SMBGhost_RCE_PoC

SMBGhostRCEPoC RCE PoC for CVE-2020-0796 "SMBGhost" For demonstration purposes only! Only use this a reference. Seriously. This has not been tested outside of my lab environment. It was written quickly and needs some work to be more reliable. Sometimes you BSOD. Using this for any purpose other...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix write buffer corruption The digiwriteinbcommand function is supposed to wait until the write Urb becomes available or return an error; instead, it updates the transfer buffer and attempts to resen...

CVE-2020-0796-exp

SMBGhostRCEPoC RCE PoC for CVE-2020-0796 "SMBGhost" For demonstration purposes only! Only use this a reference. Seriously. This has not been tested outside of my lab environment. It was written quickly and needs some work to be more reliable. Sometimes you BSOD. Using this for any purpose other...

CVE-2020-11179-Adreno-Qualcomm-GPU

My independent work from the poc created by P0 researcher Ben Hawkes Original article: https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html My goal is to convert his poc to C, and continue where he left off and turn the poc into either a root shell, or a kernel r/w, a...

The FLTK Team fltk digital error vulnerability

The FLTK Team’s fltk 1.4.5 and earlier versions contain a numerical error vulnerability. This vulnerability stems from an integer overflow in the FlBMPImage::loadbmp function, which results in the allocation of a pixel buffer with an excessively small width and height. Attackers can exploit this ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: “vt: fix unicode buffer corruption when deleting characters” This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 “vt: fix memory overlapping when deleting chars in the buffer”. The solution is als...

CVE-2026-76661

A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data...

CVE-2026-76660

A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data...

CVE-2026-76661 HPE NonStop QIOMON - Memory corruption vulnerability

A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data...

CVE-2026-76661

A vulnerability exists in HPE NonStop QIOMON (T8671) where an out-of-bounds write can occur, leading to the corruption of buffer data. This memory corruption flaw could potentially result in a Denial of Service (DoS) , buffer overflow, or stack overflow. HPE has released security fixes; specifica...

EUVD-2026-101811

A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data...

PT-2026-114437

A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data...

PT-2026-114438

A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data...

CVE-2026-19938: Use After Free

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-97618

A flaw was found in the Linux kernel's iouring subsystem. This vulnerability allows a local user to cause a denial of service DoS or buffer corruption. When handling network receive operations configured with the packet truncation flag MSGTRUNC, the kernel calculates buffer consumption based on t...

CVE-2026-98051

A flaw was found in the Linux kernel's Broadcom ASP 2.0 Ethernet driver. When evaluating whether sufficient transmit buffer space is available for outgoing packets, the driver fails to properly verify all required consecutive descriptor slots. A local user could exploit this flaw by generating...

SUSE CVE-2026-89748

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...

CVE-2026-89748

A flaw was found in the Linux kernel's tracing subsystem. An issue in the simpleringbufferswapreaderpage function, related to retry exhaustion during ring buffer reader page swaps, can lead to incorrect handling of successful or failed operations. This can result in corruption of the ring buffer,...