kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

A flaw was found in the Linux kernel's CIFS Common Internet File System client. When the cifssanitizeprepath function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-boun...

kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc

A flaw was found in the Linux kernel's futex subsystem. The needfutexhashallocatedefault function incorrectly relies on CLONETHREAD semantics, which can lead to non-concurrency issues when memory allocations mm-futexref pcpu allocations are shared across CLONEVM clones, excluding vfork. This can...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs

A flaw was found in the Linux kernel's Generic Receive Offload GRO networking subsystem. This vulnerability occurs when skbgroreceive attempts to merge zerocopy socket buffers skbs without properly managing page reference counts, specifically when the SKBFLMANAGEDFRAGREFS flag is set. An attacker...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

A flaw was found in the Linux kernel's CIFS Common Internet File System client. When the cifssanitizeprepath function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-boun...

kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

A flaw was found in the Linux kernel's netfilter component, specifically within the nftsetpipapoavx2 AVX2 matching functions. This vulnerability occurs when a pipapo set with an 'ipv4 . port' key is reloaded. Due to incorrect masking, the system may erroneously identify non-matching elements as...

Dissecting-CVE-2026-0628-Chromium-Extension-Privilege-Escalation

= doi.org/10.5281/zenodo.18413764 = orcid.org/0009-0007-7728-256X root@kitploit: README.md CVE-2026-0628: تصعيد الامتيازات في Chromium WebView انتحال الأصل – بحث تقني وإثبات المفهوم المؤلف: Sastra Adi Wiguna Purple Elite Teaming تاريخ البحث: يناير 2026 معرف CVE: CVE-2026-0628 CVSS v3.1: 8.8 عالٍ...

K000162521: BIG-IP and BIG-IQ Configuration utility vulnerability CVE-2026-66842

Security Advisory Description BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to the Configuration utility. CVE-2026-66842 Impact This vulnerability may allow an authenticated attacker with networ...

Security Bulletin: Multiple vulnerabilies in Netty impacting IBM webMethods API Management

Summary Multiple vulnerabilities in Netty have been addressed in IBM webMethods developer portal and IBM webMethods ControlPlane Vulnerability Details CVEID:CVE-2026-42579 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final,...

Fragnesia-go

fragnesia-go SA واحدة. بايت واحد في كل مرة. بدون سباق. مَنفذ Go من fragnesia CVE-2026-46300. عضو في فئة الثغرات Dirty Frag - ثغرة منفصلة، نفس السطح، تصحيح خاص بها. كيف يعمل tl;dr توجد الثغرة في النظام الفرعي XFRM الخاص بـ ESP-in-TCP في لينكس. عندما يتم تثبيت TCPULP espintcp على مقبس بعد أن تم...

K000162599: NGINX ngx_http_js_module vulnerability CVE-2026-18329

Security Advisory Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An...

Conferences

المؤتمرات شرائح عروض المؤتمرات: BlackHat USA 2025 August 2-7 Offensivecon 2025 May 16-17 Black Hat Asia 2025 1-4 April Black hat Europe 2024 9-12 December شرائح Hexacon 2024 4-5 October شرائح Black Hat USA 2024 3-8 August شرائح REcon 2024 28-30 Jun Offensivecon 2024 May 10-11 Blackhat Asia 2024...

Zapscape-Fix

Zapscape-Fix — CVE-2026-64561 KVM 内核热补丁 English | 简体中文 给 CentOS Stream 8 / RHEL 8 （4.18.0 全系列内核）的 KVM 宿主机修复 CVE-2026-64561（Zapscape） 漏洞的内核热补丁 ： 不打补丁的风险 ：租户虚拟机（guest）可以仅凭自身操作逃逸到宿主机，以宿主 内核 root 权限执行代码——击穿整台物理机及其上所有虚拟机。 本项目的补丁 ：基于 Linux 上游官方修复（2abd5287f083）backport 而来， 通过内核 livepatch 机制在线生效 ： ✅ 不重启宿...

lamda

FIRERPA Android ｜ AI-Powered Automation An all-in-one Android automation framework that combines on-device services, AI-ready agents, and extensible tool invocation. Documentation | 使用文档 | TELEGRAM | QQ Group | SKILLS | llms-full.txt | 中文版本 FIRERPA is an all-in-one Android device control platform...

java-remote-class-loader

This tool allows you to send Java bytecode in the form of class files to your clients or potential targets to load and execute using Java ClassLoader together with Reflect API. The client receives the class file from the server and return the respective execution output. Payloads must be written ...

CVE-2025-24990_POC

برنامج تشغيل مودم Agere لنظام ويندوز ltmdm64.sys. هذا البرنامج قديم جدًا ولا يتم تحميله افتراضيًا على جهاز الاختبار الخاص بي، لذا سأستغله في سيناريو BYOVD. ومن المثير للاهتمام، وفقًا لبحثي، أن هذا البرنامج موجود منذ ويندوز 7 ويحتوي على خطأ واحد على الأقل. هنا في ذلك الوقت، لم يتخذ MSRC أي إجراء 🤡...

CVE-2026-21858

CVE-2026-21858 + CVE-2025-68613 - السلسلة الكاملة لـ n8n قراءة ملفات عشوائية بدون مصادقة → تزوير رمز المدير → تجاوز صندوق الحماية → RCE | ---|--- CVE| CVE-2026-21858 AFR + CVE-2025-68613 RCE CVSS| 10.0 + 9.9 حرجة الإصدارات المتأثرة| = 0.211.0 RCE الإصدار المُصحَّح| 1.121.0 AFR / 1.120.4+ RCE تاري...

CVE-2026-20896

प्रूफ ऑफ कॉन्सेप्ट कोड CVE-2026-20896 यह स्क्रिप्ट Gitea API के रूट वैलिडेशन में तार्किक दोष का शोषण स्वचालित करती है, जिससे प्राधिकरण हेडर में डायरेक्टरी ट्रैवर्सल हमले के माध्यम से सर्वर को एक मान्य प्रशासनिक टोकन प्रदान करने के लिए मजबूर किया जा सकता है। root@kitploit: !/usr/bin/env python3 Po...

regipy

regipy ⚠️ تغييرات جذرية في الإصدار 6.0.0 يتضمن الإصدار 6.0.0 تغييرات تحديثية كبيرة: يتطلب Python 3.9+ - تم إيقاف دعم Python 3.6 و3.7 و3.8 إزالة مكتبةattrs - تستخدم فئات البيانات الآن وحدة dataclasses المضمنة في Python إذا كان الكود الخاص بك يستورد فئات داخلية Cell، VKRecord، Value، Subkey ويستخدم...