CVE-2024-55968

CVE-2024-55968 LPE Exploit POC for CVE-2024-55968 Vulnerablity Description The com.dtexsystems.helper service, responsible for handling privileged operations within the macOS DTEX Event Forwarder agent, fails to implement critical client validation during XPC inter-process communication IPC...

Forklift_LPE

Forklift 3.3.9 Local Privilege Escalation When installing the Forklift, a new helper called com.binarynights.ForkLiftHelper for Mac OS X is automatically installed to the /Library/PrivilegedHelperTools/ directory. Analyzing this helper, which handles XPC messages, resulted in different ways of...

gsscred-move-uaf

GSSCred-move-uaf The com.apple.GSSCred XPC service, which runs as root on macOS and iOS, does not properly implement the "move" command, leading to a use-after-free condition in the doMove function. The GSSCred service can be reached from within the default application sandbox on iOS. This progra...

TrueTree

TrueTree About Read all about the TrueTree concept here TrueTree is more than just a pstree command for macOS. It is used to display a process tree for current running processes while using a hierarchy built on additoinal pids that can be collected from the operating system. The standard process...

xpc-string-leak

xpc-string-leak xpc-string-leak is a proof-of-concept exploit for an out-of-bounds memory read in libxpc. This exploit uses the vulnerability to read out-of-bounds heap memory from diagnosticd, an unsandboxed root process with the taskforpid-allow entitlement. The vulnerability: CVE-2018-4248 On...

ios-nehelper-wifi-info-0day

Nehelper Wifi Info 0-day iOS 15.0 I've updated this code to avoid using Private API directly. Read more in my blog post. However, that means that now this code is iOS version-specific and possibly device model-specific. So if it doesn't work on your device, recalculate and update the offsets in c...

ios-nehelper-enum-apps-0day

nehelper enumerate installed apps 0-day iOS 15.0 I've updated this code to avoid using Private API directly. Read more in my blog post. However, that means that now this code is iOS version-specific and possibly device model-specific. So if it doesn't work on your device, recalculate and update t...

ios-gamed-0day

iOS gamed exploit fixed in 15.0.2 Update: Apple has quietly fixed this in iOS 15.0.2 without any kind of public acknowledgement or credit. Any app installed from the App Store may access the following data without any prompt from the user: Apple ID email and full name associated with it Apple ID...

sploits

sploits | Code| Description ---|---|--- CVE-2018-4310| code| MediaRemote: An access issue was addressed with additional sandbox restrictions CVE-2018-4991| code| Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper certificate validation...

UnjailMe

UnjailMe A sandbox escape based on: the proof-of-concept CVE-2018-4087 by Rani Idan Zimperium @cheesecakeufo's securityd overflow proof-of-concept zeroday, no CVE known, thank you Abraham! About the ZIMPERIUM PoC Rani used sbtool from Jonathan Levine to find out what services were accessible for...

CVE-2026-6666-XPC-Service-NSKeyedUnarchiver-Deserialization-Attack-macOS-iOS-simulation-

CVE-2026-6666 – XPC Service NSKeyedUnarchiver Deserialization Attack macOS/iOS simulation Program Code Python simulation root@kitploit: !/usr/bin/env python3 vulnerablexpcservice.py - Simulated XPC service using unsafe plist deserialization import plistlib, subprocess, socketserver, struct Mach...

CVE-2026-86819

Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement...

EUVD-2026-74192

Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement...

CVE-2026-86819

Waves Central for macOS contains a local privilege escalation in its privileged helper service. The root cause is improper XPC client authentication : the helper validates connecting clients by comparing the caller's code-signing certificate chain for equality with its own, rather than checking a...

xspawn

xspawn xspawn starts a program on macOS through launchd and never execs that program itself. The aim is that an EDR records launchd as the parent, not this tool or the calling shell. by cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/xspawn Summary xspawn opens...

CVE-2024-55968

CVE-2024-55968 POC for DTEX LPE CVE-2024-55968 Affected product: DEC-M DTEX Forwarder version 6.1.1. DTEX is a unified insider risk management platform. Affected component: DEC-M EventReportingService XPC Helper Attack vector: The DTEX Event Reporting Service was found with a privileged XPC helpe...

CVE-2024-11467

CVE-2024-11467 The macOS operating system uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. The VMware Horizon Client, upon installation, registers the...

EUVD-2026-66331

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication XPC while masquerading as an Apple-signed process...

CVE-2026-78236

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication XPC while masquerading as an Apple-signed process...

CVE-2026-78236 Insecure PIN derivation mechanism in Admin By Request (ABR)

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication XPC while masquerading as an Apple-signed process...