CVE-2023-36427

CVE-2023-36427 This repo contains the report and exploit of CVE-2023-36427, memory corruption at arbitrary physical addresses from the root partition on Windows. The details and exploit of the vulnerability are in the report sent to Microsoft. Timeline July 2 - Sent a report to a friend of mine a...

CVE-2025-23247

CVE-2025-23247 Epic Collab with @reubensammut : as alaways : wip for CVE-2025-23247 . ATM just crash PoC which shows we control buffer and offset, so we got aaw. Bug from https://talosintelligence.com/vulnerabilityreports/TALOS-2025-2151 checksec ./cuobjdump '/home/vlad/cuobjdump' Arch:...

UnPlus

unplus CVE-2026-43499 Futex PI UAF kernel arbitrary-address-write exploit core logic code, used to bypass SELinux and gain root. This repository only contains the core exploit logic source src/ and the single-binary packager wrapper/. src/target.h is a template ; you must fill in parameters for...

CVE-2023-50245

CVE-2023-50245 Vulnerability Overview CVE-2023-50245 CVSS : 9.8 Dec 11, 2023 Image Viewer Vulnerability Vulnerability Description github advisories arbitrary address write vulnerability POC 1 1404.9264: Access violation - code c0000005 first chance First chance exceptions are reported before any...

PT-2026-108049

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite affected versions not specified Description A policy-enforcement flaw allows an authenticated user to bypass disabled mail forwarding. This is achieved by utilizing a Sieve notify action—a mechanism used to trigger...

CVE-2026-102722

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...

CVE-2026-102722

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...

PT-2026-97185

Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1 Description The plugin fails to bind saved-draft notifications to the visitor who created the draft. It accepts both the recipient address and the link included in the message direct...

OESA-2026-3601 aom security update

The Alliance for Open Media’s focus is to deliver a next-generation video format that is: Security Fixes: An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows ...

EUVD-2026-62498

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contactidoffer / contactidevent instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

CVE-2026-75953: Insertion of Sensitive Information Into Sent Data

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contactidoffer / contactidevent instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound

...

libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel value...

libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel value...

PT-2026-68125

Name of the Vulnerable Software and Affected Versions nanoMODBUS versions prior to 1.23.1 Description An out-of-bounds stack read exists in the nmbs read device identification basic and recv read device identification res functions within nanomodbus.c. The issue occurs because the object id...

libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel value...

CVE-2026-15146

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an...

OESA-2026-2866 aom security update

The Alliance for Open Media’s focus is to deliver a next-generation video format that is: Security Fixes: An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows ...

OESA-2026-2865 aom security update

The Alliance for Open Media’s focus is to deliver a next-generation video format that is: Security Fixes: An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows ...

OESA-2026-2864 aom security update

The Alliance for Open Media’s focus is to deliver a next-generation video format that is: Security Fixes: An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows ...