CVE-2024-24816

CVE-2024-24816 CKEditor 4 XSS This issue was caused by a lack of sanitization of the data passed to "preview" feature. This problem has been fixed in CKEditor 4 at version 4.24.0-lts. Affected versions 4.24.0-lts Advisory Update CKEditor 4 to version 4.24.0-lts or newer. References...

CVE-2026-101308

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

CVE-2026-101304

When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...

EUVD-2026-101883

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

CVE-2026-101308 TOCTOU race between sound(4) buffer resizing and mmap

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

CVE-2026-101308

The sound(4) driver in FreeBSD contains a TOCTOU (Time-of-Check Time-of-Use) race condition during audio channel buffer resizing. The driver checks if a buffer is memory-mapped, drops the channel lock to allocate a new buffer, and then frees the old one. A concurrent mmap(2) call can complete dur...

CVE-2026-101304 Multiple jail filesystem root escapes

When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...

CVE-2026-101304

A vulnerability exists in FreeBSD jails where a process can escape the jail's filesystem root restriction. When fdescfs(4) is mounted with the "nodup" option, opening /dev/fd/N returns a descriptor that fails to inherit FD_RESOLVE_BENEATH or Capsicum capability rights from descriptor N. This allo...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 nuclei template Joomla CVE-2023-23752 - a request parameter breaks through the Rest API Affected version ​ Joomla roughly has three routing entries, which are 1. index.php in the root directory users access articles 2. administrator/index.php in the root directory...

RHCOS 4 : Red Hat build of MicroShift 4.18.57 (RHSA-2026:80167)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80167 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame...

FreeBSD : FreeBSD -- TOCTOU race between sound(4) buffer resizing and mmap (1fef3562-c848-11f1-ada3-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1fef3562-c848-11f1-ada3-bc241121aa0a advisory. When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not...

CVE-2026-101942

An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — CodeIgniter 4 Validation Rule Injection CVE-2023-32692 is a code injection vulnerability in the CodeIgniter 4 PHP framework, affecting versions 4.0.0 through 4.3.4. It was fixed in 4.3.5 released June 2023. This is a demo environment for anyone that wants to play with it...

IDA_Plugin_PCodeGPT

PCodeGPT A plugin for ida 7.5 7.x and 8.x. Description This is a gepetto and WPeChatGPT modified IDA plug-in that I use to automate code analysis using OpenAI's GPT 3.5 or GPT-4. Currently, only Chinese is supported. Usage Move PCodeGPT.py into the plugins folder, and the plug-in will be...

FreeBSD -- TOCTOU race between sound(4) buffer resizing and mmap

Problem Description: When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the...

FreeBSD-SA-26:71.sound

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:71.sound Security Advisory The FreeBSD Project Topic: TOCTOU race between sound4 buffer resizing and mmap Category: core Module: sound Announced: 2026-10-14...

CVE-2024-9014

CVE-2024-9014 - pgAdmin 4 OAuth2 Authentication Bypass Exploit Tools This repository contains tools to check for and exploit the CVE-2024-9014 vulnerability in pgAdmin 4. The vulnerability allows an attacker to bypass OAuth2 authentication and access sensitive resources. Tools 1...

pgadmin4-9.10-CVE-2025-13780

pgadmin4 9.11 Meta-Command Filter Command Execution Summary The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for Issue 9320 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark EF BB BF or other special sequences. The implemented filter...

CVE-2024-48955_Overview

CVE-2024-48955Overview Description: Netadmin 4 IAM with access control flaws. Affected version: V4.030319 NetAdmin system returns data with functionalities in the endpoint that "builds" the functionality menus; the response of this call is not encrypted, and as the system does not validate sessio...

picohaxx

now with 100% more source code ™ picohaxx Open source Kernel exploit for Pico 4 devices based on cve-2023-33107 Optimized for a rock-solid 100% success rate and speed 7s on all vulnerable Pico 4 devices. Supported Pico 4 OS Versions: 5.2.0 up to 5.11.0 Chinese or Global 5.9.9. As of this writing...