nftables-oob-read-write-exploit-CVE-2023-35001-

nftables 越界读/写漏洞利用（CVE-2023-35001） 该漏洞利用在 2023 年温哥华 Pwn2Own 大赛中用于 Ubuntu 桌面系统。此漏洞利用支持赛事开始时可用的内核版本（5.19.0-35）。 要求 C 编译器 Go 编译器 用法 Build $ make Run $ ./exploit 运行后将生成一个 lpe.zip 文件，可在目标系统上解压。压缩包中有两个二进制文件： wrapper ：用于进入命名空间的 C 二进制程序 exploit ：实际的漏洞利用程序 应执行的程序是 exploit 文件。它通过 wrapper 程序调用自身并进入一个新的命名空间。...

CVE-2022-1015

CVE-2022-1015 关于 Linux 内核中越界读取与写入漏洞的详细分析及本地权限提升概念验证代码。 你可以在我的博客上找到该漏洞的深入分析，同样你也可以在那里找到我对 nftables 的介绍。 重要说明 本仓库提供的漏洞利用代码不应期望在开箱即用的易受攻击内核版本上成功运行。 不同内核构建之间会存在许多偏移量差异，当然也包括不同的 ROP 小工具。 有时，由于内核构建之间的差异，甚至可能不得不改变利用漏洞的方式。例如，David Bouman @pqlqpql 对该漏洞的另一篇分析文章（可在此查看）中，他使用 UDP 数据包 来利用漏洞——针对处理 UDP...

CVE-2026-100860 heym before 0.0.105 Authentication Bypass via Redis Node

heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node backend/app/services/nodeexecution/nodes/redisnode.py. When getaccessiblecredential returns None — because the credential ID does not exist or the caller is not authorized to use it —...

CVE-2026-100860 heym before 0.0.105 Authentication Bypass via Redis Node

heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node backend/app/services/nodeexecution/nodes/redisnode.py. When getaccessiblecredential returns None — because the credential ID does not exist or the caller is not authorized to use it —...

CVE-2026-100860

The software heym before version 0.0.105 contains an Authentication Bypass vulnerability in the Redis workflow node (backend/app/services/node_execution/nodes/redis_node.py). The root cause is that the application fails to act on the result of credential authorization lookups; if _get_accessible_...

CVE-2026-11645

CVE-2026-11645 - Google ChromeのV8におけるリモートコード実行脆弱性 簡単な使い方 python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe 悪用に関する注意点 重要度: HIGH CVSS: 8.8 影響: 機密性、完全性、可用性 公開日: 2026-06-09 技術概要 Google Chrome...

CVE-2025-25257

CVE-2025-25257 FortiWeb CVE-2025-25257 エクスプロイト https://pwner.gg/blog/2025-07-10-fortiweb-fabric-rce exp.py: 動作する完全なエクスプロイト。 signed.py: ファイル読み書きの単なる PoC。エクスプロイトの初期バージョン。...

huawei-p10-cve-2017-8890-unlock

Investigación sobre el desbloqueo del bootloader de Huawei P10 CVE-2017-8890 Este repositorio documenta un proyecto de investigación autorizado por el propietario que portó CVE-2017-8890 a un firmware de Huawei P10, convirtió el use-after-free del kernel en lectura/escritura arbitraria del kernel...

CVE-2026-27971_POC

CVE-2026-27971 — Qwik server$ 未认证 RCE PoC !WARNING 本仓库包含一个活跃的远程代码执行概念验证。请仅对您拥有或明确获授权测试的系统使用。作者对未经授权的使用或造成的损害不承担任何责任。 CVE-2026-27971 / GHSA-p9x5-jp3h-96mm 的独立 Python 概念验证，该漏洞是 Qwik server$ RPC 反序列化机制中的一个未认证远程代码执行漏洞。 该 PoC 可执行主动标记探测、执行命令、读取或写入文本文件，并在 Linux 或 Windows 目标上请求反向 Shell。它仅使用 Python 标准库。...

AZL-105278 CVE-2026-93834 affecting package qemu 10.1.0-1

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

UBUNTU-CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-93834 Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

EUVD-2026-87092

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-93834

A use-after-free vulnerability exists in the QEMU 9pfs subsystem due to a race condition between the main thread and a worker thread. When processing concurrent Tlcreate and Twalk requests, a malicious guest user can craft a fid path containing stale heap data . This allows the attacker to bypass...

CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-98039

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

DEBIAN-CVE-2026-98039

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

UBUNTU-CVE-2026-98039

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

CVE-2026-98039 bpf: Require MEM_PERCPU for percpu kptr stores

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...