NotCVE-2026-0010

概要 脆弱性: Barrier デーモン TCP ポート 24801 を介した、認証なしの IPC による SYSTEM へのローカル権限昇格 ベンダー: debauchee Barrier プロジェクト 製品: Barrier 2.4.0 最終リリース、2021-11-01 CWE: CWE-306: 重要な機能に対する認証の欠如 説明 Barrier の Windows サービス barrierd.exe は LocalSystem としてインストールおよび実行され、認証、クライアント ID 検証、アクセス制御なしで TCP IPC コントロール サーバーを...

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE このエクスプロイトは、CVE-2019-16098を再構築して利用するものです。この脆弱性は、ドライバーMicro-Star MSI Afterburner...

PrintSpoofer

PrintSpoofer Windows 10 および Server 2016/2019 上で SeImpersonatePrivilege を悪用して LOCAL/NETWORK SERVICE から SYSTEM へ昇格します。 詳細: https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/. 使用方法 -h オプションを使用してヘルプメッセージを確認できます。 root@kitploit: C:\TOOLSPrintSpoofer.exe -h PrintSpoofer v0.1 by @itm4n...

iqvw64e-privilege-escalation

iqvw64e-privilege-escalation CVE-2015-2291 ローカル権限昇格 PoC 概要 このプロジェクトは、CVE-2015-2291 に関連する Intel イーサネット診断ドライバである iqvw64e.sys（SHA256: 37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9）のローカル権限昇格（LPE）脆弱性に対する教育用の概念実証（PoC）です。 KDMapper のようなカーネルモードローダーでこのドライバが悪用されているのを見て、IOCTL ディスパッチの仕組み...

CVE-2020-11492

CVE-2020-11492 Docker Desktop for Windows の権限昇格の脆弱性に対する Proof-of-Concept PoC です。この脆弱性は、2020年5月11日にDockerバージョン2.3.0.2で修正されました。 このPoCは以下のことを行います: dockerの名前付きパイプ \.\pipe\dockerLifecycleServer を模倣する名前付きパイプを作成し、 dockerサービスからの接続後に ImpersonateNamedPipeClient を呼び出し、 現在のスレッドから偽装されたアクセストークンを取得して複製し、...

EUVD-2026-62956

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The improp...

CVE-2026-76391

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The improp...

CVE-2026-76391 Improper Privilege Management through Agent Run History in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The improp...

PT-2026-78818

Name of the Vulnerable Software and Affected Versions Splunk AI Toolkit versions prior to 6.0.0 Description Improper privilege management in the Agent Run History handler allows users without admin or power roles to execute searches with system-level privileges. This occurs because the handler...

Privilege escalation vulnerability via unprotected IOCTL interface in Pegatron Tdelo64.sys

Overview A privilege escalation vulnerability exists in the tdeio64.sys driver due to an unprotected input/output control IOCTL dispatch routine that fails to validate the origin and permissions of user-supplied requests. An unprivileged local attacker can abuse exposed IOCTL dispatch routines...

GO-2026-5711 Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline

Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline...

fox-foxone-exploit

markdown FoxFOXONE Driver Exploit Local privilege escalat...

Exploit for CVE-2026-0828

CVE-2026-0828 — Safetica ProcessMonitorDriver.sys BYOVD PoC S...

MS16-032-Cobalt-Strike-LPE-BOF

MS16-032 Beacon Object File BOF A Cobalt Strike Beacon Obje...

Exploit for CVE-2026-29923

CVE-2026-29923 — pstrip64.sys Local Privilege Escalation A mi...

CVE-2026-4858

Mattermost CVE-2026-4858 affects versions 11.6.x, 11.5.x, 11.4.x and 10.11.x where the integration action URL does not properly validate path traversal. This allows a malicious authenticated user to call an arbitrary API using the system admin Mattermost token by exploiting the path traversal in ...

Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

Summary The Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL when the user omits the token parameter. A tenant with TaskRun or PipelineRun create permission can exfiltrate the shared API token GitHub PAT, GitLab token, etc. by...

CVE-2026-40161

Summary: Tekton Pipelines before 1.10.0, specifically the git resolver in API mode, can exfiltrate system-configured Git tokens when the token parameter is omitted. Affected software: Tekton Pipelines git resolver (API mode), versions 1.0.0–1.10.0. Vulnerability details: In API mode, the resolver...

CVE-2026-34990 OpenPrinting CUPS: Local print admin token disclosure using temporary printers

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That...

CVE-2025-63691

In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface /api/admin/sys-token/page has an improper permission verification issue, which leads to information leakage. This interface can be called by any user who...