CVE-2023-27326

Parallels Desktop 虚拟机逃逸 该仓库包含针对 Parallels Desktop 漏洞（编号 CVE-2023-27326）的利用代码。此漏洞允许本地攻击者在受影响的 Parallels Desktop 安装实例中提升权限。 该利用代码已在 Parallels Desktop 18.0.0 53049 版本上测试通过，该漏洞已在 18.1.1 53328 安全更新 中被修复。 漏洞详情 具体缺陷存在于 Toolgate 组件中。问题源于在使用用户提供的路径进行文件操作之前，缺乏对路径的正确验证。攻击者可利用此漏洞提升权限，并在主机系统上当前用户的上下文中执行任意代码。...

CVE-2020-12753-PoC

CVE-2020-12753-PoC Este repositorio contiene una prueba de concepto para 🔋📱❄️🥾🔓, una vulnerabilidad SBL1/aboot para ejecución de código arbitrario en Secure EL3 en el LG Stylo 4 AMZ/Q710ULM. Solo se ha probado en las actualizaciones 20a y 20c y con la variante SBL1 de la vulnerabilidad. - Makefile...

CVE-2024-4367-hands-on-01

!IMPORTANT Este repositorio es para aprender sobre vulnerabilidades. Realice este taller únicamente en un ordenador adecuado que usted gestione. No realice nunca actividades ilegales. Además, el autor no se hace responsable de ningún daño o responsabilidad derivados de este repositorio...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

CVE-2026-101919

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

[SECURITY] [DSA 6544-1] sabnzbdplus security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6544-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 05, 2026 https://www.debian.org/security/faq -...

[SECURITY] [DSA 6543-1] libreoffice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6543-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 05, 2026 https://www.debian.org/security/faq -...

CVE-2024-4947-PoC

CVE-2024-4947 — Confusión de tipos en V8 Maglev → RCE completo PoC d8 Una cadena de explotación completa y autocontenida para CVE-2024-4947 confusión de tipos en V8 Maglev, desde el disparador inicial de la confusión de tipos hasta la ejecución arbitraria de código. El PoC se ejecuta contra una...

EUVD-2026-92524

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2026-101919 Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2026-101919 Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2026-101919

A vulnerability exists in the HyperShift operator where it copies user-provided kubeconfig secrets directly into the privileged control plane namespace without sufficient validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this by supplying a...

CVE-2026-101919

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2023-27326

Escape de máquina virtual de Parallels Desktop Este repositorio contiene un exploit para una vulnerabilidad de Parallels Desktop a la que se le ha asignado el CVE-2023-27326. Esta vulnerabilidad permite a atacantes locales escalar privilegios en instalaciones afectadas de Parallels Desktop. El...

CVE-2026-2796-escape-wasm-by-using-wasm

CVE-2026-2796 — Escape de la sandbox de WebAssembly de SpiderMonkey Cadena de exploits de prueba de concepto para CVE-2026-2796 , una mala compilación JIT / confusión de tipos en la optimización de importación WebAssembly de Mozilla SpiderMonkey componente "JavaScript: WebAssembly". Un módulo was...

CVE-2026-18718

Advisory: GHSA-pcfh-853f-q3gh · Severity: High CVSS 7.5 · Affected: Ghidra ≤ 12.1.2 · Fixed: c03a70d Ghidra 12.1.3 Opening someone else's Ghidra project was enough to execute their code. Ghidra 12.1.2 stores analyzer options inside the program database , and one of those options is a filesystem...

CVE-2025-64512

CVE-2025-64512 在 pdfminer.six 中通过精心构造的 PDF 输入执行任意代码的 PoC 基于 https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp % python3 mkpickle.py 用法：mkpickle.py 输出文件 例如：mkpickle.py 'curl IP:端口/rce' evil.pickle.gz % python3 mkpdf.py -h 用法：mkpdf.py -h -o 输出 -p 路径 -f picklename 创建触发...

CVE-2026-63277

A flaw was found in LibreOffice. When linking spreadsheet cell ranges to external data sources in Calc, a document can specify an external Java database driver. By convincing a user to open a specially crafted document, a remote attacker can force the application to download and execute untrusted...

SUSE CVE-2019-25777

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

CVE-2022-20186_CTXZ

CVE-2022-20186 漏洞利用 详细分析可在此处找到：here。这是 Arm Mali 内核驱动程序中的一个漏洞，我于 2022 年 1 月提交报告。该漏洞可用于从未受信任的应用域获得任意内核代码执行权限，进而禁用 SELinux 并获取 root 权限。 该漏洞利用已在 Google Pixel 6 上测试，支持从 2021 年 11 月到 2022 年 2 月的补丁级别。通过更改几个镜像偏移量，可以轻松添加对其他固件的支持。作为参考，我使用以下命令在 ndk-21 中通过 clang 编译：...