CVE-2026-101341

The NSD name server is vulnerable to an out-of-bound stack write due to insufficient bounds checking on text tokens in RDATA (e.g., TXT records ) under 32 bytes. This flaw allows for arbitrary sized writes , including the potential overwrite of a callback function pointer immediately following a ...

EUVD-2026-100985

Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...

CVE-2026-101341 Stack overwrite from specially formatted TXT-DATA RDATA field

Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...

CVE-2026-12166_CVE-2026-12167_CVE-2026-12168

Multiple Local Privilege Escalation Vulnerabilities in Little Orbit GFAC Driver GFACSysx64.sys | ---|--- CVE IDs| CVE-2026-12166, CVE-2026-12167, CVE-2026-12168 Vendor| Little Orbit Product| GamersFirst Anti-Cheat GFAC Driver GFACSysx64.sys Affected Versions| No version information is embedded in...

firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...

firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...

CVE-2026-88842

A flaw exists in the BusyBox dpkg utility where the write_status_file() function fails to reset a field cursor between package stanzas. This results in an out-of-bounds read and leads to limited data corruption when two packages are removed in a single invocation, specifically if the first stanza...

ghostlock-sabrina

GhostLock Sabrina Root exploit for Chromecast with Google TV sabrina via CVE-2026-43499 -- a use-after-free in the Linux kernel's futex PI priority inheritance subsystem. Achieves root on a locked bootloader device running Android 14 with kernel 5.15.170 PGO+BOLT+LTO, clang 17. The vulnerability...

firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...

firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...

CVE-2025-65018_Exploit_Challenge

CVE-2025-65018 CTF Challenge: "PNG Panic" This challenge is based on a real-world buffer overflow vulnerability in libpng specifically dealing with the simplified API pngimagefinishread when handling 16-bit interlaced images. 🚩 Challenge Goal You are provided with a vulnerable binary victim that...

CVE-2023-3338-DECPwn

DECPwn Practicing different Linux kernel exploitation techniques with my DECnet vulnerability and null page mapping enabled. Scenarios Everything disabled : qemu-system-x8664 -append "nosmap nosmep nopti nokaslr" Code execution is redirected to the output function in userland, which invokes...

firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...

CVE-2015-8543_for_SLE12SP1

$cat /etc/-release PRETTYNAME="SUSE Linux Enterprise Server 12 SP1" $id uid=1000jeremysp1 gid=100users groups=100users $sudo sh disablesecurity.sh $gcc exp.c -o exp 2/dev/null $../nsjail/nsjail -Mo --user 0 --group 0 --keepcaps --chroot / -- /bin/sh -i sh-4.2 /home/jeremysp1/nullpointerderf/exp +...

CVE-2017-11176

CVE-2017-11176 Proof of concept for CVE-2017-11176 for code execution. Vulnerability The mqnotify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial...

php_hack

This tool exploits a vulnerability called CVE-2019-11043, an instance of insecure pointer arithmatic, to gain access to poorly configured PHP servers. It can be downloaded here you will need to run it from the command line Usage: phphack target IP target port...

CVE-2024-38041

CVE-2024-38041 Kernel pointers copied to output user mode buffer with ioctl 0x22A014 in the appid.sys driver...

EUVD-2026-100749

Libreswan has a null pointer dereference bug in the PKCS7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERTPKCS7WRAPPEDX509, it guards the PKCS7 blob with SECPKCS7ContainsCertsOrCrls and then iterates the certificate list with...

EUVD-2026-100748

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a...

CVE-2026-98412

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrsequnitnew If memory allocation fails in pwrsequnitsetupdeps, pwrsequnitput is called to release the partially initialized unit. However, we've never initialized unit-list and...