EUVD-2023-60617

A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution...

Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs

Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the Fairwind Program. "The Fairwind Program gives high-priority defenders like governments,...

SoftwareSystemSecurity-2019

SoftwareSystemSecurity-2019 Software System Security Final Assignment: Vulnerability Reproduction CVE-2018-4878 Flash 0day...

CVE-2018-15982

CVE-2018-15982 Flash sources for CVE-2018-15982 used by NK this is a dump of a fully weaponized activex obj used by NK https://threatpost.com/adobe-patches-zero-day-vulnerability-in-flash-player/139629/ Payloads are in Class 6 and 7...

CVE-2018-4878

Author and Credits Author: Vincent Yiu @vysecurity Credits: @evi1cg: Helping me test and keep me motivated @smgoreli: Original Calc.exe PoC @kbandla: He knows, and I know. ; Disclaimer Developed to encourage more Aggressor script development. Use only in authorized penetration testing! Descriptio...

CVE-2026-84696

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write...

CVE-2026-84696

Phison PS3111-S11 controller firmware, in versions through SBFQT1.3 , exposes privileged vendor unique commands (VUC) over the ATA interface with absent or defeatable authentication. Attackers with local access can bypass a weak CRC-16 based unlock handshake or target builds lacking a VUC lock en...

CVE-2026-84696 Phison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write...

Flash-player

Fake-flash.cn Page de phishing de www.flash.cn, chinois + anglais Aperçu en ligne : http://fake-flash.se7ensec.cn/...

CVE-2026-51757

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51756

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component...

CVE-2018-4878

CVE-2018-4878 POC CVE-2018-4878 was first demonstrated being exploited in the wild by TEMP.Reaper. This repository contains the POC we created from the analysed malware, which is known to work against 32-bit versions of Flash 27 by exploiting a Use-After-Free vulnerability. Successful exploitatio...

CVE-2026-51757

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69200

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51757

CVE-2026-51757 is a critical access-control flaw (CVSS 9.8 ) in the TOTOLINK T6 mesh router, firmware 4.1.5cu.748_B20211015 . The meshSlaveUpdate function in the cs_broker component does not properly validate incoming requests, allowing an unauthenticated remote attacker to send a crafted MQTT me...

CVE-2025-51643

CVE-2025-51643: Unprotected SPI Flash Enables Firmware Extraction in Meitrack T366G-L Description Meitrack T366G-L GPS Tracker devices contain an SPI flash chip Winbond 25Q64JVSIQ that is accessible without authentication or tamper protection. An attacker with physical access can attach a standar...

CVE-2026-80597

A flaw was found in the Linux kernel's mtd: maps: vmu-flash component. During the initialization of the Memory Technology Device MTD, a NULL pointer dereference can occur if the mtdinfo structure, which contains a device structure, is not properly linked to its parent. This issue can lead to the...

CVE-2026-80712

A flaw was found in the Linux kernel's spi-qpic-snand driver. This vulnerability arises from an incorrect timing issue where the SETFEATURE command for SPI-NAND flash devices is executed before the intended feature value is properly written. Consequently, the device is programmed with an outdated...

EUVD-2026-68586

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83852

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setUploadSetting function allows unauthenticated attackers to manipulate the upload or flash workflow. This is achieved by sending a crafted POST request to...