kernel: ice: fix double-free of tx_buf skb

A flaw was found in the Linux kernel's ice network driver. An error in the driver's handling of network packet transmission, specifically when icetso or icetxcsum functions fail, can lead to a double-free of a network buffer skb. This occurs because a transmit buffer txbuf may still point to an...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

CVE-2026-106269

An use after free flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=565742178 https://code.google.com/p/chromium/issues/detail?id=106269...

CVE-2022-2586-LPE

CVE-2022-2586-LPE CVE-2022-2586 的 LPE N-day 利用：Linux 内核 nftobject UAF gcc exploit.c -o exploit -lmnl -lnftnl -no-pie -lpthread 作者：Alejandro Guerrero [email protected] 版权所有 C 2022 Qualys, Inc...

CVE-2026-23918

CVE-2026-23918 Doble liberación en la limpieza de flujos de modhttp2 de Apache httpd que conduce a una ejecución remota de código RCE sin autenticación. Afectado: httpd 2.4.66 con modhttp2 y MPM de múltiples subprocesos event/worker. Corregido en: 2.4.67. Encontrado y reportado por Bartlomiej...

CVE-2022-32250-exploit

CVE-2022-32250-Linux-Kernel-LPE 演示视频 https://www.youtube.com/watch?v=YqmwA6fPjKE 关于 CVE-2022-32250 允许本地用户将权限提升至 root，因为错误的 NFTSTATEFULEXPR 检查导致 use-after-free。 参考 Linux 内核漏洞利用 CVE-2022-32250 结合 mqueue 受影响版本 Linux，在提交 520778042ccca019f3ffa136dd0ca565c486cedd 之前 2022年5月26日 Ubuntu = 22.04 在安全补丁之前...

CVE-2026-23918

CVE-2026-23918：Apache HTTP/2 双重释放 DoS CVE-2026-23918 | Apache HTTP Server 2.4.66 | CWE-415：双重释放 | CVSS 8.8 | 已在 2.4.67 中修复 modhttp2（h2mplx.c）中的双重释放漏洞允许远程攻击者通过快速的 RSTSTREAM 帧触发 c1c2streamjoined 与 mstreamcleanup 之间的竞争条件，从而导致拒绝服务（工作进程崩溃）。 快速开始 1. Start the lab docker-compose up --build -d 2. Run the...

openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side

A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability...

Important: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange DH-GEX client path. This occurs during FIPS Federal Information Processing Standards mode known-group validation when the client processes attacker-controlled DH-GEX...

NFSundown

Resumen Exploit de prueba de concepto para NFSundown CVE-2025-38089. Puede provocar de forma remota la caída del kernel en un servidor NFS. Detalles Un atacante remoto puede provocar una desreferencia de puntero nulo en el kernel y causar su caída enviando una solicitud RPC especialmente...

Web Directory Free < 1.7.3 - Local File Inclusion

The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include, which could lead to Local File Inclusion issues. id: CVE-2024-3673 info: name: Web Directory Free 1.7.3 - Local File Inclusion author: s4e-io severity: critical description: | The Web...

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

JustRows WordPress - Cross-Site Scripting

JustRows free WordPress plugin v0.2 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

WordPress Title Experiments Free <9.0.1 - SQL Injection

WordPress Title Experiments Free plugin before 9.0.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via the wpextitles AJAX action, available to unauthenticated users. An attacker can possibly obtain sensitive...

WordPress WP Video Gallery <=1.7.1 - SQL Injection

WordPress WP Video Gallery plugin through 1.7.1 contains a SQL injection vulnerability. The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

Guten Free Options - Cross Site Scripting

Guten Free Options WordPress plugin = 0.9.5 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to click malicious link. id: CVE-2024-13492 info: name: Guten Free...

CVE-2026-43499-aristotle

CVE-2026-43499 — aristotle au/KDDI 小米 XIG04 针对搭载Android 12 的au/KDDI 小米 "aristotle" XIG04 的本地权限提升（tmp-root），利用CVE-2026-43499 。这是一个设备所有者root原始方法：用于root你自己的手机（例如，当开发者选项无法访问时重新启用ADB）。 这是上游实现的一个aristotle 移植 ：https://github.com/x-spy/CVE-2026-43499-popsicle —— 该实现针对小米17 / Pro / Ultra（popsicle，骁龙，Androi...

uaf-2023-28205

CVE-2023-28205: Apple WebKit 释放后使用漏洞 此漏洞可通过恶意构造的网页内容加以利用，允许攻击者执行任意代码。 描述 该代码通过延迟添加 Map 和 Date 对象，触发释放后使用（UAF）漏洞，使得垃圾回收器（GC）能够释放它们。这可能导致访问已释放的对象，从而引发内存损坏或实现漏洞利用。 参考 WebKit 提交 c9880de4a28b9a64a5e1d0513dc245d61a2e6ddb CVE-2023-28205：Google 威胁分析小组的 Clément Lecigne 以及 Amnesty International 安全实验室的...

rootsh

rootsh rootsh 是一个针对 OS X Yosemite 10.10.5 build 14F27 的本地权限提升工具。它利用了 CVE-2016-1758 和 CVE-2016-1828，这两个 XNU 中的漏洞已在 OS X El Capitan 10.11.4 和 10.11.5 中修补。rootsh 无法在启用了 SMAP 的平台上运行。 CVE-2016-1758 CVE-2016-1758 是一个信息泄露漏洞，由于将内核栈中未初始化的字节复制到用户空间导致。通过比较泄露的内核指针与固定参考地址，可以恢复内核偏移（kernel slide）。 CVE-2016-1828...