CVE-2023-6702

Chrome Renderer 1day RCE via Type Confusion in Async Stack Trace CVE-2023-6702 Summary This vulnerability allowed a remote attacker to execute arbitrary code inside the Chrome renderer process. There was an insufficient type check in the async stack trace handling code. It leads to a type confusi...

Vulnerability_PoC

El PoC/Exploit de algunas vulnerabilidades interesantes Autor: Equipo de Investigación de Vulnerabilidades de Numen Cyber Labs 1. Vulnerabilidad RCE de TCP/IP CVE-2022–34718: restauración y análisis del PoC...

CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter

CVE-2026-85046 + CVE-2026-87491 Was doing a ton of reading over at https://github.com/Serotav/Writeups. Decided to combine 85046 with 87491 and bake in some WASM at the same time. Went and re-did a stage1.js for an eventual ubuntu LPE I'm cooking. The basics: Confuse packed object and integer...

CVE-2026-2441-PoC

CVE-2026-2441-PoC PoC de CVE-2026-2441 PoC de Use-After-Free en CSS de Chrome Blink CSSFontFeatureValuesMap PoC que desencadena UAF en el procesamiento de CSS → RCE del renderizador dentro del sandbox en Chrome =144.0.x todas las plataformas. Desencadenante: @font-feature-values + container-query...

CVE-2026-2441-PoC

CVE-2026-2441 — Use-After-Free en CSSFontFeatureValuesMap de Chrome CVSS 8.8 Alto | Explotado activamente en la naturaleza | RCE en el renderizador con sandbox Una vulnerabilidad de use-after-free en el motor CSS Blink de Google Chrome que permite a un atacante remoto ejecutar código arbitrario...

CVE-2026-2441

CVE-2026-2441 — Chrome CSSFontFeatureValuesMap 释放后使用 CVSS 8.8（高危） | 已在野外被积极利用 | 渲染器远程代码执行（沙箱内） Google Chrome 的 Blink CSS 引擎中存在释放后使用漏洞，允许远程攻击者通过精心构造的 HTML 页面在浏览器沙箱内执行任意代码。 漏洞详情 字段| 值 ---|--- CVE| CVE-2026-2441 CVSS| 8.8（高危） 类型| 释放后使用（CWE-416） 组件| Blink CSS — CSSFontFeatureValuesMap 源文件|...

CVE-2026-44670 SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View AV / database names without any HTML escape, then a render template uses raw strings.ReplaceAlltpl, "$avName", nodeAvName to embed the name in HTML before pushing to all clients via...