CVE-2026-89610

A flaw was found in the Linux kernel's NTFS component. The mapping pairs decoder fails to verify if a run length extends beyond the volume boundary. A local attacker could exploit this by providing a malformed NTFS image with a crafted mapping pairs array. This could lead to memory corruption and...

CVE-2022-26923_AD-Certificate-Services

CVE-2022-26923 AD 证书服务 发布日期 ：2022年5月10日 攻击复杂度：低 所需权限：低 CVSS 评分： 8.1 该漏洞允许低权限用户在默认的 Active Directory 环境中（安装有 Active Directory 证书服务 AD CS 服务器角色）将权限提升为域管理员。 由 Oliver Lyak ly4k 用 Python 开发了一个利用程序，并在公告发布之前（而非之后）公开。它被声明为概念验证。该利用程序可在 research.ifcr.dk 下载。 来源：...

CVE-2022-0847

CVE-2022-0847 将 dirtypipe 脚本修改为自动提权，无需手动搜索文件来劫持 suid 二进制文件。 编译 gcc dirty.c -o dirty gcc dirtypipe2.c -o dirty 运行 ./dirty 然后你将自动获得 root 权限 修改内容 受影响的内核 内核版本高于 5.8 可能受影响 版本 5.10 版本 5.15 版本 5.16...

CVE-2026-80928

A flaw was found in the Linux kernel's SMACK Simplified Mandatory Access Control Kernel security module. Incorrect handling of task credentials within the smackfilesendsigiotask function can lead to a Use-After-Free UAF vulnerability. A local attacker could exploit this flaw to potentially escala...

CVE-2022-29582-Exploit

CVE-2022-29582 このリポジトリには、CVE-2022-29582 のエクスプロイトコードが含まれています。これは Linux カーネルの iouring におけるローカル権限昇格（Local Privilege Escalation）です。 デフォルト設定が影響を受け、特別な権限は必要ないはずです。 解説は https://ruia-ruia.github.io/2022/08/05/CVE-2022-29582-io-uring/ でご覧いただけます。 ビルド 以下のコマンドを実行します。 root@kitploit: make...

CVE-2026-89656

A flaw was found in libceph within the Linux kernel. This vulnerability allows a local attacker to craft a malformed CRUSH map, which is used for data placement. By doing so, one data bucket can be made to reuse another bucket's memory workspace, leading to an out-of-bounds write. This memory...

CVE-2026-82329

CVE-2026-82329 — JFrog Artifactory 未认证身份验证绕过（批量利用） -red.svg 严重身份验证绕过（CVSS 9.8）— 已在野外被积极利用 该工具是 CVE-2026-82329 的批量利用 工具，该漏洞允许具有网络访问权限的未认证攻击者 在自托管 JFrog Artifactory 实例上获得完全管理权限 。支持单目标和多线程批量扫描。 ⚠️ 漏洞概述...

CVE-2026-23111-POC-noddlenpottato

CVE-2026-23111 — noddlenpottato nftables catchall UAF → 非特权 LPE。在大多数 5.10—6.18 Linux 内核上实现从普通用户到 root 的提权。 自动适配目标内核 — 检测结构体偏移、解析符号、查找 ROP gadgets、确定 slab 缓存、生成定制化 exploit、编译并运行。 nftables catchall UAF → 非特权 LPE。在大多数 5.10—6.18 Linux 内核上，普通用户可变为 root。 自动适配目标内核 — 检测结构体偏移、解析符号、查找 ROP gadgets、确定 slab...

CVE-2026-89502

A flaw was found in the Linux kernel's ring-buffer component. When sub-buffers are configured with a specific memory allocation order greater than zero, the system attempts to free a memory page using an incorrect size. This memory management error can lead to memory corruption, potentially...

MegaHiDocker

MegaHiDocker 本项目将利用一些具有类似漏洞代码（CVE-2020-35191）的 Docker 容器进行攻击，但此次针对的是其他容器。 = 请阅读 Description.txt 文件 要求： 1. 需要在你的 Linux 中安装 Docker，并为 Python 3.X 安装 subprocess 模块。 2. 你需要拉取你的容器，然后运行此代码（例如：docker pull ） 漏洞影响： 1. CVSS：9.8 严重 2. 影响代码执行：是 3. 影响拒绝服务：是 4. 影响权限提升：是 5. 影响信息泄露：是 6. 受影响组件：/etc/shadow 受影响软件：...

CVE-2026-89636

A flaw was found in the Linux kernel's Server Message Block SMB client. When the freetgts function frees data structures, a pointer ce-tgthint is not properly reset, leaving it pointing to a memory location that has already been deallocated. If this pointer is subsequently used, it can lead to a...

CVE-2026-80929

A flaw was found in the Linux kernel. A non-root user can exploit a vulnerability in the sysctl mechanism, specifically related to the cadpid entry. By unsharing process ID PID and user namespaces, a local attacker can modify this global system control from a child namespace. This allows a user...

CVE-2026-89750

A flaw was found in the Linux kernel's tracing/userevents component. This vulnerability arises when a child process, created via fork, exits and frees memory that the parent process still references. This creates a Use-After-Free UAF condition, where the parent process attempts to access freed...

CVE-2026-89438

A flaw was found in the Linux kernel, specifically within the Intel Speed Select Technology ISST component. This vulnerability arises from insufficient validation of input values, such as logical CPU ID and CLOS ID, used in the core power feature. A local attacker could exploit this by providing...

OSDS_Paper_CVE-2016-5195

CVE-2016-5195 "Dirty COW" Este repositorio contiene mi artículo y las diapositivas de la presentación sobre CVE-2016-5195, una vulnerabilidad de escalada de privilegios en Linux, escritos para el curso Operating Systems: Design And Security en la FMI, Universidad de Bucarest. Correction En mi...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2021-25253

root@kitploit: Exploit Title: Trend Micro OfficeScan Client 10.0 - ACL Service LPE Date: 2023/05/04 Exploit Author: msd0pe Vendor Homepage: https://www.trendmicro.com My Github: https://github.com/msd0pe-1 趋势科技 OfficeScan 客户端： 10.0 及以下版本在 OfficeScan 客户端文件夹上存在错误的 ACL...

CVE-2026-89761

A flaw was found in the Linux kernel's AppArmor security module. An out-of-bounds write vulnerability exists when null terminating a label vector due to improper memory allocation. An unprivileged local attacker can exploit this by writing to specific system files, potentially leading to a denial...

CVE-2024-1086

CVE-2024-1086 仅供学习目的。 参考： https://pwning.tech/nftables/ https://github.com/Notselwyn/CVE-2024-1086 Kconfig： root@kitploit: +CONFIGCONFIGFSFS=y +CONFIGSECURITYFS=y +CONFIGNFTABLES=y mnlcbrun: Operation not supported +CONFIGNETFILTERNETLINKGLUECT=y +CONFIGNETLINKDIAG=y +CONFIGNFTCT=y...

FalconFlank

FalconFlank Crowdstrike Falcon 0day 权限提升漏洞 FalconFlank 是一个 0day 权限提升漏洞，它滥用了 Crowdstrike Falcon Sensor 中的 Office 恶意宏修复功能。显然，在我发布此漏洞时，Crowdstrike 可能已经具备针对它的检测能力，因此如果你想进行测试，要么将其添加到排除列表中，要么混淆 PoC 并更改 DLL 加载技术。 截至目前，它适用于完全更新的 Windows 11 25H2 / Windows Server 2025，并搭配 Crowdstrike Falcon - Phase 3 Optim...