LeakedHandlesFinder

LHF - 유출된 핸들 찾기 유출된 Windows 프로세스 핸들을 식별하는 도구입니다. 침투 테스트 중 새로운 LPE 취약점을 식별하거나 새로운 연구 과정으로 유용합니다. 현재 유출된 프로세스 핸들을 익스플로잇autopwn하여 새로운 임의 프로세스기본 cmd.exe를 생성하는 것을 지원합니다. LHF는 실시간으로 상속된 핸들을 식별하고 연구자에게 익스플로잇 가능성 팁을 제공합니다. rootedcon 2022에서 발표됨 https://www.rootedcon.com/ponentes-rooted2022/. 발표 자료 -...

ghostlock-emerald

POCO M6 Proemerald용 GhostLock GhostLockCVE-2026-43499은 futex 우선순위 상속 코드에 존재하는 15년 된 Linux 커널 use-after-free 취약점으로, 모든 로컬 사용자가 root 권한을 얻을 수 있게 합니다. 이 프로젝트는 이 취약점을 사용하여 POCO M6 ProMediaTek Helio G99 Ultra / MT6789를 루팅하고 잠긴 부트로더에 KernelSU를 설치합니다. 커널: 6.12.30-android16-5-g6e872b4863d6-ab13847919-4k ...

GhostLock-OPPO-PCKM00

GhostLock — OPPO PCKM00 4.14.180 PoC CVE-2026-43499 GhostLock — Linuxカーネルfutex優先度継承における use-after-freeを利用したローカル権限昇格PoC。OPPO PCKM00 OP4A57, SM6150, Android 11, kernel 4.14.180-perf+ 向けに移植。 DISCLAIMER / 免責事項 このプロジェクトは認可されたセキュリティ研究および教育目的のみ を対象としています。 所有していないデバイス、または明示的にテストを許可されていないデバイスでは使用しないでください。...

pixel-ksu-root

pixel-ksu-root ロックされたブートローダーのままの純正Google Pixelを、非特権のadb shellからカーネルCVEを使ってroot化する — アンロックもフラッシュもベンダーの協力も不要。...

ghostlock-sabrina

GhostLock Sabrina Root exploit for Chromecast with Google TV sabrina via CVE-2026-43499 -- a use-after-free in the Linux kernel's futex PI priority inheritance subsystem. Achieves root on a locked bootloader device running Android 14 with kernel 5.15.170 PGO+BOLT+LTO, clang 17. The vulnerability...

DEBIAN-CVE-2026-82531

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2026-82531

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2026-82531 Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

EUVD-2026-93376

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2026-82531 Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2026-82531

The Smarty template engine, in versions prior to 4.5.8 and 5.x before 5.8.5 , is vulnerable to a PHP Code Injection flaw. The root cause is that the top-level nocache_hash is not restored during extends:/ multi-component template inheritance, leaving it null. This allows an attacker to provide as...

CVE-2026-82531 Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

PT-2026-106715

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.8 Smarty versions 5.x prior to 5.8.5 Description A code injection flaw exists during multi-component template inheritance where the top-level nocache hash is not restored and remains null. This allows an attacker t...

CVE-2026-43499

👻 CVE-2026-43499 — GhostLock 15年前のGhostLockの脆弱性がほとんどのLinuxディストリビューションでルート権限取得とコンテナエスケープを可能にする GhostLock は、Linuxカーネルのrtmutex サブシステムにおける高深刻度のUse-After-Free UAF脆弱性です。この欠陥は、Priority Inheritance PI処理中の誤ったウェイタークリーンアップに起因し、カーネルメモリの破壊、ローカル権限昇格、またはサービス拒否を引き起こす可能性があります。 📑 目次 概要 技術概要 根本原因 攻撃フロー 影響 影響を受けるバージ...

ghostlock-oneplus

GhostLock — Locked Bootloader Jailbreak Kernel exploit for Android devices with locked bootloader. Achieves temporary root + KernelSU installation without unlocking bootloader or modifying boot image. Runtime auto-detection of kernel version with multi-device offset table. Vulnerability...

CVE-2026-93355 LiteLLM Weak JWT Authentication via Email-Based User Lookup

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...

CVE-2026-100566 OpenClaw LINE before 2026.8.1 Access Control Inheritance

OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restriction...

CVE-2026-100566 OpenClaw LINE before 2026.8.1 Access Control Inheritance

OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restriction...

CVE-2026-100541

OpenClaw's Matrix integration npm package @openclaw/matrix versions = 2026.2.2 and 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matr...

CVE-2026-100541: Improper Handling of Case Sensitivity

OpenClaw's Matrix integration npm package @openclaw/matrix versions = 2026.2.2 and 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matr...