CVE-2023-24871

CVE-2023-24871 This repository contains materials related to CVE-2023-24871, which I covered in this series of posts. You'll find more info inside the specific folders, since the vulnerability allowed both RCE & LPE...

CVE-2021-46417

CVE-2021-46417 Franklin Fueling Systems Colibri Controller Module - Local File Inclusion Optional Arguments: -h, --help show this help message and exit -u url, --url url Target url eg:"http://127.0.0.1" -f file, --file file Targets in file eg:"ip.txt" Use python3 CVE-2021-46417.py -u...

PwnKit-Local-Privilege-Escalation-Vulnerability-Discovered-in-polkit-s-pkexec-CVE-2021-4034

PwnKit-Local-Privilege-Escalation-Vulnerability-Discovered-in-polkit-s-pkexec-CVE-2021-4034- Software Vulnerabilities and mitigation university project, to show exploitation and remediation caused by this vulnerability. We used for this experiment Ubunto version 16.04 LTS, as well and Debian 10.1...

K80Pro-miro-CVE-2026-64560

k80pro-miro-cve-2026-64560 Redmi K80 Pro miro 的 CVE-2026-64560 用户态本地提权移植项目。 🚀 不想看这么多文档？ 如果你不想深入研究 ，或者不想读这一堆 AI 生成的.md， 请直接看 dyc.md —— 一篇讲人话的快速上手： 从零到越狱（含 KernelSU），只讲要敲什么命令，不讲为什么。 上游漏洞利用及 Xiaomi 15 dada 适配来自 quyicheng03-boop， 本仓库是在其基础上为 K80 Pro 重新推导地址与常量后的移植成果。 本项目只做移植，不包含漏洞发现。 漏洞原理、利用链设计全部属于上游作者...

USN-8818-2 linux-ibm-5.15 vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

USN-8818-2: Linux kernel (IBM) vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

CVE-2026-15667

CVE-2026-15667 CVE-2026-15667 WordPress Event Solution LFI POC Eventin WordPress plugin wp-event-solution ≤ 4.1.22 — authenticated Contributor+ local file inclusion via the eventlayout REST field. For authorized testing only. Do not run this against systems you do not own or have permission to...

CVE-2026-36980-Kernel-BSOD-DoS-PoC

CVE-2026-36980-Kernel-BSOD-DoS-PoC Project Date : Feb 2026 / Discovered a buffer overflow vulnerability in the IOCTL handler of the pwdrvio.sys kernel driver. The vulnerability allows an unprivileged local attacker to corrupt kernel pool memory, triggering an immediate system crash BSOD and Denia...

CVE-2025-27136-XXE-LocalS3

CVE-2025-27136 XXE-LocalS3 Proof of Concept for CVE-2025-27136 XXE in Local-S3 └─$ python3 exploit.py http://$ip:8080 /etc/passwd + S3 service detected + Creating bucket: xxe-32d14993 + Server response: ac3aaf20-e59a-4705-9505-3ebb01db7fc1 + Retrieving file via ?location + Response:...

AZL-104598 CVE-2026-98116 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF sndpcmhwparams and sndpcmhwfree guard buffer reallocation with an mmapcount check performed under the PCM stream lock, but the lock is released long before th...

CVE-2026-98116

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF sndpcmhwparams and sndpcmhwfree guard buffer reallocation with an mmapcount check performed under the PCM stream lock, but the lock is released long before th...

DEBIAN-CVE-2026-98116

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF sndpcmhwparams and sndpcmhwfree guard buffer reallocation with an mmapcount check performed under the PCM stream lock, but the lock is released long before th...

AZL-104838 CVE-2026-98095 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: afpacket: Don't cast tpackethdr.tplen to int in tpacketparseheader. syzbot reported BUG in socksendmsgnosec. 0 The problem is that tpacketparseheader casts user-provided tpackethdr.tplen, which is u32, to int. If the length is...

DEBIAN-CVE-2026-98037

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTRUNTRUSTED but retains MEMALLOC. The pointer may be NULL or may refer to an object whose lifetime is...

CVE-2026-98037

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTRUNTRUSTED but retains MEMALLOC. The pointer may be NULL or may refer to an object whose lifetime is...

AZL-104448 CVE-2026-98027 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

CVE-2026-97910

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprdplatformcompropen allocates the stage 0 IRAM buffer 32K data area and the stage 1 DDR buffer 2M data area with fixed sizes, but sprdplatformcomprcopy derive...

AZL-104736 CVE-2026-97910 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprdplatformcompropen allocates the stage 0 IRAM buffer 32K data area and the stage 1 DDR buffer 2M data area with fixed sizes, but sprdplatformcomprcopy derive...

DEBIAN-CVE-2026-97602

In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues before flushing them fqdirpreexit flushes the skbs from incomplete queues without changing their completion state. A fragment which found a queue before highthresh was cleared can then acquire the...

AZL-104538 CVE-2026-97602 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues before flushing them fqdirpreexit flushes the skbs from incomplete queues without changing their completion state. A fragment which found a queue before highthresh was cleared can then acquire the...