitHub Releases 发布二进制文件 3...

msldap

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord msldap LDAP library for MS AD 🚩 Runs in the browser This project, alongside with many...

publications

Publicaciones de Trail of Bits Publicaciones de Trail of Bits Artículos académicos Libros blancos Guías y manuales Presentaciones de conferencias Detección y explotación automatizada de bugs Blockchain Compiladores Criptografía Ingeniería Educación Infraestructura Aprendizaje automático Seguridad...