SharpPolarBear

SharpPolarBear This is a weaponized version for one of the Exploits published by SandboxEscaper from here https://github.com/SandboxEscaper/polarbearrepo. Most of the code comes from rasta-mouse CollectorService repository https://github.com/rasta-mouse/CollectorService. I just changed the...

CVE-2025-3464-AsIO3-LPE

CVE-2025-3464-AsIO3-LPE CVE-2025-3464: Unprivileged LPE exploit for ASUS AsIO3.sys - TOCTOU auth bypass + PreviousMode decrement CVE-2025-3464: AsIO3.sys Local Privilege Escalation This exploit will only work on Windows 11 22H2 or earlier. Microsoft fixed PreviousMode hijinks. Local privilege...

CVE-2026-29786

CVE-2026-29786 Research: Joshua van Rijswijk Description This repository contains a Proof of Concept PoC for CVE-2026-29786 , a vulnerability in the tar npm package that allows a crafted archive to create a hardlink pointing outside the intended extraction directory. The issue occurs when a tar...

CVE-2020-10665

CVE-2020-10665 Docker Desktop Local Privilege Escalation POC for Docker Desktop Local Privilege Escalation. Built based on the writeup at https://www.activecyber.us/activelabs/docker-desktop-local-privilege-escalation-cve-2020-10665. Hardlink creation adapted from...

research

Security Research Repository dedicated to my security vulnerability discoveries CVEs. This repository contains detailed technical documentation, proof-of-concept exploits, and analysis of discovered vulnerabilities. About This repository aggregates all CVEs I have discovered and researched,...

CVE-2025-4517-POC

CVE-2025-4517 Exploit NOTES This exploit and description are written by AI. If you find a mistake or issue, please let me know! This exploit was tested and confirmed working. Thank you! Overview This exploit leverages CVE-2025-4517 , a critical vulnerability in Python's tarfile module that allows...

CVE-2025-55188

CVE-2025-55188: 7-Zip Arbitrary File Write Proof-of-concept of CVE-2025-55188, an arbitrary file write in 7-Zip. Patched in version 25.01, released on August 3, 2025. Note: CVE-2025-55188 is different than CVE-2025-11001. The version that CVE-2025-11001 was patched in version 25.00 is still...

CVE-2026-115424

A flaw in the OpenShift client (oc) allows for a symlink/hardlink target validation bypass during the oc image extract operation. The application fails to properly sanitize links pointing to absolute paths or sibling directories, enabling an attacker providing a malicious container image to write...

CVE-2026-115424 Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a...

tox-dev filelock: race condition issue

The tox-dev filelock version 4.1.0 to 4.2.1 had a race condition vulnerability. This vulnerability stemmed from SoftFileLock’s ability to restore files by their name after removing an outdated marker. This allowed local users with rename privileges in non-sticky lock directories to replace symbol...

Linux Distros Unpatched Vulnerability : CVE-2026-47699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image...

GHSA-GFP8-W835-V44J borg extract might modify out-of-tree files when extracting maliciously crafted archives

Impact A maliciously crafted archive could contain a symlink e.g. "evil" - "/etc" followed by an item below it "evil/passwd", or an item whose path embeds ".." e.g. "a/../../etc/passwd". When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite fil...

borg extract might modify out-of-tree files when extracting maliciously crafted archives

Impact A maliciously crafted archive could contain a symlink e.g. "evil" - "/etc" followed by an item below it "evil/passwd", or an item whose path embeds ".." e.g. "a/../../etc/passwd". When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite fil...

busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

CVE-2026-108119

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

UBUNTU-CVE-2026-108119

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

CVE-2026-108119

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

CVE-2026-108119

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

CVE-2026-108119 Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

CVE-2026-108119

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...