CVE-2021-40438

CVE-2021-40438 exploit PoC with Docker setup CD into the directory containing the Apache configuration and Dockerfile shared in repo. Building Image: docker build -t cve-2021-40438:1.0 . Running the Docker Image: docker run --rm -d -p 4444:80 cve-2021-40438:1.0 Note: You can also use Image ID...

EUVD-2026-121705

pgEdge Control Plane generates pghba.conf with trust authentication for local and loopback connections...

dirty_sock

dirtysock: Linux Privilege Escalation via snapd In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains the original exploit POC, which is being made available for research and education. F...

openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...

openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...

CVE-2024-31317

CVE-2024-31317 Preface A couple of days ago, I saw an analysis of the CVE-2024-31317 vulnerability posted on JD's official account. After reading it through, I found it quite interesting. Moreover, the current mainstream solutions for automotive IVI In-Vehicle Infotainment are all based on Androi...

CVE-2026-83603-LPE-PoC

CVE-2026-83603-LPE-PoC A PoC for ZDI-CAN-28834/CVE-2026-83603, which allows local privilege escalation using netdata and fail2ban-client History This bug was discovered by me on Dec 31, 2026. It was acquired by Zero Day Initiative who are great, by the way!, and disclosed to the vendor on Jan 22,...

CVE-2026-125323

pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pghba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top ...

CVE-2026-125323

pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pghba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top ...

PT-2026-141870

Name of the Vulnerable Software and Affected Versions pgEdge Control Plane versions 0.1.0 through 0.10.1 Description The application generates pg hba.conf files containing hard-coded trust entries for Unix-socket and loopback connections. Since PostgreSQL processes this file sequentially from top...

suricata_exporter

Suricata Prometheus Exporter This is a Prometheus Exporter for Suricata using dump-counters via the unix socket to query metrics. Usage $ ./suricataexporter -h Usage of ./suricataexporter: -suricata.socket-path string Path to the Suricata Command socket. default "/var/run/suricata.socket" -versio...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: AppArmor: fix race in unix socket mediation when peerpath is used Holding a reference to the peersk is not enough to ensure access to the peersk path. Accessing the path outside of the state lock allows for a race with...

SUSE CVE-2026-116497

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

DEBIAN-CVE-2026-116497

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

CVE-2026-116497

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

UBUNTU-CVE-2026-116497

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

CVE-2026-116497

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

EUVD-2026-109941

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

CVE-2026-116497 Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

CVE-2026-116497 Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...