CVE-2026-20521

A missing bounds check in the Video HAL component can lead to a local escalation of privilege . This vulnerability allows an attacker to gain elevated privileges without requiring additional execution privileges or user interaction. The vulnerability is associated with Patch ID: ALPS11375674 and ...

CVE-2026-20589

A type confusion vulnerability in venc can lead to an out-of-bounds write . If a malicious actor has already obtained System privilege , this flaw could be exploited to achieve a local escalation of privilege . No user interaction is required for exploitation. Remediation is available via Patch I...

CVE-2026-20589

In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9606...

EUVD-2026-92207

In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9606...

CVE-2026-20589

In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9606...

2009

2009 Linuxカーネルエクスプロイト - CVE-2009-1185 + CVE-2009-1337 + CVE-2009-2692 + CVE-2009-2698 + CVE-2009-3547...

cve-2025-7771

CVE-2025-7771 — ThrottleStop.sys LPE CVE-2025-7771 の概念実証。ThrottleStop.sys は、アクセス制御なしで任意の物理メモリ読み取り/書き込みを可能にする2つのIOCTLハンドラを公開しています。つまり、任意の管理者プロセスが物理RAM内の任意の場所を読み書きできます。 Windows 10 22H2 および Windows 11 23H2 x64 でテスト済み。 やったこと まずドライババイナリを IDA Pro にロードし、内部の動作を理解しました。IRPMJDEVICECONTROL...

kernel: net: qrtr: restrict socket creation to the initial network namespace

A flaw was found in the Linux kernel's QRTR Qualcomm IPC Router networking component. An unprivileged local attacker can create a QRTR socket in a separate network namespace. Due to improper handling of global state variables, this allows the attacker to send datagrams and control-plane messages ...

kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled

A flaw was found in the Linux kernel's memory management subsystem. This issue occurs when the kernel's memory allocator attempts to zero out newly allocated memory, but an incorrect check prevents the full memory region from being cleared under specific configurations. This can lead to memory no...

CVE-2026-105293

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2025-4524

CVE-2025-4524 WordPress Madara Theme 2.2.2.1 - ローカルファイルインクルージョン...

CVE-2026-105293

Legcord versions 1.1.0 through 1.3.0 are vulnerable to a path traversal vulnerability within the theme IPC handlers. The root cause is the use of unvalidated theme ids , which allows scripts running in the Discord origin (e.g., via XSS ) to escape the designated themes directory. Attackers can ab...

EUVD-2026-92157

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-105293 Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-50656-rogueplanet-validation

RoguePlanet PoC 検証レポート Microsoft Defender 向け レポートの目的と範囲 本レポートは、Microsoft Defender に関連して公開された RoguePlanet PoC の検証に関するものです。説明されている手法は、2026年6月10日にメディアでローカル権限昇格（LPE）として発表されました。ローカルユーザーが NT AUTHORITY\SYSTEM 権限を取得できる可能性があるとされています。公開された説明では、Microsoft Defender がファイルを処理またはスキャンする際に使用する関数を利用するメカニズムであるとされていま...

ghostlock-cve-2026-43499-4.19-k40

GhostLock — CVE-2026-43499 PoC（Qualcomm 4.19 内核） 本地权限提升，利用 CVE-2026-43499 —— 一个 rtmutex removewaiter 缺陷，该缺陷会在等待者的内核栈上留下一个悬空的 struct rtmutexwaiter（kernel/locking/rtmutex.c，CWE-416 释放后使用）。 改编自 NebuSec/CyberMeowfia （IonStack/CVE-2026-43499，Apache-2.0），面向 Qualcomm Android 4.19.x 厂商内核系列。...

cve-2026-64560-a16

CVE-2026-64560 — ツールチェーン + マルチターゲット移植 CVE-2026-64560 は Linux カーネル posix-cpu-timers の use-after-free （ローカル非特権レース、CVSS 3.1 = 7.8；6.6.118 では未修正、6.6.147 でようやく修正）。 このリポジトリには二つの目的がある：上流では Python スクリプト群でしか駆動できなかったツールチェーンを単一の静的 Go バイナリ にすること、 そして上流にはない realme RMX5010（A16 / SM8750） ターゲットを補うこと。 !WARNING...

By-Poloss..-..CVE-2026-7515-PoC

CVE-2026-7515: BetterDocs Pro views-get"layouts/encyclopedia/$docstyle", 'doc' = $doc, 'excerpt' = $excerpt, 'dictionarylearnmoretext' = $learnmoretext, 'itemheadingtag' = $itemheadingtag, ; 문제점: $docstyle 변수사용자 제어가 views-get에 전달되는 파일 경로에 직접 포함되어 파일을 포함합니다. 데이터 흐름 HTTP POST 요청 ↓ $POST'docstyle' =...

CVE-2026-43499-pmg110-root

pmg110-root CVE-2026-43499 futex PI rtmutexwaiter use-after-free ローカル権限昇格、 OPPO PMG110 / K15 Pro+ — MediaTek MT6991、ColorOS 16 向けに移植。 プッシュするファイルは 1 つだけ。LDPRELOAD で実行します： adb push out/preload-pmg110-16.0.9.400.so /data/local/tmp/preload.so adb shell chmod 644 /data/local/tmp/preload.so adb shell...

CVE-2026-28641: Undefined Security Weakness

In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...