Pi-Zero-2W-Bad-USB

Raspberry Pi Zero 2 W BadUSB HID Toolkit A programmable BadUSB / HID attack platform built on a Raspberry Pi Zero 2 W. The Pi enumerates as a USB composite device keyboard plus an optional read-only mass-storage volume and executes Ducky-Script-style payloads against the host it's plugged into...

keycloak-services: keycloak-services: FGAP v2 composite-blind role mapping allows privilege escalation

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

CVE-2017-8570

What? This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file into the %TEMP% directory, and then execute it using the primitive that the vulnerability provides. Why? A few...

CVE-2025-27363-proof-of-concept

Proof-of-concept for CVE-2025-27363 that crashes FreeType 2.13.0. This modifies Roboto Flex, a variable font, so that the "%" character glyph 8 is now a composite glyph with 0xfffd subglyphs. Rendering the edited font with FreeType 2.13.0 the last version before the fix crashes, with ASAN detecti...

CVE-2017-8570

来源：https://www.exploit-db.com/exploits/44263/ 使用方法：python packagercompositemoniker.py -s calc.sct -o example.rtf What? This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file...

CVE-2017-8570

What? This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file into the %TEMP% directory, and then execute it using the primitive that the vulnerability provides. Why? A few...

Scan Before You Install: Detecting and Mitigating Local and Composite Vulnerabilities in Skills

An agent skill packages natural-language instructions, scripts, and reference files that an LLM-based agent loads for a task. Skills may access the file system, shell, and network under user-authorized permissions; weaknesses can lead to unsafe execution. Existing scanners primarily target...

Exploit for CVE-2026-94000

Keycloak composite map-role privilege escalation A reproducib...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server and is vulnerable to multiple vulnerabilities

Summary IBM WebSphere Application Server is shipped with IBM Tivoli Composite Application Manager for Application Diagnostics. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- Tivoli...

Astra Linux – Vulnerability in openexr

OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf31::LineCompositeTask::execute called from IlmThread31::NullThreadPoolProvider::addTask and IlmThread31::ThreadPool::addGlobalTask. NOTE: db217f2 may be inapplicable...

Astra Linux – vulnerability in linux, linux-5.10

An issue was found in drivers/usb/gadget/composite.c within the Linux kernel prior to version 5.16.10. The USB Gadget subsystem fails to perform proper validation on certain interface OS descriptor requests—specifically those involving large array indices and those related to retrieval of NULL...

CVE-2026-85823

Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally...

CVE-2026-85824

Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally...

EUVD-2026-99533

Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally...

CVE-2026-85824

A Use after free vulnerability exists in the Windows Composite Image File System . This flaw allows an authorized attacker to perform a local privilege escalation . While the vulnerability is confirmed, specific technical details regarding the root cause or affected components are not provided in...

EUVD-2026-99534

Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally...

CVE-2026-85823

A Use after free vulnerability in the Windows Composite Image File System allows an authorized attacker to achieve local privilege escalation . The vulnerability is assigned a CVSS 3.1 base score of 7.0 (High) . While the documentation confirms the existence of an official fix, specific details r...

Windows Composite Image File System Elevation of Privilege Vulnerability

Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally...

Windows Composite Image File System Elevation of Privilege Vulnerability

Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-85824: Windows Composite Image File System Elevation of Privilege Vulnerability

Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally...