CVE-2021-27965

CVE-2021-27965 Simple PoC for exploiting CVE-2021-27965 for LPE by spawning system cmd. https://vulners.com/cve/CVE-2021-27965 An issue was discovered in signed MICSYS windows driver MsIo64.sys which may lead to compromisation of whole local system. Driver's ioctl dispatch routine suffers from...

CVE-2026-20700

dyld-signing-oracle-poc A controlled exploration of dyld's page-in linking and chained fixup machinery as a PAC signing oracle, in the context of CVE-2026-20700. On arm64e, every function pointer is hardware-authenticated. The goal here is to show that dyld itself can be directed — through a...

CVE-2026-39866

CVE-2026-39866 — Command Injection via unquoted workflow dispatch input Proof-of-concept lab for command injection in GitHub Actions workflow dispatch Purpose CVE-2026-39866 is a command injection bug in Lawnchair's GitHub Actions release workflow. The releaseupdate.yml file passes user input...

CVE-2026-71300

CVE-2026-71300 — camel-atmosphere-websocket dispatch header injection Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-atmosphere-websocket producer selects its WebSocket recipients from websocket. Exchange headers whose names fall outside the Camel namespac...

CVE-2021-21551

PoC for CVE-2021-21551 Windows LPE using the Dell dbutil23.sys driver. Exploit approach Implement read/write, allocate shellcode, flip page to bypass smep, overwrite haldispatch ptr, execute shellcode...

iqvw64e-privilege-escalation

iqvw64e-privilege-escalation CVE-2015-2291 Local Privilege Escalation PoC Overview This project is an educational proof-of-concept for a Local Privilege Escalation LPE vulnerability in the driver iqvw64e.sys SHA256: 37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9 — the Intel...

CVE-2026-114629

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

CVE-2026-114629

The Web::Simple module for Perl (versions before 0.035 ) is vulnerable to a memory allocation issue. The component Web::Dispatch::ParamParser::get_unpacked_body_from reads application/x-www-form-urlencoded bodies using a single read call without a cap. Because Perl's read function grows the buffe...

CVE-2026-114629 Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

CVE-2024-21338-Exploit

CVE-2024-21338 Exploit Project Introduction This is a POC for CVE-2024-21338, a privilege escalation vulnerability in the Windows AppLocker driver appid.sys. It was exploited as a 0-day by the Lazarus group for local privilege escalation on Windows. Vulnerability Background CVE-2024-21338 is a...

EUVD-2026-97737

obsidian-tc tokens can access arbitrary configured vaults...

cantina

ARCHIVED. This project moved tocustom-oscp-tooling. All Cantina code lives on there now, alongside the Star Wars enum/advisor tool suite. This repo is kept read-only for history. New home: https://gitlab.com/WattoCyber/custom-oscp-tooling Run: python tools/cantina.py from that repo Cantina At a...

Apache Qpid Dispatch Router 1.19.0 Remote Stack Overflow

Summary A high-performance, lightweight AMQP 1.0 message router, written in C and built on Qpid Proton. It provides flexible and scalable interconnect between any AMQP endpoints, whether they be clients, brokers or other AMQP-enabled services. Description Apache Qpid Dispatch suffers from a...

UBUNTU-CVE-2026-98864

In the Linux kernel, the following vulnerability has been resolved: schedext: Wait for SCXOPSSDISPATCHING before reenqueueing a task ebf1ccff79c4 "schedext: Fix ops.dequeue semantics" moved the final opsstate store in scxdispatchenqueue after the DSQ unlock so that the custody update and...

CVE-2026-98564

The Linux kernel contains a vulnerability in the net: dsa: mt7530 driver. The mt7530_remove_common() function disposes of per-PHY interrupt mappings while the owning regmap-irq chip remains devm-registered . This allows the regmap-irq thread to dispatch on a mapping that no longer exists, leading...

CVE-2026-98564 net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530removecommon disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is only...

CVE-2026-98564 net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530removecommon disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is only...

PT-2026-117083

In the Linux kernel, the following vulnerability has been resolved: sched ext: Wait for SCX OPSS DISPATCHING before reenqueueing a task ebf1ccff79c4 "sched ext: Fix ops.dequeue semantics" moved the final ops state store in scx dispatch enqueue after the DSQ unlock so that the custody update and...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Whitelist slab/slub objects for copying to userspace Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu- results in a bug when the CONFIGHARDENEDUSERCOPY configuration is enabled, as shown belo...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: s390/syscalls: Added a spectre boundary for the syscall dispatch table. The s390 syscall number is directly controlled by the user space, but there is no arrayindexnospec boundary to prevent access beyond the syscall function...