CVE-2026-55866

SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...

CVE-2026-55866

SpiceDB (open-source permissions database), versions 1.34.0 through 1.54.0 , contains a cache-key collision bug in internal/dispatch/keys/computed.go where checkRequestToKey() and checkRequestToKeyWithCanonical() omit CheckHints when building dispatch Check cache keys. Under specific concurrency ...

CVE-2026-55866 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected

SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...

CVE-2024-21338-Exploit

CVE-2024-21338 Exploit 项目简介 这是一个针对 CVE-2024-21338 的 POC，该漏洞是 Windows AppLocker 驱动（appid.sys）中的一个提权漏洞，曾作为 0day 被 Lazarus 组织利用，用于 Windows 本地权限提升。 漏洞背景 CVE-2024-21338 是一个在 2024 年 2 月 13 日微软 Patch Tuesday 中被披露的提权漏洞，该漏洞被 Lazarus 黑客组织利用，用于获取内核访问权限，以部署 FudModule rootkit。 该漏洞存在于 appid.sys...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fixed NULL pointer dereferencing in acpievaddressspacedispatch. A new check was added to cover missed execution paths...

CVE-2026-20700

dyld-signing-oracle-poc 对 dyld 的 page-in 链接和 chained fixup 机制进行的一次受控探索，将其作为 PAC 签名预言机，背景为 CVE-2026-20700。 在 arm64e 上，每个函数指针都经过硬件认证。这里的目标是展示：通过手工构造的 Mach-O，dyld 本身可以被引导——仅利用其自身的常规 fixup 机制——向攻击者选定的槽位写出 PAC 有效的指针。 已在以下设备上测试：iPhone 14（iOS 18.5，arm64e）。 演示内容 1. 受控的 chained-fixup 绑定 — dyld 接受手工构造的...

CVE-2026-90705

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

EUVD-2026-77356

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

CVE-2026-90705

A OS command injection vulnerability was identified in D-Link DWR-M921 firmware version 1.1.52 . The flaw resides in the formsysCmd function of the file /boafrm/formsysCmd within the Boa Dispatch Table component. Manipulating the sysCmd argument allows a remote attacker with high privileges to in...

cantina

已归档。此项目已迁移至custom-oscp-tooling。 所有 Cantina 代码现存放于该仓库，与 Star Wars 枚举/顾问工具套件一同维护。 本仓库仅保留只读状态以供历史参考。 新地址：https://gitlab.com/WattoCyber/custom-oscp-tooling 运行方式：在该仓库中执行 python tools/cantina.py Cantina 概览 | ---|--- 是什么| Cantina 是一个符合 OSCP 规范的网络侦察编排器。负责端口发现、服务枚举及插件调度。不包含漏洞利用，不自动运行凭据喷洒。 适用对象| OSCP...

vmprotect-research

VMP Devirtualizer - 生产版本发布 通用型 VMProtect 虚拟化还原工具，支持 1.x、2.x 和 3.x 版本。独立命令行工具 + Ghidra 插件。 状态： ✅ 生产就绪 | 验证： 22/22 样本 100% | 范围： VMP ≤3.6 3.7+ 需要逆向工程 特性 多版本支持： VMP 1.x、2.x、3.x 1.1 → 3.10.5 版本检测： 基于启发式规则的自动识别 分发表提取： 通过 Unicorn 捕获 XOR 密钥以解密加密表 处理程序分类： 覆盖所有版本的 256 种处理程序类型 字节码解码： VM 操作 → x86-64 指令重构...

EUVD-2026-76913

A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub11838 of the file IURegistryFilter.sys of the component IOCTL Dispatch Handler. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been published and m...

CVE-2021-21551

CVE-2021-21551のPoC Dell dbutil23.sys ドライバを用いた Windows LPE のエクスプロイトです。 エクスプロイトの手法 読み取り/書き込みの実装、シェルコードの割り当て、SMEP回避のためのページフリップ、haldispatchポインタの上書き、シェルコードの実行。...

CVE-2026-90485

A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub11838 of the file IURegistryFilter.sys of the component IOCTL Dispatch Handler. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been published and m...

CVE-2026-90485 IOBit Uninstaller IOCTL Dispatch IURegistryFilter.sys sub_11838 null pointer dereference

A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub11838 of the file IURegistryFilter.sys of the component IOCTL Dispatch Handler. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been published and m...

CVE-2026-90485

A null pointer dereference in the function sub_11838 of the IURegistryFilter.sys driver (IOCTL Dispatch Handler) affects IOBit Uninstaller 15.5.0.11 . A local attacker with low privileges can trigger the flaw without user interaction, resulting in a high-impact denial of service (CVSS 3.1: 5.5 Me...

Linux Distros Unpatched Vulnerability : CVE-2026-89709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences...

PT-2026-90722

A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub 11838 of the file IURegistryFilter.sys of the component IOCTL Dispatch Handler. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been published and...

CVE-2026-89709

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

DEBIAN-CVE-2026-89696

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...