pwn2own2020

Compromising the macOS Kernel through Safari by Chaining Six Vulnerabilities Overview 이 저장소에는 macOS 10.15.3에 대한 커널 권한 상승을 통해 Apple Safari를 대상으로 한 우리의 Pwn2Own 2020 우승 제출물의 악용 및 기술적 세부 정보가 포함되어 있습니다. 추가 정보는 우리의 Blackhat USA 2020 슬라이드 및 비디오에서 확인할 수 있습니다. 또한 이 저장소에는 성공적인 악용을 위한 데모 비디오가 포함되어 있습니다. How...

Pixel_GPU_Exploit

Mali GPU 커널 LPE 이 글은 구글에 독립적으로 식별하여 보고한, 기본 애플리케이션 샌드박스에서 접근 가능한 Mali GPU 내의 두 가지 커널 취약점에 대한 심층 분석을 제공합니다. 임의의 커널 읽기/쓰기 기능을 달성하는 커널 익스플로잇을 포함합니다. 결과적으로, SELinux를 비활성화하고 다음 Android 14 버전을 실행하는 Google Pixel 7 및 8 Pro 모델에서 root 권한을 상승시킵니다: Pixel 8 Pro:...

cve-2026-43499-firetv-sheldonp-writeup

CVE-2026-43499 on Amazon Fire TV Stick 3rd Gen sheldonp Chaining a Linux kernel privilege escalation into a preloader downgrade and bootloader unlock. Overview This repository documents my authorized reproduction of the CVE-2026-43499 exploitation chain on an Amazon Fire TV Stick 3rd Gen sheldonp...

OHTS

OHTS Microsoft Windows - 'afd.sys' 로컬 커널 권한 상승 익스플로잇 보고서 CVE-2011-1249...

EUVD-2026-89173

Attacker model / Preconditions: a loaded TXMMODULEUSERMODE | TXMMODULEMEMORYPROTECTION module issuing kernel dispatch calls, on a build with TXENABLEEVENTTRACE. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it...

ghostlock-apk

GhostLock APK 독립 APK: CVE-2026-43499 GhostLock 커널 권한 상승 + Shizuku shell 신원 실행. 사전 요구 사항 HONOR AAK-AN00 / MagicOS 10 / Linux 6.6.89 / 4KB 페이지 Shizuku 설치 및 adb 방식으로 시작됨 adb shell sh /sdcard/Android/data/moe.shizuku.privileged.api/start.sh USB 디버깅 승인됨 작동 원리 1. Shizuku UserService : APK가 시작되면 Shizuku...

EUVD-2026-78104

A race condition was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A sandboxed app may be able to execute arbitrary code with kernel...

PT-2026-91654

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.7 iPadOS versions prior to 26.7 iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 macOS Sequoia versions prior to 15.8 macOS Tahoe versions prior to 26.7 tvOS versions prior to...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock for NVIDIA Shield TV Pro 9.2.4 Validated arm64 po...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Ipados

CVE-2026-65330 — tmpfs setxattr PAC Bypass Component: XNU...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.72 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.72 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Exploit for Use After Free in Google Android

CVE-2019-2215 Temproot for Pixel 2 and Pixel 2 XL via CVE-...

CVE-2026-53996: Missing Authorization

NetBSD's hdaudio4 driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIOFGRPSETCONFIG ioctl without elevated permissions by exploiting the absence of an access check on /dev/hdaudioN device nodes. Attacker...

Photon OS 5.0: Linux PHSA-2025-5.0-91-0538

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0538. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

The vulnerability of the `execve` system call in FreeBSD’s kernel allows a hacker to gain full control over the system.

The vulnerability of the execve system call in FreeBSD operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain full control over the system...

kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources

A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation TLBI operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local...

CVE-2026-10682

The userspace verifier zvrfylogfilterset for the logfilterset syscall in subsys/logging/logmgmt.c performed a signed comparison against the int16t srcid parameter: srcid int16tlogsrccntgetdomainid. Any negative value for srcid e.g. -1 trivially satisfied this check and was forwarded into...

KB5101650: Windows 11 Version 24H2 / Windows 11 Version 25H2 Security Update (July 2026)

The remote Windows host is missing security update 5101650. It is, therefore, affected by multiple vulnerabilities - Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network. CVE-2026-58594 - Heap-based buffer overflow in Windows FTP Service...

USN-8501-1: Linux kernel vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

CVE-2026-45250 Stack buffer overflow via setcred(2)

The setcred2 system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length. If the supplied list exceeds the capaci...