CVE-2026-108539

A use after free vulnerability exists in GPAC up to version 26.07.0 . The flaw is located within the MP4Box component, specifically affecting the gf_fq_pop function in the filter_core/filter_queue.c file. An attacker may initiate this attack remotely via specific manipulation. Public exploits for...

powerglot

Powerglot Powerglot codifica varios tipos de scripts usando políglotas, por ejemplo, scripts ofensivos de PowerShell. No se necesita un cargador para ejecutar el payload. En ejercicios de red team o tareas ofensivas, el enmascaramiento de payloads suele realizarse mediante esteganografía,...

apache_audit_cve-2026-23918

cve-2026-23918 Defensive audit tools for CVE-2026-23918 Apache HTTPD HTTP/2 double-free RCE and four related CVEs disclosed in the May 4, 2026 Apache Software Foundation security advisory. CVE| Severity| Component| Impact| Affected ---|---|---|---|--- CVE-2026-23918| High CVSS 8.8| HTTP/2| Double...

CVE-2026-108538 GPAC MP4Box os_thread.c gf_mx_v use after free

A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gfmxv of the file utils/osthread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...

EUVD-2026-96731

A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gfmxv of the file utils/osthread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...

CVE-2026-108538

A use after free vulnerability exists in GPAC versions up to 26.07.0 . The flaw is located within the gf_mx_v function of the utils/os_thread.c file in the MP4Box component. This vulnerability can be triggered via a remote attack . While a public exploit has been disclosed and may be used, the ve...

frameless-bitb

Frameless BITB Un nuevo enfoque para el Navegador en el Navegador BITB sin el uso de iframes, permitiendo eludir los framebusters tradicionales implementados por páginas de inicio de sesión como Microsoft. Este código POC está diseñado para usar este nuevo BITB con Evilginx y un phishlet de...

CVE-2015-0311

Reupload of an old Linux/Firefox port of an exploit for CVE-2015-0311 Use-after-free in Adobe Flash Player I created for educational purposes...

CVE-2026-98305

A flaw was found in the Linux kernel's MaxLinear MXL862xx Ethernet switch driver. Improper synchronization during device initialization failure, teardown, or shutdown allows background statistics polling to continue running after port resources have been released. This issue can allow a local use...

CVE-2026-43655-AppleM2ScalerCSCDriver-UAF

CVE-2026-43655: AppleM2ScalerCSCDriver shared scheduler use-after-free Public technical disclosure for CVE-2026-43655 , an AppleM2ScalerCSCDriver / IOSurfaceAccelerator use-after-free reachable from the default iOS app sandbox with no special entitlements. Apple addressed this issue in iOS 26.5 /...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 – Linux Kernel rtmutex removewaiter proxy-lo...

cve-2016-0728-testbed

CVE-2016-0728 testbed This repository contains a test program for CVE-2016-0728, a refcount leak and overflow bug in Linux, that leads to a use-after-free. The bug was found and explained by Perception Point. I am not affiliated to them. Usage Welcome to the CVE-2016-0728 testbed sizeofstruct...

CVE-2026-98295

A flaw was found in the Linux kernel's Bluetooth subsystem. A local user can cause a Denial of Service DoS or memory corruption by disconnecting a Bluetooth device during an active diagnostic crash dump. Because the system fails to cancel pending dump tasks upon device unregistration, background...

Internet-Explorer-UAF

This repository does not have a README...

CVE-2024-52433

CVE-2024-52433 My Geo Posts Free = 1.2 - Unauthenticated PHP Object Injection Description The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated...

Fedora 46 : libpng15 (2026-fc041839f8)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fc041839f8 advisory. Automatic update for libpng15-1.5.30-27.fc46. Changelog Sun Oct 11 2026 Michal Hlavinka - 1.5.30-27 - fix CVE-2025-64505: heap buffer overflow via...

kernel security, bug fix, and enhancement update

5.14.0-687.56.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

List-CVE-2025-2026

CVE-2025-69412 - KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API aka phishing API, which might allow ... 2. CVE-2025-69413 - In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on...

CVE-2026-98286

A flaw was found in the Linux kernel's dropmonitor subsystem. A local user can trigger this issue during monitor teardown under memory pressure, where a race condition allows a timer to be re-armed after it has been cancelled. When the module is subsequently unloaded, the active timer executes...

CVE-2026-68121

⚡ CVE-2026-68121 - PPPoEject Linux Kernel PPPoE Use-After-Free → Local Privilege Escalation A Linux kernel memory-corruption vulnerability in the PPPoE transmit path , caused by a stale pointer to an skbuff header after a device header callback reallocates the skb head. ⚠️ Disclaimer This...