CVE-2023-20938

CVE-2023-20938 Vulnerability Analysis 1. Client A and Client B establish a Binder connection via the ServiceManager context manager. 2. A creates node 0xbeef node = bindernewnodeproc, fp;. B references node 0xbeef via ref-targetnode. 3. B correctly processes targetnode 0xbeef, enqueuing the...

CVE-2020-17057

I wrote this exp based on this blog（https://blogs.360.cn/post/CVE-2020-17057%20detail%20and%20exploit.html），But I ended up with only palette objects with dangling data pointer. Because of type isolation, I can't get arbitrary R/W primitives by using palettes or bitmap objects，If you have a way to...

CVE-2026-46215-exploit-linux-7.0-uaf-stable

CVE-2026-46215 Exploit for Linux 7.0 - More Stable & Reliable c0d3 by : Antonius w1sdom / ev1lut10n / sw0rdm4n - bluedragonsec.com https://github.com/bluedragonsecurity This exploit works in a limited environment, check some requirements below !!! WHAT THE HELL IS THIS ? This is an exploit for...

CVE-2026-46215-EXPLOIT

CVE-2026-46215 Exploit for Linux 7.0 c0d3 by : Antonius w1sdom / ev1lut10n / sw0rdm4n - bluedragonsec.com https://github.com/bluedragonsecurity This exploit works in a limited environment, check some requirements below !!! WHAT THE HELL IS THIS ? This is and exploit for CVE-2026-46215 Linux Kerne...

Taken

Taken Takeover subdomains using AWS dangling elastic ips and have a working POC for Subdomain Takeover. What all you can do with Subdomain Takeover - Cookies stealing, If cookies are set with domain attribute set to the hijacked subdomain. CORS request, If Access-Control-Allow-Origin is set to...

CVE-2026-43499-S26

CVE-2026-43499 — Android GKI 6.12 pselect / configfs kernel exploit A Linux kernel exploit for the Android GKI 6.12 line Samsung and Pixel devices targeting CVE-2026-43499 : a buggy removewaiter rollback in rtmutexstartproxylock that uses current instead of waiter::task, leaving a waiter's...

CVE-2025-14321

CVE-2025-14321 Proof of Concept Description PoC for a Use-After-Free UAF vulnerability in the RTCEncodedFrameBase component of Firefox, exploitable via the WebRTC Encoded Transforms API. CVE-2025-14321 : The destructor of RTCEncodedFrameBase does not call DetachArrayBuffer when releasing the nati...

kfd

Quick disclaimer: I have no intention of adding offsets for other devices and iOS versions. kfd kfd, short for kernel file descriptor, is a project to read and write kernel memory on Apple devices. It leverages various vulnerabilities that can be exploited to obtain dangling PTEs, which will be...

CVE-2026-23479-Redis-UAF-Proof-of-Concept

🔥 CVE-2026-23479 – Redis UAF Proof of Concept Use-After-Free in RedisunblockClientOnKey leading to Remote Code Execution Proof of concept with GDB‑assisted exploitation educational / lab use only 📖 Overview CVE-2026-23479 is a critical Use‑After‑Free UAF vulnerability in Redis versions 7.2.0...

CVE-2026-7777-Rust-Use-After-Free-in-Unsafe-Web-Server

CVE-2026-7777 – Rust Use‑After‑Free in Unsafe Web Server Program Code Rust // uafserver.rs - Vulnerable Rust HTTP server with use-after-free use std::sync::Arc, Mutex; use std::thread; use std::io::prelude::; use std::net::TcpListener, TcpStream; struct SharedBuffer data: Vec, impl SharedBuffer f...

CVE-2016-4669

CVE-2016-4669 Imperfect exploit code, for learning purposes only : 1 Compilation method Just run make 2 Function If successful, it can obtain root privileges. But the success rate is not high. 3 General overview Relatively stable creation of a dangling port. Cannot stably reuse the port with root...

CVE-2026-43499-poc

Weaponisation research for CVE-2026-43499 ghostlock. the rtmutex removewater proxy path bug that leaves a tasks piblockedon dangling into its own popped kernel stack frame. The bug class and original exploit strategy credit to nebusec their write-up here everything in this repo is my own...

ghostlock-sabrina

GhostLock Sabrina Root exploit for Chromecast with Google TV sabrina via CVE-2026-43499 -- a use-after-free in the Linux kernel's futex PI priority inheritance subsystem. Achieves root on a locked bootloader device running Android 14 with kernel 5.15.170 PGO+BOLT+LTO, clang 17. The vulnerability...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell: CVE-2026–109618, CVE-2026–109619 PoC — Pre-Auth RC...

tcp-zerocopy-sm

Investigation is closed. Working fork: https://github.com/soumarcelino/Root-My-Galaxy-SM-S918B Read this - https://github.com/BuSung-dev/Root-My-Galaxy-Payloads/issues/160issuecomment-5227077583 Attempts to cause rights elevation w GhostLock via TCP Zerocopy. Designed expecially for 5.15. samsung...

CVE-2026-98995

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

DEBIAN-CVE-2026-98945

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This...

CVE-2026-98945

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This...

CVE-2026-98995 namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

EUVD-2026-108789

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...