SharpPolarBear

SharpPolarBear This is a weaponized version for one of the Exploits published by SandboxEscaper from here https://github.com/SandboxEscaper/polarbearrepo. Most of the code comes from rasta-mouse CollectorService repository https://github.com/rasta-mouse/CollectorService. I just changed the...

CVE-2020-10665

CVE-2020-10665 Docker Desktop Local Privilege Escalation POC for Docker Desktop Local Privilege Escalation. Built based on the writeup at https://www.activecyber.us/activelabs/docker-desktop-local-privilege-escalation-cve-2020-10665. Hardlink creation adapted from...

research

Security Research Repository dedicated to my security vulnerability discoveries CVEs. This repository contains detailed technical documentation, proof-of-concept exploits, and analysis of discovered vulnerabilities. About This repository aggregates all CVEs I have discovered and researched,...

CVE-2025-4517-POC

CVE-2025-4517 Exploit NOTES This exploit and description are written by AI. If you find a mistake or issue, please let me know! This exploit was tested and confirmed working. Thank you! Overview This exploit leverages CVE-2025-4517 , a critical vulnerability in Python's tarfile module that allows...

CVE-2025-55188

CVE-2025-55188: 7-Zip Arbitrary File Write Proof-of-concept of CVE-2025-55188, an arbitrary file write in 7-Zip. Patched in version 25.01, released on August 3, 2025. Note: CVE-2025-55188 is different than CVE-2025-11001. The version that CVE-2025-11001 was patched in version 25.00 is still...

CVE-2025-3464-AsIO3-LPE

CVE-2025-3464-AsIO3-LPE CVE-2025-3464: Unprivileged LPE exploit for ASUS AsIO3.sys - TOCTOU auth bypass + PreviousMode decrement CVE-2025-3464: AsIO3.sys Local Privilege Escalation This exploit will only work on Windows 11 22H2 or earlier. Microsoft fixed PreviousMode hijinks. Local privilege...

CVE-2026-29786

CVE-2026-29786 Research: Joshua van Rijswijk Description This repository contains a Proof of Concept PoC for CVE-2026-29786 , a vulnerability in the tar npm package that allows a crafted archive to create a hardlink pointing outside the intended extraction directory. The issue occurs when a tar...

CVE-2026-115424

A flaw in the OpenShift client (oc) allows for a symlink/hardlink target validation bypass during the oc image extract operation. The application fails to properly sanitize links pointing to absolute paths or sibling directories, enabling an attacker providing a malicious container image to write...

CVE-2026-115424 Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-18477 DESCRIPTION: A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a...

CLSA-2026-1791897081 python3: Fix of 4 CVEs

CVE-2026-11940: pass filterfunction through TarFile.extract so the hardlink-extraction fallback is filtered prerequisite - CVE-2026-11940: filter the symlink at the hardlink's own path so a hardlink to a deeper symlink cannot recreate it at a shallower path and escape the destination directory -...

CentOS Linux 7 [TuxCare] Security Update: python3 / python3-debug / python3-devel / python3-idle / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791896121)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791896121 advisory. - tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored...

CLSA-2026-1791897945 python3: Fix of 4 CVEs

CVE-2026-11940: pass filterfunction through TarFile.extract so the hardlink-extraction fallback is filtered prerequisite - CVE-2026-11940: filter the symlink at the hardlink's own path so a hardlink to a deeper symlink cannot recreate it at a shallower path and escape the destination directory -...

tox-dev filelock: race condition issue

The tox-dev filelock version 4.1.0 to 4.2.1 had a race condition vulnerability. This vulnerability stemmed from SoftFileLock’s ability to restore files by their name after removing an outdated marker. This allowed local users with rename privileges in non-sticky lock directories to replace symbol...

Linux Distros Unpatched Vulnerability : CVE-2026-47699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image...

CLSA-2026-1791896121 python3: Fix of 2 CVEs

CVE-2026-11940: pass filterfunction through TarFile.extract so the hardlink-extraction fallback is filtered prerequisite - CVE-2026-11940: filter the symlink at the hardlink's own path so a hardlink to a deeper symlink cannot recreate it at a shallower path and escape the destination directory -...

CVE-2026-62268

A maliciously crafted archive could contain a symlink e.g. "evil" - "/etc" followed by an item below it "evil/passwd", or an item whose path embeds ".." e.g. "a/../../etc/passwd". When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite files...

GHSA-GFP8-W835-V44J borg extract might modify out-of-tree files when extracting maliciously crafted archives

Impact A maliciously crafted archive could contain a symlink e.g. "evil" - "/etc" followed by an item below it "evil/passwd", or an item whose path embeds ".." e.g. "a/../../etc/passwd". When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite fil...

borg extract might modify out-of-tree files when extracting maliciously crafted archives

Impact A maliciously crafted archive could contain a symlink e.g. "evil" - "/etc" followed by an item below it "evil/passwd", or an item whose path embeds ".." e.g. "a/../../etc/passwd". When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite fil...

Astra Linux – vulnerability in busybox

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to...