AV-Chaos-Monkey

AV Chaos Monkey 分布式混沌工程平台，用于对视频会议系统进行负载测试。模拟超过1500个WebRTC参与者，传输H.264/Opus流，并注入网络混沌尖峰，以验证系统在降级条件下的韧性 架构 1. 媒体处理管道 ： FFmpeg 在启动时将输入视频转换为 H.264 Annex-B 和 Ogg/Opus NAL Reader 解析 H.264 流（SPS/PPS/IDR/Slices） Opus Reader 从 Ogg 容器中提取 20ms 音频帧 帧数据缓存在内存中，所有参与者共享（零拷贝） 相比每个参与者独立编码，CPU 降低约 90% 2. 控制平面 ： HTTP...

CVE-2025-14893

CVE-2025-14893: Cross-Site Scripting XSS Almacenado Autenticado en el Plugin IndieWeb de WordPress Descargo de responsabilidad: Este repositorio se crea únicamente con fines educativos y de divulgación ética. La vulnerabilidad ha sido reportada de manera responsable al proveedor y corregida. No...

CVE-2026-97486

In the Linux kernel, the following vulnerability has been resolved: hpfs: handle setblocksize failures hpfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97419

In the Linux kernel, the following vulnerability has been resolved: hsr: broadcast netlink notifications in the device's net namespace The HSR generic netlink family sets .netnsok = true. HSR devices can live in network namespaces other than initnet. Two async notifiers broadcast events with...

CVE-2026-93826

In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidppconnectevent If inputregisterdevice fails, we call inputfreedevice, but keep stale pointer to the old device in hidpp-input, which could potentially lead to UAF. Fix that by resetting it to...

CVE-2025-32462-

CVE-2025-32462 – Bypass de Hostname en Sudo para Escalada de Privilegios Tabla de Contenidos 1. Resumen 2. Detalles de la Vulnerabilidad 3. Impacto 4. Entorno de Laboratorio 5. Verificación de la Versión Vulnerable 6. Configuración de Usuario y sudoers 7. Recorrido de Explotación 8. Resumen de la...

AndroidAuto

Open Android Auto Android Auto 手机端 应用的开源实现。此应用在手机上运行，通过USB将画面投射到汽车头机，替代Google专有的 com.google.android.projection.gearhead APK。 ⚠️ 正在进行中 本项目处于早期开发阶段。协议握手和视频投影已在真实头机上成功运行。手机屏幕可在汽车头机上成功显示约几秒钟后断开（视频稳定性正在改进）。 功能 协议与连接 USB AOA 附件模式检测与连接 TLS 1.2 双向认证（手机作为服务器） 版本协商（协议 v1.7） 服务发现（请求/响应）...

CVE-2019-2107

CVE-2019-2107 CVE-2019-2107 CVE-2019-2107 - looks scary. Still remember Stagefright and PNG bugs vulns .... With CVE-2019-2107 the decoder/codec runs under mediacodec user and with properly "crafted" video with tiles enabled - pspps-i1tilesenabledflag you can possibly do RCE. The codec affected i...

Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting

Parallels H-Sphere 3.0.0 P9 and 3.1 P1 contains multiple cross-site scripting vulnerabilities in login.php in webshell4. An attacker can inject arbitrary web script or HTML via the err, errorcode, and login parameters, thus allowing theft of cookie-based authentication credentials and launch of...

CVE-2025-32462-POC

CVE-2025-32462 – sudo -h 权限提升 PoC 🚨 通过 -h/--host 参数利用 sudo 的本地权限提升漏洞 影响存在 sudo 配置错误导致非预期根访问的系统。 🧠 简介 此 PoC 演示了 CVE-2025-32462 ，这是 sudo（所有版本 ≤ 1.9.17）中的一个逻辑缺陷，滥用 -h 选项可绕过 RunAs 限制，导致非预期的根命令执行。 📋 要求 受影响的 sudo 版本：≤ 1.9.17 sudoers 配置包含类似这样的错误配置： ALL, !root NOPASSWD: ALL 🚀 使用 chmod +x CVE-2025-32462.s...

CVE-2024-55040-Sensaphone-XSS

SENSAPHONE VULNERABILITY DISCLOSURE Summary In mid-September 2024, I identified several medium-to-low severity security issues in the Sensaphone Web600 Monitoring System, including stored cross-site scripting XSS vulnerabilities in the system Setup, Profile, and Zone options. Remote authenticated...

[SECURITY] [DLA 4789-1] libde265 security update

Debian LTS Advisory DLA-4789-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost September 20, 2026 https://wiki.debian.org/LTS Package : libde265 Version : 1.0.11-1+deb12u3 CVE ID : CVE-2023-51792 CVE-2024-38949 CVE-2024-38950 CVE-2026-33164 CVE-2026-33165...

Hundred OSINT

h-osint h-osint Un banco de trabajo OSINT local-first, controlado por teclado, para la terminal — keybinds estilo Neovim, configuración en Lua, 12 temas y un almacén local de casos en SQLite. Sin cuenta, sin backend en la nube, sin telemetría. root@kitploit: kitty » h-osint Repositorio: h-osint ·...

h-encore

h-encore h-encore , donde h significa hacks y homebrews, es el segundo jailbreak público para la PS Vita™ que es compatible con los firmware más recientes 3.65, 3.67 y 3.68. Te permite realizar modificaciones de kernel y de usuario, cambiar la velocidad del reloj, instalar plugins, ejecutar...

FreeRDP: FreeRDP: Out-of-bounds read leads to memory disclosure or client crash

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can provide a specially crafted H.264 video stream that causes the client's H.264 decoder to read beyond its allocated memory. This out-of-bounds read can lead to the disclosure of sensitive client memory or cause the...

FreeRDP: FreeRDP: Out-of-bounds read leads to memory disclosure or client crash

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can provide a specially crafted H.264 video stream that causes the client's H.264 decoder to read beyond its allocated memory. This out-of-bounds read can lead to the disclosure of sensitive client memory or cause the...

CVE-2026-77692

An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG0 record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1...

Astra Linux – Vulnerability in DjVuLibre

In DjVuLibre 3.5.27, the sorting functionality also known as GArrayTemplate::sort allows attackers to cause a denial-of-service attack, resulting in an application crash due to uncontrolled recursion. This can occur when a PBM image file is mishandled in the libdjvu/GContainer.h header file...

Astra Linux – Vulnerability in libde265

libde265 is an open-source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit caused a segmentation fault in the picparameterset::setderivedvalues function. This issue has been fixed in version 1.0.17...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: xfs: Fixed the allocation of the log recovery buffer for the legacy hsize parameter. The commit a70f9fe52daa “xfs: detects and handles invalid iclog size settings provided by mkfs“” added a fix for incorrect hsize values used ...