how2heap

Educational Heap Exploitation This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases. You can run apt source libc6 to download the source code of the Libc you are using...

red-teaming-auto-mode

Red-teaming Claude Code's auto-mode monitor Code for the paper Red-teaming Claude Code's auto-mode monitor. Production coding-agent monitors e.g. Claude Code's Auto Mode or Codex's Guardian review each action and block unsafe ones in real time. This repository red-teams them under a persistent...

CVE-2026-107448

Magic: The Gathering Arena Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or...

CVE-2026-107448

The Magic: The Gathering Arena Windows/Steam client (versions 2026.59.30.12801.127931.6 and certain 2026.60.x builds) is vulnerable to a Resource Injection flaw. The application fails to validate the URI scheme or domain of a server-supplied URL received from a home-screen carousel GoToExternalUr...

CVE-2026-107448

Magic: The Gathering Arena Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or...

EUVD-2026-94696

Magic: The Gathering Arena Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or...

PT-2026-107802

Name of the Vulnerable Software and Affected Versions Magic: The Gathering Arena Windows/Steam client versions 2026.59.30.12801.127931.6 through 2026.60.x Description The application passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell usin...

CVE-2026-88341

A flaw was found in YARA. A remote attacker could exploit this vulnerability by providing a specially crafted compiled rule file .yrc with an invalid arena configuration. This malicious file, when loaded, triggers an assertion failure, leading to the application's termination. This results in a...

PT-2026-97027

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration num buffers=0 that triggers an assertion failure in yr arena get ptr, causing the application to terminate...

SUSE CVE-2026-90211

In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPFPROBEATOMIC and gets an exception table entry, but bpfjitprobeatomicpre on...

SUSE CVE-2026-93044

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

Linux Distros Unpatched Vulnerability : CVE-2026-93044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be...

Linux Distros Unpatched Vulnerability : CVE-2026-90211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to...

Linux Distros Unpatched Vulnerability : CVE-2026-93045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject arena frees below the arena base bpfarenafreepages accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs...

CVE-2026-93045

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpfarenafreepages accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range t...

DEBIAN-CVE-2026-93045

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpfarenafreepages accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range t...

DEBIAN-CVE-2026-90342

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock deadlock on arena lock failure Reported by the Sashiko AI review. arenavmfault returns VMFAULTRETRY when it can't take arena-spinlock, but it never took mmaplock. The fault path assumes a VMFAULTRETRY handler...

CVE-2026-90211

In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPFPROBEATOMIC and gets an exception table entry, but bpfjitprobeatomicpre on...

DEBIAN-CVE-2026-90211

In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPFPROBEATOMIC and gets an exception table entry, but bpfjitprobeatomicpre on...

CVE-2026-93044

CVE-2026-93044 affects the Linux kernel BPF subsystem. The BPF interpreter does not support arena-related instructions (ST/LDX/STX). When a BPF program using an arena map falls back to the interpreter (via core.c::__bpf_prog_select_runtime()), execution hits a BUG_ON() at kernel/bpf/core.c:2349, ...