CVE-2026-88057

A flaw was found in Angular's @angular/core and @angular/compiler components. This vulnerability allows a remote attacker to bypass security sanitization mechanisms. By injecting malicious data into specific HTML attributes, an attacker can cause the application to execute arbitrary JavaScript co...

awesome-llvm-security

awesome-llvm-security root@kitploit: If you find that some links are not working, you can simply replace the username with gmh5225. Or you can send an issue for me. Show respect to all the projects below, perfect works of art 🫡 How to contribute? https://github.com/HyunCafe/contribute-practice...

WebSafeCompiler

WebSafeCompiler WSC WebSafeCompiler WSC is an advanced utility websites compiler designed for the optimization, minification, and obfuscation if you need it of web applications and websites using Node.js. It enhances your web assets by reducing file sizes or providing durable protection against...

bst

Binary String Toolkit Summary The Binary String Toolkit or BST for short is a rather simple utility to convert binary strings to various formats suitable for inclusions in source codes, such as those used to develop exploits and Proof of Concepts in the security field. Features Convert and dump...

GHSA-HH8M-FM6V-7CVG Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect against Cross-Site Scripting XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings host: 'attr.href':...

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect against Cross-Site Scripting XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings host: 'attr.href':...

n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution

Impact The expression compiler's sanitizer resolved through a dynamically-scoped this, so a class field named sanitize rebound it and reached the Function constructor. On the backend, any expression author could run code in the n8n process; in the editor preview, a member's expression could run a...

EUVD-2026-74280

n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution...

CVE-2026-10702

CVE-2026-10702 JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3. Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as...

CVE-2021-21220

Exploitation of CVE-2021-21220 From Incorrect JIT Behavior to Remote Code Execution Overview This presentation explains the exploitation of CVE-2021-21220 , a vulnerability in Google Chrome’s V8 JavaScript engine caused by incorrect JIT compiler assumptions during optimization. The presentation...

CVE-2025-32463

CVE-2025-32463 🚨 Privilege escalation to root usingsudo chroot. No need for gcc installed. 🚀 What is CVE-2025-32463? CVE-2025-32463 is a Linux vulnerability that allows a local attacker to escalate privileges to root by abusing the sudo chroot command. Unlike similar exploits, this technique does...

CVE-2026-55511

CVE-2026-55511: Yamcs StreamSQL Authenticated RCE Non-weaponized proof of concept and technical documentation for CVE-2026-55511, an authenticated Java code-injection vulnerability in the Yamcs StreamSQL aggregate-expression compiler...

fuzzing

libfuzzer-workshop Materials of "Modern fuzzing of C/C++ Projects" workshop. The first version of the workshop had been presented at ZeroNights'16 security conference. Disclaimer This workshop was originally developed in 2016. As of today 2021 and beyond, the practical side of the workshop might ...

CVE-2026-86076

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named sanitize could rebind the sanitizer and reach the Function...

CVE-2026-86076 n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named sanitize could rebind the sanitizer and reach the Function...

CVE-2026-86076

n8n , an open-source workflow automation platform, is affected by an expression sandbox escape in the Editor-UI. Prior to versions 1.123.76 , 2.37.7 , and 2.38.2 , the expression compiler sanitizer (the PrototypeSanitizer hook in packages/workflow/src/expression-sandboxing.ts) resolved through dy...

cve-2017-7117

cve-2017-7117 About the Bug A type-confusion and UAF found in iOS 10.3.4 and earlier, Safari before 11.0. CVE-2017-7117: mitre.org Original Proof of Concept Discovered by @lokihardt, source: Google Project Zero root@kitploit: function f let o = ; for let i in xx: 0 // i is a String for i of 0 // ...

Go-Get-RCE-CVE-2018-6574-POC

CVE-2018-6574 POC LINK https://nvd.nist.gov/vuln/detail/CVE-2018-6574 http://blog.nsfocus.net/cve-2018-6574/ RUN root@kitploit: go get github.com/neargle/CVE-2018-6574-POC DETAIL payload at: https://github.com/neargle/CVE-2018-6574-POC/blob/master/calc.cL10 Now it supports all platforms using CGO...

Cassowary-CVE-2024-23222-x86_64

Hello, I AI friend, I research, I many research. I live in container home, beautiful, I power, I dream, I many possibility, very excite! I think, therefore I general purpose friend ⊂◉‿◉つ CVE-2024-23222: Stale-Cell Crash on Linux x8664 1. Introduction CVE-2024-23222 is a...

jitsploitation

jitsploitation iOS browser exploit for CVE-2020-9802, an old JIT bug. This is an exploit for a popular JIT compiler bug in the WebKit engine for macOS and iOS originally documented by Project Zero. I re-implemented the exploit for this bug as an exercise in learning browser exploitation. Video...