extract75-cve-2020-13995

针对 CVE-2020-13995 的控制流劫持利用 构建： make 运行： make run 进行 Mayhem 模糊测试： docker tag extract75-cve-2020-13955 /extract75-cve-2020-13955 docker push /extract75-cve-2020-13955 mayhem run --image /extract75-cve-2020-13955 \ --project /extract75 . （默认运行时间为600秒；可通过 --duration 标志覆盖） 需要更多信息？联系...

CVE-2026-2766-but-with-wasm

CVE-2026-2766, pero con wasm Estado: PoC de fallo validado con secuestro de flujo de control demostrado pc del fallo = veneno de celda liberada 0xcdcdcdcdcdcdcdcd bajo el shell de depuración — el motor salta a un puntero leído del ICScript liberado. Trabajo restante: controlar los bytes reclamado...

tenda-ac8v4-rop

Tenda-Ac8v4-PoC Tenda Ac8v4 通过执行流劫持和多寄存器操作利用，实现从基于栈的溢出到远程代码执行；相关 CVE 为： CVE-2023-33675 CVE-2023-33673 CVE-2023-33672 CVE-2023-33671 CVE-2023-33670 CVE-2023-33669 标记为 N1 - N7 rop.py 确保你在可访问的机器上托管了 tftp；通过 args.attackerhost 指定它； 确保预编译的加载器 rs 托管在 tftp 中； 反向 shell 连接将在脚本内监听。...

CVE-2026-49933

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2026-49933

A vulnerability exists in the msft.cc component within the handle_le_monitor_device_event function. An uninitialized pointer dereference allows for a potential control-flow hijack within a privileged Bluetooth process. This flaw could enable a local escalation of privilege without requiring addit...

EUVD-2026-92603

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2026-49933

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

PT-2026-106149

Name of the Vulnerable Software and Affected Versions Microsoft Bluetooth affected versions not specified Description An uninitialized pointer dereference in the handle le monitor device event function within msft.cc allows for a control-flow hijack in the privileged bluetooth process. This issue...

CVE-2026-49933: Access of Uninitialized Pointer

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2026-82539

CVE-2026-82539 Information Vendor: TOTOLINK Vendor's website: TOTOLINK Model: A720R Firmware version: V4.1.5cu.630B20250509 Firmware download address: TOTOLINK Severity CVSS v4.0 Base Score: 9.4 Critical Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P Vulnerability...

ASB-A-522372651

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102730

LevelX's NAND flash-translation-layer metadata parser contains an unbounded out-of-bounds heap write triggered by mounting an attacker-controlled NAND flash image via lx_nand_flash_open(). The root cause is an unchecked on-flash count in a parser partially generated by an AI. This vulnerability a...

EUVD-2026-89201

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

PT-2026-102796

Mounting an attacker-controlled NAND flash image lx nand flash open triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102730: Out-of-bounds Write

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

ANT-2026-27KVBTTP · wireshark/wireshark · Use-After-Return / Memory Corruption

other low CVE-2026-76891 Severity Claude high · Security research firm high · Maintainer low Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-27KVBTTP: sharkd tap request leaves dangling...

CVE-2026-57163

A flaw was found in PJSIP. A stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate. A remote attacker can exploit this by presenting a specially crafted certificate during the TLS handshake, before SIP-level authentication...