CVE-2026-81565 Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init()

A flaw was found in the Linux kernel's drm/xe/pt module. During certain memory management operations, an internal counter is not properly reset. Repeated attempts to perform these operations, possibly due to resource contention or out-of-memory conditions, can cause this counter to exceed its...

kernel: dm-verity: fix buffer overflow in FEC calculation

A flaw was found in the dm-verity component of the Linux kernel. A buffer overflow occurs during Forward Error Correction FEC calculation, allowing an attacker to write past the end of an allocated buffer. This out-of-bounds write can corrupt the syndrome buffer, potentially leading to system...

CVE-2025-4517-PoC

CVE-2025-4517-PoC CVE-2025-4517 is a vulnerability in Python’s tarfile module that allows arbitrary file writes outside the extraction directory when extracting untrusted tar archives. The issue occurs when using TarFile.extract or TarFile.extractall with filter="data" or filter="tar", which does...

libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...

libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...

watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260

CVE-2025-71257 and CVE-2025-71260 BMC FootPrints Pre-Authenticated Remote Code Execution Chain BMC FootPrints Pre-Authenticated Remote Code Execution Chain Detection Artifact Generator Tool Description This Detection Artifact Generator verifies if BMC FootPrints instance is vulnerable to...

varlib-cve-2025-66034

fontTools varLib CVE-2025-66034 Exploit This repo doesn't introduce a new vulnerability. This is a Proof-of-concept exploit for CVE-2025-66034 affecting the fontTools varLib variable font generation pipeline. The vulnerability allows attackers to control the output filename inside a crafted...

CVE-2026-2796-and-CVE-2026-2768-escape-the-wasm-box

CVE-2026-2796 + CVE-2026-2768 — Escape the Wasm Box Full-chain Firefox exploitation research: a WebAssembly type confusion for renderer code execution , chained toward a parent-process bug for a sandbox escape. Both bugs were fixed in Firefox 148 MFSA-2026-13; the target here is a Firefox...

CVE-2017-1000117

面向 VulApps 的 CVE-2017-1000117 PoC 仓库 Fork 自 joernchen/CVE-2017-1000117 git clone --recursive https://github.com/Jerry-zhuang/CVE-2017-1000117.git 会将 id 的输出写入 /var/www/html 下的 vul 文件。 在 VulApps 查看更多...

cve-2021-4034-mock

CVE-2021-4034 PwnKit 模拟漏洞系统 该项目是一个模拟系统，用于重现 Linux pkexec 守护进程中发现的 CVE-2021-4034（越界读/写） 漏洞的核心运行原理。在没有实际 SUID 权限提升的情况下，在受控环境中安全地模拟了环境变量内存区域越界及恶意载荷注入机制。 特别是，该模拟系统能够检测最新 Linux 内核的 execve 防御机制（传递空数组时强制插入空字符串从而形成 argc=1 的现象），并通过修正偏移量，成功模拟了过去存在漏洞的内存环境。 📂 文件结构 root@kitploit: cve-2021-4034-mock/ ├──...

CVE-2025-8110

CVE-2025-8110 — Gogs = 0.13.3 Arbitrary File Write via Symlink Traversal Overview Gogs = 0.13.3 is vulnerable to arbitrary file write through the PutContents API /api/v1/repos/:owner/:repo/contents/:path. The API validates file paths for directory-traversal sequences ../ but does not resolve...

CVE-2026-43284-DirtyFrag-PoC

CVE-2026-43284 — 4-byte XFRM/ESP Proof-of-concept local privilege escalation via XFRM/ESP page-cache corruption 4-byte write primitive · 48 iterations · 192-byte ELF overwrite · unprivileged user + netns Proof of concept Left: kernel preflight, setuid scan, and exploit chain · Right: root shell...

CVE-2026-82782

Out-of-bounds write vulnerability exists in CONPROSYS nano Series. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service DoS condition...

CVE-2026-82768

Path traversal vulnerability exists in SGA1000. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or altered by an attacker who can access the product via FTP...

CVE-2026-21045_and_CVE-2026-21048

CVE-2026-21045 & CVE-2026-21048 — Samsung libimagecodec.quram.so OOB Write PoC Overview This repository contains conceptual Proof-of-Concept PoC files that demonstrate out-of-bounds OOB write vulnerabilities in the Quramsoft image codec library libimagecodec.quram.so used on Samsung Android...

EUVD-2026-77248

Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or altered by an attacker who can access the product via FTP...

CVE-2026-82765

CVE-2026-82765 is a path traversal vulnerability in Contec FX5000, FX4000, and FX3000 series devices. An attacker with FTP access to the affected product can view and/or alter arbitrary files on the server, resulting in high confidentiality and integrity impact with no availability impact. The CN...

CVE-2026-82782

An out-of-bounds write vulnerability in CONPROSYS nano Series (Contec) allows a remote attacker with low privileges to send a specially crafted request that triggers a denial-of-service condition. The CVSS 3.1 score is 4.3 (MEDIUM) and CVSS 4.0 is 5.3 (MEDIUM) , reflecting a network-based attack ...

CVE-2026-82782

Out-of-bounds write vulnerability exists in CONPROSYS nano Series. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service DoS condition...