CVE-2018-4878

Author and Credits Author: Vincent Yiu @vysecurity Credits: @evi1cg: Helping me test and keep me motivated @smgoreli: Original Calc.exe PoC @kbandla: He knows, and I know. ; Disclaimer Developed to encourage more Aggressor script development. Use only in authorized penetration testing! Descriptio...

CVE-2021-40444

Fully Weaponized CVE-2021-40444 Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution, works with arbitrary DLL files. Background Although many PoC are already around the internet, I guessed to give myself a run to weaponizing this vulnerability, as what I...

CVE-2018-8174

CVE-2018-8174 MS Word MS WordPad via IE VBS Engine RCE MS Word and MS WordPad RCE via IE VBS RCE https://github.com/smgorelik/Windows-RCE-exploits/tree/master/Web/VBScript Save the index.html to webserver then use the python script to generate RTF Exploit Shellcode is static Down\Exec Putty.exe...

CVE-2021-1965

CVE-2021-1965 CVE-2021-1965 WiFi Zero Click RCE Trigger PoC This is a quick&dirty Proof-of-Concept code to verify if your phone is vulnerable. After running the poc code, your phone is supposed to crash&reboot within seconds. In case you need more info about the bug & vulnerable code, here you ar...

CVE-2021-40444

Fully Weaponized CVE-2021-40444 Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution, works with arbitrary DLL files. Update 31/05/2022 - CVE-2022-30190 - Follina Now the generator is able to generate the document required to exploit also the "Follina"...

Fake_CVE-2020-1350

FakeCVE-2020-1350 This is the source code for a very crude fake CVE-2020-1350 exploit tool, which developed as part of honeypot repository for the SIGRed vulnerability, with the goal of tracking/mapping interest and attempts to use exploits for this critical vulnerability. This project was...

CVE-2024-53027-WIP

CVE-2024-53027-WIP Work in Progress for POC CVE-2024-53027: Qualcomm Bluetooth/Wi-Fi Vulnerability 📄 Overview CVE-2024-53027 is a medium-severity vulnerability CVSS unrated affecting Qualcomm’s WLAN and Bluetooth chipsets in Android devices. It can cause transient denial-of-service DoS when...

Linux Distros Unpatched Vulnerability : CVE-2026-98889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq...

UBUNTU-CVE-2026-98889

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

CVE-2026-98889 wifi: iwlwifi: mvm: fix sched scan IE sizing

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

CVE-2026-98889

The Linux kernel 's iwlwifi driver contains a vulnerability where scheduled scans built probe requests before the iwl_mvm_scan_fits() check. This allowed oversized Information Elements (IEs) to be copied into a fixed preq buffer without prior length validation . To resolve this, the driver was up...

CVE-2026-98889

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

PT-2026-120772

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bt a2dp codec ie, a one-byte len field plus a fixed 8-byte codec ie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dp process config ind in subsys/bluetooth/host/classic/a2dp.c copied only the first ...

CVE-2026-98823

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211updateassocbssentry can pass such an entry to cfg80211updateknownbss when...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8723bs: Fixed an issue where the OOB read was performed in the IE parsing loop during OnAssocRsp. The IE parsing loop in OnAssocRsp advances by pIE-length + 2 with each iteration, but it only checks for i length fr...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to a out-of-bounds read in ntfsielookup in NTFS-3G before version 2021.8.22...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath6kl – Fix for out-of-bounds reads during IE parsing when accessing the fields beaconielen, assocreqlen, and assocresplen in the ath6klwmiconnecteventrx function. The fields beaconielen, assocreqlen, and assocresplen that...

CVE-2026-108102 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...

CVE-2026-108102

The Open5GS project (versions through 2.8.0 ) contains a heap out-of-bounds read vulnerability within the ogs_pfcp_parse_volume_measurement() function in lib/pfcp/types.c. This flaw allows remote unauthenticated attackers to read past Information Element (IE) buffers by sending a PFCP Session Rep...

CVE-2026-107737

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...