EUVD-2026-76746

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-89607

A flaw was found in ecryptfs in the Linux kernel. The parsetag3packet function does not properly validate the size of the encrypted key, allowing an oversized key to be processed. This improper validation leads to out-of-bounds writes, corrupting critical data structures within the ecryptfsauthto...

CVE-2026-89487

A flaw was found in openvswitch in the Linux kernel. This vulnerability occurs when the queueuserspacepacket function incorrectly modifies a shared network packet buffer by stripping a critical flag. This action can lead to an unprivileged page-cache write, allowing a local attacker to modify dat...

CVE-2026-89668

A flaw was found in the nfsd component of the Linux kernel. The nfsddebugfsinit function is called before nfsd4initslabs. If the slab allocation fails, the nfsddebugfsexit cleanup function is bypassed, leaving orphaned debugfs files with stale function pointers. This can lead to a use-after-free...

CVE-2025-47810

PunkBuster LPI（CVE-2025-47810） 背景 PunkBusterは、2つのサービスとオプションのカーネルドライバとしてインストールされます。 PnkBstrA: 常にバックグラウンドで動作し、PunkBuster全体を管理するサービス PnkBstrB: 保護されたゲームが開始されると起動するサービス。Aよりも多くの機能を備えています。 両方のサービスは同様の構造を持ち、localhostのUDPポート44301, 44400の範囲で待ち受けます。 ポートが見つかると、HKLM:\SOFTWARE\Even...

Linux Distros Unpatched Vulnerability : CVE-2026-89579

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallba...

Linux Distros Unpatched Vulnerability : CVE-2026-89610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run...

Linux Distros Unpatched Vulnerability : CVE-2026-89638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions When a file has the setuid or setgid bit set and is written to, the VFS...

CVE-2026-89579

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component, specifically impacting 32-bit systems. This vulnerability stems from incorrect sizing and indexing of bloom filters, which can lead to out-of-bounds memory access. A local attacker with CAPBPF capabilities could exploit...

CVE-2026-80969

A flaw was found in the Linux kernel's ALSA mpu401 driver. The driver fails to validate the card index when a device is manually bound through the sysfs interface. This oversight can lead to an out-of-bounds memory access. A local attacker with appropriate permissions could exploit this...

CVE-2026-89486

A flaw was found in the Linux kernel's Intelligent Platform Management Interface IPMI subsystem. Due to incorrect synchronization during the deallocation of command receiver objects, a use-after-free vulnerability can occur. This allows a freed memory region to be accessed, which could be exploit...

CVE-2026-68138

CVE-2026-68138：Linux qdisc 速率表竞态导致本地 root 提权 本仓库包含针对 CVE-2026-68138 的概念验证型本地权限提升漏洞利用程序，该漏洞是 Linux 流量控制速率表代码中的一个竞态条件。在测试的 QEMU 环境中，该 PoC 可将初始用户命名空间中 UID 为 1000 的普通进程提升为 UID 为 0 的 shell。 警告 此代码会故意破坏内核堆状态。请仅在你拥有的一次性隔离虚拟机中使用。竞态失败或过早清理可能导致客户机内核崩溃。请勿在工作站、服务器或第三方系统上运行。 漏洞概要 qdiscgetrtab 和 qdiscputrtab...

amd-ryzen-master-driver-v17-exploit

使用 AMD 的 Ryzen Master 驱动程序（版本 17）进行内核漏洞利用的 Cobalt Strike Beacon 对象文件。 由 Tijme 构建。感谢 Alex 的教导！由 Northwave Security 提供支持 描述 这是一个利用 AMD 的 Ryzen Master 驱动程序（版本 17）的 Cobalt Strike CS Beacon 对象文件 BOF 和可执行文件。它仅将 beacon 进程令牌覆盖为系统进程令牌。但是，就像 KernelMii 一样，这个 BOF 主要只是通过 CS 进行进一步内核漏洞利用的良好基础。你可以利用它来禁用 EDR、禁用 E...

SharpStartWebclient

SharpStartWebclient 从非特权会话运行，以启动 WebClient 服务并实现绝妙的提权。 Beacon Object File 的 C 移植版本，源自 https://github.com/outflanknl/C2-Tool-Collection/blob/main/BOF/StartWebClient/SOURCE/StartWebClient.c...

SeManageVolumeExploit

SeManageVolumeExploit 此漏洞为机器上的所有用户授予对 C:\ 驱动器的完全权限。 在令牌中启用该特权 使用 SYNCHRONIZE | FILETRAVERSE 创建指向 \.\C: 的句柄 发送 FSCTLSDGLOBALCHANGE，将 S-1-5-32-544 替换为 S-1-5-32-545 覆盖 "Printconfig.dll" 以获取 SYSTEM Shell 访问权限 在受保护目录中创建用户可控文件的能力，为权限提升带来了多种可能性。其中相对简单的技术之一，是将位于 "C:\Windows\System32\spool\drivers\x64\3" ...

RToolZ

RToolZ 一个隐蔽的 Lsass 转储工具——可利用 ProcExp152.sys 驱动程序来转储受 PPL 保护的 Lsass。 它有何特别之处？ 不调用 MiniDump 或任何 dbghelp.lib 方法，整个转储过程由转储工具手动完成，同时通过移除不必要的 DLL 将转储体积降至最小。 方法与使用方法 OmriToolZ 提供 3 种转储 lsass 的方法： 1. 第一种方法直接使用系统调用（syscalls）获取 lsass 句柄。 2. 第二种方法，以 PROCESSCREATEPROCESS 权限请求获取 lsass 的句柄，以 lsass 的名义创建一个新进程，并...

CVE-2024-10220-githooks

CVE-2024-10220 テスト 参照 https://irsl.medium.com/sneaky-write-hook-git-clone-to-root-on-k8s-node-e38236205d54...

CVE-2026-89548

A flaw was found in the Linux kernel's SUNRPC component. When sunrpcdestroycachedetail is called, it may not properly drain the cachecleaner before freeing a cachedetail object. This oversight can lead to a use-after-free vulnerability, where the system attempts to access or use memory that has...

CVE-2025-47646

CVE-2025-47646 PoC WordPress PSW Front-end Login Registration Plugin ≤ 1.12 の認証なし権限昇格エクスプロイト 📖 説明 このPythonスクリプトは、CVE-2025-47646 の概念実証（PoC）エクスプロイトです。影響を受けるのは WordPress PSW Front-end Login Registration Plugin ≤ 1.12 の脆弱性です。...

RasmanPotato

RasmanPotato 感谢 @Wh04m1001 一直以来的持续交流 与其他 potato 类似的又一个 potato，利用 RasMan 服务进行权限提升 适用于 Windows 10（未测试 11）、Windows Server 2012 - 2019（未测试 2022） 用法 root@kitploit: magicRasMan v0.1 Provided that the current user has the SeImpersonate privilege, this tool will have an escalation to SYSTEM Arguments: -c...