flow_divert-heap-overflow

flowdivert-heap-overflow flowdivert-heap-overflow is a proof-of-concept exploit for CVE-2016-1827, which was patched in OS X El Capitan 10.11.5 and iOS 9.3.2. The vulnerability is a series of unchecked arithmetic operations on an untrusted length supplied from user space in the function...

CVE-2019-8852

CVE-2019-8852 A tfp0 bug for macOS 10.15.1 and below. Warranty Use it on your own risk. This will make you macOS panic. I build it for security researchers only. Current state Just a PoC, convert the vulnerability to a useful UAF. Tested on macOS 10.14.6 18G103 , MacBook Pro with 16 GB RAM. Credi...

CVE-2022-25636

CVE-2022-25636 Este es mi exploit para CVE-2022-25636. Lo probé contra Ubuntu 21.10 con el kernel 5.13.0-30. Funciona aproximadamente el 40% de las veces, en los otros casos probablemente obtengas un pánico del kernel. El exploit podría corromper datos importantes en el heap, después de un intent...

CVE-2025-39866

CVE-2025-39866 - use-after-free Author: Byte Reaper Description This POC attempts to exploit the CVE-2025-39866 vulnerability, which is a flaw in Linux systems iwb” and schedules the critical free via “wbputmany”. step 3 : - thread 2 : free wbolb - thread 1 - pointer - free object wb free old -...

CVE-2022-36946

CVE-2022-36946 Reportado por: Domingo Dirutigliano y Nicola Guerrera Mientras trabajábamos en firegex, nuestro firewall de aplicación para competiciones CTF Attack-Defence, nos topamos con algunos kernel panics. Este extraño comportamiento fue luego aislado y analizado, llevando al descubrimiento...

CVE-2025-29338

CVE-2025-29338 — Security Advisory Buffer Overflow in NXP moal.ko Wi-Fi Kernel Driver woalsetupmoduleparam / parsecfggetline Field| Value ---|--- CVE ID| CVE-2025-29338 Severity| High CVSS v3.1 Score| 7.8 CVSS v3.1 Vector| CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Vulnerability Type| Stack-Bas...

GenEtherExploit

ES GenEtherExploit es un exploit de prueba de concepto PoC para la vulnerabilidad de macOS CVE-2023-40404. Este PoC utiliza las APIs de IOKit para interactuar con el servicio de red IOUserEthernetResource, manipulando las interfaces de red del sistema. El propósito de este exploit es demostrar un...

IOHIDFamily-PoC-Research

CVE-2026-28992 — PoC de FastPathUserClient de IOHIDFamily Repositorio de investigación de seguridad. Dos aplicaciones PoC que demuestran las condiciones de carrera en IOHIDFamily's FastPathUserClient en iOS 18.7.1 y anteriores. ⚠️ Ambos PoCs provocarán un kernel panic y reiniciarán tu dispositivo...

CVE-2024-27804

CVE-2024-27804 root@kitploit: ./build.sh ./panic.sh root@kitploit: paniccpu 4 caller 0xfffffe0026851cdc: Unaligned kernel data abort. at pc 0xfffffe0026aed514, lr 0xfffffe0026aed5d8 saved state: 0xfffffe3a396e3200 x0: 0x000000000000000e x1: 0xfffffe1002bdc01b x2: 0x0000000000000000 x3:...

CVE-2026-43499

CVE-2026-43499 — Linux Kernel Futex PI Use-After-Free Bug removewaiter in kernel/locking/rtmutex.c is used by the slowlock paths but also for proxy-lock rollback in rtmutexstartproxylock when invoked from futexrequeue. In the proxy-lock case waiter::task is not current, but removewaiter incorrect...

sysctl_coalition_get_pid_list-dos

sysctlcoalitiongetpidlist-dos Die Funktion sysctlcoalitiongetpidlist in bsd/kern/syscoalition.c verwendet die Funktion coalitiongetpidlist, um eine Liste von PIDs in einer Koalition zu sammeln. Diese Funktion gibt bei Erfolg die Anzahl der PIDs oder bei Fehlschlag einen negativen errno zurück...

CVE-2026-28992-IOHIDFamily-FastPathUserClient-Race-Conditions

CVE-2026-28992: Condizioni di gara in IOHIDFamily FastPathUserClient CVE-2026-28992 | Autore: Johnny Franks @zeroxjf Componente: IOHIDFamily Impatto: Un attaccante potrebbe causare la terminazione imprevista di un'app Descrizione: Una vulnerabilità di corruzione della memoria è stata risolta...

CVE-2026-43499-PoC-Scanner

CVE-2026-43499 PoC-Scanner Dieses Repository enthält einen Go-basierten Scanner und eine Proof-of-Concept-Implementierung für eine Linux-Kernel-Sicherheitslücke im Zusammenhang mit CVE-2026-43499. Das Projekt ist ausschließlich für Forschung, defensive Analyse und autorisierte Sicherheitstests...

ScreenOff

ScreenOff CVE-2026-52910 PoC di crash del kernel. riferimento: https://github.com/5unkn0wn/security-research/tree/CVE-2026-52910ltscosmitigation Cosa socket + SOATTACHREUSEPORTCBPF + setsockopt race condition. La tempesta di callback timerfd/epoll rallenta il percorso di ricezione. Sostituire il...

CVE-2023-6931

CVE-2023-6931 Kernel Panic PoC für CVE-2023-6931 Beschreibung CVE-2023-6931 ist eine Schwachstelle in perfevent, die zu einem Heap-Pufferüberlauf führt, verursacht durch einen Integer-Überlauf im readsize einer Gruppe. Was ist ein Performance-Ereignis perf event? perfevents ist ein vom Linux-Kern...

CVE-2026-80695

In the Linux kernel, the following vulnerability has been resolved: hwmon: sht3x Fix unaligned accesses Sashiko reports: In sht3xupdateclient, the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16tocpup. The pointers passed to this function are...

AZL-98075 CVE-2026-80695 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: hwmon: sht3x Fix unaligned accesses Sashiko reports: In sht3xupdateclient, the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16tocpup. The pointers passed to this function are...

CVE-2026-80644

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

CVE-2026-80625

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix memory leak of bonding resources In a corner case of concurrent driver removal and driver reset, bonding resource is first released in hnsrocehwv2exit during driver removal, and then is allocated again in...

CVE-2026-80604

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hidgetreport for numbered reports When a caller passes a size of 0 to hidreportrawevent for a numbered report, the function originally called hidgetreport before performing any size validation. Inside...