kernel: exec: Cleanup POSIX timers right after de_thread()

A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigg...

kernel: perf: Fix addr_filter_ranges lifetime

A flaw was found in the Linux kernel's performance events perf subsystem. This vulnerability occurs because memory allocated for event address filters is released prematurely while still in active use by other kernel processes. A local user could exploit this use-after-free flaw during performanc...

SteaLinG

SteaLinG v3.1 Description The SteaLinG is an open-source penetration testing framework designed for social engineering After the hack, you can upload it to the victim's device and run it disclaimers: This is only for testing purposes and can only be used where strict consent has been given. Do no...

redexer

redexer Redexer is a reengineering tool that manipulates Android app binaries. This tool is able to parse a DEX file into an in-memory data structure; to infer with which parameters the app uses certain permissions we name this feature RefineDroid; to modify and unparse that data structure to...

CVE-2026-68820_Mass_Exploit

CVE-2026-68820 — Mass Exploit Framework Edition. Automated module for mass local privilege escalation LPE to NT AUTHORITY\SYSTEM via a use-after-free vulnerability in the AFD.sys driver ancillary function driver. This exploit is designed for corporate environments: Supports Windows 10/11 all...

CVE-2019-12889

CVE-2019-12889 Summary An unauthenticated privilege escalation exists in SailPoint Desktop Password Reset 7.2. A user with local access to only the Windows logon screen can escalate their privileges to NT AUTHORITY\System. An attacker would need local access to the machine for a successful exploi...

CVE-2018-10933

libSSH-Authentication-Bypass Spawn to shell without any credentials by using CVE-2018-10933 Exploit-DB : https://www.exploit-db.com/exploits/45638 Information about CVE-2018-10933 by libSSH : https://www.libssh.org/security/advisories/CVE-2018-10933.txt Bugfix Release by libSSH :...

GHSA-VX6W-VV9F-6GVG Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

============================================================================ EPS loadscale lets Ghostscript render past the decompression bomb limit Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

============================================================================ EPS loadscale lets Ghostscript render past the decompression bomb limit Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript Commit: a707c6b21c313880d0771e54965d142dd42358b6...

qu1ckr00t

qu1ckr00t A PoC application demonstrating the power of an Android kernel arbitrary R/W CVE-2019-2215. Writeup: https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/ Qu1ckR00t is a PROOF OF CONCEPT. It should NOT be used on your personal device with valuable userdata. It has...

CVE-2026-85254

CVE-2026-85254 — camel-platform-http: request-header echo suppression bypass header-name case Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the guard that stops a request header being reflected into the response compared header names case-sensitively , while HTTP...

CVE-2026-85257

CVE-2026-85257 — camel-cxf: SOAP fault information disclosure Runnable proof-of-concept reproducer for the Apache Camel vulnerability where, when a route behind a CXF SOAP consumer failed with an exception the service contract does not declare , the exception was described back to the SOAP client...

CVE-2026-85296

CVE-2026-85296 — camel-as2: cross-partner MDN signing key confusion Runnable proof-of-concept reproducer for the Apache Camel vulnerability where per-request signing material was held in state shared across requests rather than confined to the request being processed. A single ResponseMDN is...

CVE-2026-85260

CVE-2026-85260 — camel-mllp: protected health information written to the log Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-mllp component's logPhi option defaulted to true, so a deployment that did nothing wrote HL7 payload content — patient data — to the...

CVE-2026-85300

CVE-2026-85300 — camel-pqc: private key written with permissive file permissions Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-pqc's FileBasedKeyLifecycleManager wrote generated key material to disk with the permissions the process default umask produced ,...

CVE-2026-85301

CVE-2026-85301 — camel-keycloak: issuer validation bypass Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-keycloak's KeycloakSecurityProcessor validated the issuer of an introspected token only when the introspection response actually carried aniss claim. When...

CVE-2026-85312

CVE-2026-85312 — camel-core: saga hijacking via the Long-Running-Action header Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-core's SagaProcessor selected the saga coordinator from the Long-Running-Action message header on every exchange. That header name...

CVE-2026-85313

CVE-2026-85313 — camel-jetty: enableCORS grants credentialed any-origin access Runnable proof-of-concept reproducer for the Apache Camel vulnerability where setting enableCORS=true on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults — which reflect every origin and all...

metasploitable2-pentest-lab

Metasploitable2 Exploitation Lab A hands on penetration exerc...

CVE-2026-85314

CVE-2026-85314 — camel-mail: MimeMultipart header injection mail.smtp Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-mail MimeMultipart data format mapped a message's headers onto the Exchange on unmarshal using a plain DefaultHeaderFilterStrategy, which...