Browser-Pwning-

Browser-Pwning 一份条理清晰、结构完善的文档，帮助你入门 chrome 漏洞利用 & v8 漏洞利用 文档结构 本文档的组织方式 1. 动机 2. 实际学习材料 动机 浏览器是当今最常用的技术之一。在每一台现成的计算机上，只要我们即插即用，就会看到已安装的浏览器。因此，从攻击者和威胁模型的角度来看，如果攻击者能够通过恶意页面攻破浏览器，那将是非常有回报的。基于上述理由，我选择研究 Google 的 JavaScript 引擎，尤其是 v8。 鉴于 v8 项目规模庞大，我选择以解释器（即 d8）作为起点。尽管针对 d8 已经进行了大量研究，但我们仍希望至少能找到一个...

TFC-Chrome-v8-bug-CVE-2021-38001-poc

TFC-Chrome-v8-bug-CVE-2021-38001-poc 使用命令行运行 d8: ./d8 2.mjs...

Fedora 43 : python3.11 (2026-22170bd5c0)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-22170bd5c0 advisory. Security release of Python 3.11 interpreter Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

EUVD-2026-65550

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and when MCPSHELLSECCONFIGFILE is unset, main.go starts the documented bare-binary deployment without a security policy...

The vulnerability of the btf_func_proto_check() function in the kernel/bpf/btf.c module, which supports the BPF interpreter of the Linux operating system, allows a attacker to cause a service failure.

The vulnerability of the btffuncprotocheck function in the kernel/bpf/btf.c module, which is part of the Linux kernel’s BPF support, relates to incorrect checking of the type of input data. Exploiting this vulnerability could allow an attacker to cause a service failure...

Astra Linux – Vulnerability in GhostScript

Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in the sampleddatasample function called from sampleddatacontinue and interp...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/binfmtelf: A memory leak was fixed in loadelfbinary. There is also a memory leak reported by kmemleak: Unreferenced object: 0xffff88817104ef80 size: 224 Reported by comm "xfsadmin", pid 47165, jiffies: 4298708825 age: 1333.476...

[SECURITY] Fedora 43 Update: python3.14-3.14.7-1.fc43

Python 3.14 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries...

[SECURITY] Fedora 44 Update: python3.12-3.12.14-1.fc44

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable:...

CVE-2026-75858

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

CVE-2026-75858

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

CVE-2026-68939 Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)

Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...

CVE-2026-68939 Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)

Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...

CVE-2026-68939

Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...

ANT-2026-V6YZYDKK · FreeType2 · Stack Buffer Overflow

stack-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-V6YZYDKK: Stack buffer overflow via pop aft...

CVE-2026-74487 binfmt_misc: restore write access when removing an entry

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: restore write access when removing an entry Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec which denies write access to it for as long as the entry exists. Removing the entry...

CVE-2026-74486

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...

CVE-2026-74486

The CVE-2026-74486 entry describes a Linux kernel vulnerability in binfmt_misc where load_misc_binary() clones the interpreter file and denies write access with exe_file_deny_write_access(), while the exec path later calls exe_file_allow_write_access(). This mismatch can cause repeated write-deni...

The vulnerability of the Python programming language interpreter, related to deficiencies in pathname restrictions for directories, allows attackers to compromise data integrity.

The vulnerability of the Python programming language interpreter is related to deficiencies in pathname restrictions for directories. Exploiting this vulnerability can allow attackers to compromise data integrity...

CVE-2026-68186

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: set haveexecfd only once the interpreter is opened loadmiscbinary raises bprm-haveexecfd as soon as it sees the 'O' or 'C' flag. This happens well before it opens the interpreter. If that open fails the flag stays set...