CVE-2026-19542 Stack-based out-of-bounds write in tdelete during tree rebalancing

Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as...

CVE-2026-19542 Stack-based out-of-bounds write in tdelete during tree rebalancing

Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as...

EUVD-2026-77685

Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as...

CVE-2026-19542

CVE-2026-19542 is a stack-based out-of-bounds write in the tdelete function of the GNU C Library (glibc) versions 2.1 through 2.44. The root cause is that two rebalancing branches in tdelete push an entry onto an alloca-allocated parent-node stack without checking capacity, writing one pointer pa...

CVE-2025-8110-gogs-poc

CVE-2025-8110 — Gogs 任意文件写入 PoC 针对 Gogs 中已验证用户任意文件写入的概念验证。 通过推送包含指向仓库外部的符号链接的仓库，然后通过 API 更新该链接的内容，已验证用户可以以运行 Gogs 账户的权限覆盖主机上的文件。 仅限授权测试和教育用途。 仅在您拥有或已获得明确书面许可的系统上运行此程序。您对使用方式负责。 工作原理 1. 使用现有账户向 Gogs 进行身份验证。 2. 从用户设置生成应用程序（API）令牌。 3. 创建一个仓库。 4. 添加一个符号链接（maliciouslink - /path/on/host）并推送。 5. 向...

CVE-2026-31694-POC

CVE-2026-31694: FUSE readdir 缓存越界写入 fs/fuse/readdir.c:fuseadddirenttocache 中缺少边界检查。一个 FUSE 服务器返回一个 namelen = 4095 的目录项，序列化后为 4120 字节的记录。内核将其复制到一个 4096 字节的页缓存页中，并溢出 24 个服务器可控字节到下一个物理页。 本仓库包含一个用于写入原型的标记 PoC，以及一个本地提权利用，该利用将溢出整理到 /etc/passwd 的页缓存副本上，并将 root 账户改为无密码账户。 受影响：Linux 6.15+（FUSENAMEMAX 提升到...

IKEV2-POC

EpSiLoNPoInTIkEv2.cpp ⚠️ 项目正在收尾阶段。目前状态尚未完全可用。 描述 EpSiLoNPoInTIkEv2.cpp 是一个针对 Windows 的 C/C++ 漏洞利用原型，基于 ikeext.dll（Windows 的 IKEv2 驱动程序）中的 double-free 漏洞开发，研究过程中暂定为 CVE-2026-33824。 该项目包含： 完整的混淆层（虚拟机、控制流平坦化、字符串隐藏、伪造二进制签名、内联反分析汇编）。 完整的 IKEv2 漏洞利用引擎（数据包构建、SKF 分片、多线程堆喷布局、ROP 链、任意读写原语）。 绕过 Windows...

CVE-2026-7275-moodle

CVE-2026-7275-moodle PoC y documentación para CVE-2026-7275 : Moodle Google Drive Repository repositorygoogledocs — Path Traversal / Arbitrary File Write que puede conducir a RCE en versiones de Moodle sin parchear. Disclaimer: Solo para investigación de seguridad autorizada, auditoría y educació...

CVE-2024-45436

Exploit de Ollama CVE-2024-45436 Una implementación de exploit limpia y eficiente para la vulnerabilidad de recorrido ZIP de Ollama CVE-2024-45436. Documentación en chino: READMECN.md Descripción de la vulnerabilidad CVE-2024-45436 es una vulnerabilidad de recorrido de rutas también conocida como...

OESA-2026-3858 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write...

OESA-2026-3857 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write...

OESA-2026-3817 pcre2 security update

PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...

OESA-2026-3815 pcre2 security update

PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...

OESA-2026-3816 pcre2 security update

PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...

OESA-2026-3814 pcre2 security update

PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...

ghost-hoock

ghost-hoock Un fork mínimo de GhostLock que conserva solo una primitiva : desactivar SELinux mediante CVE-2026-43499 futex PI UAF. -green Tabla de contenidos Qué es esto Cómo funciona Qué se conservó del original Qué se eliminó Compilación Ejecución Requisitos Limitaciones y riesgos Estructura de...

CVE-2023-41993

CVE-2023-41993 PoC del Exploit Este repositorio contiene una prueba de concepto PoC del exploit para la vulnerabilidad CVE-2023-41993. Esta PoC demuestra primitivas limitadas de lectura/escritura basadas en la PoC publicada por po6ix. La demostración de esta PoC se puede encontrar aquí. Por favor...

MGASA-2026-0403 Updated bzip2 packages fix a security vulnerability

Off-by-One Leading to Out-of-Bounds Write in bzip2. CVE-2026-42250...

Updated bzip2 packages fix a security vulnerability

Off-by-One Leading to Out-of-Bounds Write in bzip2. CVE-2026-42250...

Security Bulletin: IBM® Data Server driver for JDBC and SQLJ could allow an evil server to perform an arbitrary file write on the connected client due to improper validation of file paths (CVE-2026-15955)

Summary IBM® Data Server driver for JDBC and SQLJ could allow an evil Db2 server to perform an arbitrary file write on the connected client due to improper validation of file paths. This vulnerability also applies to Db2 due to bundled JDBC and SQLJ components. Vulnerability Details...