CVE-2022-24481-POC

CVE-2022-24481-POC TL;DR Questa PoC è ricavata dall'exp SHA1:fec933b0c46366a1fb272bfaf82a8262597a8d75 e molti motori AV l'hanno rilevata come CVE-2022-24521. Dopo averla analizzata, ho scoperto che potrebbe essere l'exp per CVE-2022-24481, perché CVE-2022-24521 non è una vulnerabilità di type...

CVE-2022-37969

CVE-2022-37969 PoC per l'elevazione dei privilegi locale di Windows autori: Ricardo Narvaja & Daniel Kazimirow Solid Solo a scopo dimostrativo. L'exploit completo funziona su sistemi Windows 11 21H2 vulnerabili. PoC funzionante basato su informazioni pubblicate in precedenza da Zscaler Consulta...

POC_CVE-2025-29943_Write-what-where-Condition

StackWarp: PoC für CVE-2025-29943 Proof-of-Concept für die Hardware-Sicherheitslücke StackWarp CVE-2025-29943 bei AMD-Prozessoren. Dieser Fehler erlaubt einem Angreifer mit Administratorrechten auf einem Host Hypervisor, die Konfiguration der CPU-Pipeline zu manipulieren, um den Stack-Pointer...

CVE-2026-63388

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in buffereventsock.c when buffereventsocketsetconnaddress copies a kernel-supplied AFUNIX peer address into buffereventprivate.connaddress. Release builds compiled with NDEBUG disab...

CVE-2026-72215

In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Ensure 32-bit stack location for o32 promprintf In 64-bit configurations calling any firmware entry points from a kernel thread other than the initial one will result in a situation where the stack has been placed in t...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode process, planardecompressplanerle wrote into pDstData at nYDst+y nDstStep + 4nXDst + nChannel, without verifying that nYDst+nSrcHeight fits within the destination height or that...

CVE-2026-45198 GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control Firmware uses a pointer from non-secure memory belonging to the Rich Execution Environment RE...

CVE-2026-55737 Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format ETF binary to binarytoterm/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGETUPLEEXT term, the...

CVE-2026-55737 Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format ETF binary to binarytoterm/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGETUPLEEXT term, the...

SUSE CVE-2026-26965

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, planardecompressplanerle writes into pDstData at nYDst+y nDstStep + 4nXDst + nChannel without verifying that nYDst+nSrcHeight fits in the destination height or that...

CVE-2026-46081

A flaw was found in the Linux kernel's asynchronous compression acomp subsystem. When an asynchronous hardware implementation, such as the QAT driver, completes a request that uses the DMA virtual address interface, an incorrect pointer is stored. This leads to memory corruption within the...

UBUNTU-CVE-2026-46081

In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - fix wrong pointer stored by acompsavereq acompsavereq stores &req-chain in req-base.data. When acompreqchaindone is invoked on asynchronous completion, it receives &req-chain as the data argument but casts it...

CVE-2026-46081

CVE-2026-46081 is a Linux kernel vulnerability in the crypto/acomp subsystem. The issue arises when an asynchronous hardware implementation (e.g., QAT) completes a request using the DMA virtual address interface, causing acomp_save_req() to store a pointer to the wrong object in req->base.data...

JLSEC-2026-305

HDF5 Library through 1.14.3 has a SEGV in H5Tclosereal in H5T.c, resulting in a corrupted instruction pointer...

JLSEC-2026-302

HDF5 Library through 1.14.3 has a SEGV in H5Aclose in H5Aint.c, resulting in the corruption of the instruction pointer...

JLSEC-2026-322

HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5Olayoutencode in H5Olayout.c, resulting in the corruption of the instruction pointer...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006799)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006799 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: fix check for attempt to corrupt spilled pointer When register is spilled onto a stack as a...

Linux kernel 安全漏洞

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from null pointer dereferencing, potentially leading to null pointer corruption...

CVE-2026-26965

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, planardecompressplanerle writes into pDstData at nYDst+y nDstStep + 4nXDst + nChannel without verifying that nYDst+nSrcHeight fits in the destination height or that...

CVE-2026-26965 FreeRDP has Out-of-bounds Write

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, planardecompressplanerle writes into pDstData at nYDst+y nDstStep + 4nXDst + nChannel without verifying that nYDst+nSrcHeight fits in the destination height or that...