extract75-cve-2020-13995

Exploit de Sequestro de Fluxo de Controle para CVE-2020-13995 Construa: make Execute: make run Execute o Mayhem: docker tag extract75-cve-2020-13955 /extract75-cve-2020-13955 docker push /extract75-cve-2020-13955 mayhem run --image /extract75-cve-2020-13955 \ --project /extract75 . Tempo de...

CVE-2026-2766-but-with-wasm

CVE-2026-2766, लेकिन wasm के साथ स्थिति: validated crash PoC, demonstrated control-flow hijack के साथ crashpc = freed-cell poison 0xcdcdcdcdcdcdcdcd debug shell के अंतर्गत — engine freed ICScript से पढ़े गए pointer पर jump करता है। शेष कार्य: reclaimed bytes को नियंत्रित करना। देखें...

tenda-ac8v4-rop

Tenda-Ac8v4-PoC Tenda Ac8v4 Overflow baseado em pilha para Execução Remota de Código via sequestro de fluxo de execução e exploração de manipulação de múltiplos registradores; CVEs são: CVE-2023-33675 CVE-2023-33673 CVE-2023-33672 CVE-2023-33671 CVE-2023-33670 CVE-2023-33669 Marcado como N1 - N7...

CVE-2026-49933

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2026-49933

A vulnerability exists in the msft.cc component within the handle_le_monitor_device_event function. An uninitialized pointer dereference allows for a potential control-flow hijack within a privileged Bluetooth process. This flaw could enable a local escalation of privilege without requiring addit...

CVE-2026-49933

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

EUVD-2026-92603

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2026-49933: Access of Uninitialized Pointer

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

PT-2026-106149

Name of the Vulnerable Software and Affected Versions Microsoft Bluetooth affected versions not specified Description An uninitialized pointer dereference in the handle le monitor device event function within msft.cc allows for a control-flow hijack in the privileged bluetooth process. This issue...

CVE-2026-82539

CVE-2026-82539 Information Vendor: TOTOLINK Vendor's website: TOTOLINK Model: A720R Firmware version: V4.1.5cu.630B20250509 Firmware download address: TOTOLINK Severity CVSS v4.0 Base Score: 9.4 Critical Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P Vulnerability...

ASB-A-522372651

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102730

LevelX's NAND flash-translation-layer metadata parser contains an unbounded out-of-bounds heap write triggered by mounting an attacker-controlled NAND flash image via lx_nand_flash_open(). The root cause is an unchecked on-flash count in a parser partially generated by an AI. This vulnerability a...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

EUVD-2026-89201

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102730: Out-of-bounds Write

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

PT-2026-102796

Mounting an attacker-controlled NAND flash image lx nand flash open triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

ANT-2026-27KVBTTP · wireshark/wireshark · Use-After-Return / Memory Corruption

other low CVE-2026-76891 Severity Claude high · Security research firm high · Maintainer low Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-27KVBTTP: sharkd tap request leaves dangling...

CVE-2026-57163

A flaw was found in PJSIP. A stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate. A remote attacker can exploit this by presenting a specially crafted certificate during the TLS handshake, before SIP-level authentication...