CVE-2026-95835

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handleremoteaskpass in kitty/window.py opens the POSIX shared memory...

CVE-2026-66493

Path Traversal in File Operations Delete / Copy / Move PhocaCommander ≤ 6.1.3 — Authenticated Admin Manipulates Files Outside Webroot SUMMARY The file action handler in PhocaCommander constructs source and destination paths from attacker-controlled base64-encoded parameters pathfrom, pathwhere...

CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

DEBIAN-CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-93834 Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-93834 Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

EUVD-2026-87092

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-93834

A use-after-free vulnerability exists in the QEMU 9pfs subsystem due to a race condition between the main thread and a worker thread. When processing concurrent Tlcreate and Twalk requests, a malicious guest user can craft a fid path containing stale heap data . This allows the attacker to bypass...

CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-80431 Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

CVE-2026-95832

The kitty terminal emulator (versions 0.47.3 before 0.49.0 ) is vulnerable to arbitrary command execution due to improper neutralization of special elements in the colour control escape code handler . The flaw exists because color_control() in kitty/window.py includes unrecognised field names in ...

brokentooth

brokentooth POC for CVE-2018-4327 at least I think so since CVE-2018-4327 and CVE-2018-4330 were both discussed by @SparkZheng but it's not clear from him which one relates to which bug but since he described this one first I'm taking a guess. Tested on iPhone 6S 11.3.1 Should work until 11.4 Let...

brokentooth

brokentooth POC para CVE-2018-4327 al menos eso creo, ya que @SparkZheng discutió tanto CVE-2018-4327 como CVE-2018-4330, pero no queda claro por su parte cuál se relaciona con cada bug; pero como describió este primero, me lanzo a adivinar. Probado en iPhone 6S 11.3.1 Debería funcionar hasta 11....

CVE-2026-79109

A flaw was found in Google Chrome's printing component. A remote attacker, after compromising the renderer process, could exploit improper input validation by crafting a malicious HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security...

Presentations

Presentations 2025 CodeBlue 2025 - 18th to 19th November 2025 AI Accelerated Exploiting: Compromising MTE Enabled Pixel from DSP Coprocessor by PAN Zhenpeng & Billy JHENG Bing Jhong Dancing with Exynos Coprocessor: Pwning Samsung for fun and “profit” by Muhammad Ramdhan, PAN Zhenpeng & Billy JHEN...

CVE-2026-93603

A flaw was found in vm2. This vulnerability allows an attacker who can execute untrusted script within the sandbox to achieve arbitrary code execution on the underlying host system by escaping sandbox containment. The issue occurs because vm2 fails to properly handle function calls lacking an...

CVE-2026-21858-and-CVE-2025-68613

Ni8mare: n8n Pre-Auth RCE CVE-2026-21858 & CVE-2025-68613 — Vulnerability Lab & PoC Report Hands-on lab environment Vulnerable Lab and a detailed exploitation analysis report of the Ni8mare vulnerability chain on the n8n platform — from Arbitrary File Read CVE-2026-21858 to Remote Code Execution...

foxcage

foxcage Run Firefox in a rootless Podman container for security isolation. Your browser runs with almost no Linux capabilities, in its own user and network namespace, isolated from the host — while still having full GPU acceleration, audio, and DRM support. Why foxcage? Firefox already has a...

UAP-protocol

root@kitploit: ██╗ ██╗ █████╗ ██████╗ ██║ ██║██╔══██╗██╔══██╗ ██║ ██║███████║██████╔╝ ██║ ██║██╔══██║██╔═══╝ ╚██████╔╝██║ ██║██║ ╚═════╝ ╚═╝ ╚═╝╚═╝ Universal Agent Protocol A unified, security-first wire protocol for tool access, agent coordination, and structured RPC. Built to close CVE-2025-495...

CVE-2026-93605

A flaw was found in vm2. The sandbox environment fails to restrict access to the childprocess module, which handles system command execution. In environments configured to allow built-in modules, an attacker capable of running untrusted code within the sandbox can load this module to break...