WinDriver-EXP

PoC Repository for Vulnerable Windows Drivers This repository includes PoC exploits for vulnerabilities in Windows drivers, showcasing flaws that can result in privilege escalation, arbitrary code execution, or other security risks. Intended for research and education only. POCs Vulnerability| CV...

CVE-2026-72018

CVE-2026-72018 — Linux Kernel Out-of-Bounds Write Linux Kernel • DIBS Loopback • Out-of-Bounds Write Security research and technical analysis of CVE-2026-72018. 01 — Overview CVE-2026-72018 is a Linux kernel out-of-bounds write vulnerability affecting the DIBS/ISM loopback functionality. The...

plague

plague Default Detections for EDR The detections detailed below are what I attempt to establish on any EDR product I deploy or work on. Take your own considerations for criticality and datasets. Check out this post for how you can work on achieving detections...

HolyGrail

HolyGrail A BYOVD hunter for finding the HolyGrail driver - Windows drivers suitable for BYOVD. Install git clone https://github.com/BlackSnufkin/HolyGrail cd HolyGrail cargo build --release Quick start HolyGrail.exe -d "C:\path\to\driver.sys" Add JSON output, custom output dir, and policy dir if...

VMwareCloak

VMwareCloak A PowerShell script that attempts to help malware analysts hide their VMware Windows VM's from malware that may be trying to evade analysis. Guaranteed to bring down your pafish ratings by at least a few points ; The script accomplishes this by doing the following: Renames several...

CVE-2021-3438

What is included? CVE-2021-3438detection v2sccm.ps1 is a script to run via sccm to get a small report on the vulnerability of managed devices. CVE-2021-3438detection.ps1 is a script to run manually or remote on a managed device. CVE-2021-3438remediation.ps1 is a script to check and run the...

rusty_drivers

RustyDrivers This project is a BYOVD collection with the focus on killing EDR / AV processes. Currently the following drivers are supported: Driver| Argument Name| Blocked ---|---|--- Process Explorer| processexplorer| Yes Genshin Impact| genshin| Yes Rentdrv2| rentdrv2| No TrueSight| truesight| ...

EDRSandblast-GodFault

EDRSandblast-GodFault By Gabriel Landau at Elastic Security. Modification of EDRSandblast - see original README below. Integrates GodFault into EDR Sandblast, achieving the same result without the use of any vulnerable drivers. Example Output C:\Users\user\Desktop\OffsetsEDRSandblast.exe...

Linux Distros Unpatched Vulnerability : CVE-2026-98968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb...

CVE-2026-19676

The user-mode verifier for the pecitransfer system call, zvrfypecitransfer in drivers/peci/pecihandlers.c, checked only the device object permission and copied the caller-supplied struct pecimsg with kusermodefromcopy. That copy validates the outer structure only; the buf pointers and len values...

CVE-2026-19676 PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode

The user-mode verifier for the pecitransfer system call, zvrfypecitransfer in drivers/peci/pecihandlers.c, checked only the device object permission and copied the caller-supplied struct pecimsg with kusermodefromcopy. That copy validates the outer structure only; the buf pointers and len values...

CVE-2026-19676

The peci_transfer() system call in the Zephyr RTOS (specifically within drivers/peci/peci_handlers.c ) fails to properly validate embedded buffer pointers and length values in the peci_msg structure. While the verifier checks outer structure permissions, it allows caller-controlled pointers in th...

CVE-2026-19676 PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode

The user-mode verifier for the pecitransfer system call, zvrfypecitransfer in drivers/peci/pecihandlers.c, checked only the device object permission and copied the caller-supplied struct pecimsg with kusermodefromcopy. That copy validates the outer structure only; the buf pointers and len values...

CVE-2026-98619

A flaw was found in the Linux kernel's ethtool subsystem. A local user with network administration privileges can cause a Denial of Service DoS by initiating an offline self-test on affected network drivers. Because the test routine fails to hold the necessary synchronization locks when taking th...

Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel vulnerabilities (USN-8630-2)

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8630-2 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update...

CVE-2026-105960

The PEAK-System PCAN Windows drivers are affected by a vulnerability involving the improper handling of length parameter inconsistency (CWE-130). The driver fails to sufficiently cap a variable-length receive-record copy to the actual caller-supplied output length, instead using a requested or qu...

CVE-2026-110322

The HMS Networks PEAK-System PCAN Windows drivers are vulnerable to an untrusted pointer dereference within the PCAN type 0x4030 processing path . The flaw occurs because the driver fails to validate a selected or returned object pointer before dereferencing fixed fields during post-processing. T...

CVE-2026-103672

The PEAK-System PCAN Windows drivers from HMS Networks are vulnerable to an Improper Validation of Array Index (CWE-129). The vulnerability exists because the PCAN parser indexes a length table using attacker-controlled DLC without enforcing the required bound of DLC

CVE-2026-101103

The PEAK-System PCAN Windows drivers are vulnerable to a classic buffer overflow (CWE-120) within the diagnostic call. The root cause is a failure to validate that the caller-supplied output buffer is large enough to accommodate the output record. This vulnerability can lead to a high availabilit...

CVE-2026-109576

The PEAK-System PCAN Windows drivers are vulnerable to an Out-of-bounds Write (CWE-787) due to a logic error in the parser. While the parser correctly identifies malformed records, the loop iterating through the record list incorrectly advances the processed-bytes counter even when a record is re...