EUVD-2026-95801

A missing release of resources in the illumos name service cache daemon nscd allows a local user to exhaust kernel memory. The nscd door server procedure, switcher in usr/src/cmd/nscd/nscdfrontend.c, does not close file descriptors that are passed with a door call but not used by the request, and...

cve-2026-43687

CVE-2026-43687 — Reverse engineering notes and reproduction Independent reverse engineering of the macOS NFS client access-cache race CVE-2026-43687, plus a working PoC that triggers the race and captures it live with dtrace. The bug is an unsynchronized read of the nfsnode access-cache pointer i...

K80Pro-miro-CVE-2026-64560

k80pro-miro-cve-2026-64560 CVE-2026-64560 userspace local privilege escalation port for Redmi K80 Pro miro. 🚀 Don't want to read all this documentation? If you don't want to dig deep , or don't want to read this pile of AI-generated.md files, go straight to dyc.md — a plain-language quick start:...

CVE-2026-19569

dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...

CVE-2026-19569 Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap

dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...

EUVD-2026-95529

dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...

CVE-2026-21007-GPU-Driver-ioctl-Race-Condition-Kernel-Memory-Mapping-

CVE-2026-21007 – GPU Driver ioctl Race Condition Kernel Memory Mapping Program Code C sim // gpudriversim.c - Simulated GPU driver ioctl with race condition include include include include void gpummap = NULL; sizet mapsize = 0; int locked = 0; void ioctlmapsizet size // Allocate GPU memory and m...

CVE-2020-1206-POC

CVE-2020-1206 Uninitialized Kernel Memory Read POC c 2020 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes POC to check for CVE-2020-1206 / "SMBleed" Expected outcome: Local file containing target computer kernel memory. Intended only for educational and testing in corporate...

CVE-2026-98200

A flaw was found in the Linux kernel's HP WMI Sensors hp-wmi-sensors driver. Due to a missing lock when reading sensor properties, a race condition can occur when sensor data is freed and replaced during an update while another operation is reading it. A local user could exploit this flaw by...

CVE-2026-98188

A flaw was found in the Linux kernel's p54 wireless driver. An attacker capable of connecting a malicious wireless device could cause a Denial of Service DoS by triggering a system crash. This issue occurs because the driver fails to validate data length parameters when reading calibration curve...

CVE-2019-2215

CVE-2019-2215 Temproot for Bravia TV via CVE-2019-2215. Overview Demonstration of a kernel memory R/W-only privilege escalation attack resulting in a temporary root shell. It works on Sony Bravia TV devices running the Android 8 PKG6.0724 firmware with kernel version 4.9.51. For this tool to work...

CVE-2026-36355

CVE-2026-36355: Realtek rtl819x Jungle SDK - Unauthenticated Kernel Memory Read/Write via Debug ioctls CVE : CVE-2026-36355 CWE : CWE-782, CWE-787, CWE-200 Discoverer : Daniil Gordeev Disclosed : 2026-05-03 Summary The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x out-of-tree "Jungle SDK"...

razer-lycosa-kernel-lpe-BYOVD-Vulnerability-PoC

Lycosa.sys, Razer: two kernel vulnerabilities reachable by any local user Discovered through https://github.com/416rehman/DeepZero Vendor: Razer Inc. Component: Lycosa.sys, the Razer Lycosa keyboard filter driver, x64 SHA-256: a120a6184ab16864e8a5f1dfd0cd178fca541de463b5cef946e18c34b9b6f716...

cheat-engine-undetectable

Cheat Engine Undetectable Academic Research Edition — Modified Cheat Engine with multi-tiered anti-cheat evasion for cybersecurity education and university-level reverse engineering research. Disclaimer: This project is exclusively for academic research, university coursework, and cybersecurity...

evil-mhyprot-cli

evil-mhyprot-cli Una PoC per il driver vulnerabile Mhyprot2.sys che consente la lettura/scrittura della memoria in kernel/user tramite un processo utente non privilegiato. libmhyprot Wiki Panoramica Cosa possiamo fare con questa CLI è il seguente: Leggere/Scrivere qualsiasi memoria del kernel con...

imMapper

imMapper A Demonstration on how to abuse the Vulnerable Driver AmdTools64. The Driver has the ability to only Read/Write Kernel Space Memory, as well as to Read/Write the MSR. This requires Admin Privileges. The driver is distributed trough the tool RGBFusion-2. Exclamation-mark This Demonstratio...

CVE-2026-84290

IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHODNEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileg...

CVE-2026-84290

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are affected by a vulnerability in the WfpMonitor kernel driver component. The root cause is an improper validation of user-supplied pointers , where certain METHOD_NEITHER IOCTL handlers dereference user-controlled pointers without suffi...

CVE-2026-84290 Security vulnerability affects the Windows S-TAP component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHODNEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileg...

EUVD-2026-95164

IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHODNEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileg...