ghostlock-cve-2026-43499-4.19-k40

GhostLock — CVE-2026-43499 PoC Qualcomm 4.19 커널 CVE-2026-43499 를 악용한 로컬 권한 상승 — rtmutex removewaiter 버그로 인해 struct rtmutexwaiter가 대기자의 커널 스택에 댕글링 포인터로 남게 된다 kernel/locking/rtmutex.c, CWE-416 use-after-free. NebuSec/CyberMeowfia IonStack/CVE-2026-43499, Apache-2.0에서 Qualcomm Android 4.19.x 벤더 커널...

cve-2026-64560-a16

CVE-2026-64560 — 도구 체인 + 다중 타깃 이식 CVE-2026-64560은 Linux 커널 posix-cpu-timers의 use-after-free입니다 로컬 비권한 레이스, CVSS 3.1 = 7.8; 6.6.118 미수정, 6.6.147에서야 수정. 이 저장소에는 두 가지가 있습니다: 업스트림에서 수많은 Python 스크립트로만 구동 가능한 도구 체인을 단일 정적 Go 바이너리 로 만드는 것, 그리고 업스트림에 없는 realme RMX5010 A16 / SM8750 타깃을 추가하는 것입니다. !WARNING...

By-Poloss..-..CVE-2026-7515-PoC

CVE-2026-7515: BetterDocs Pro views-get"layouts/encyclopedia/$docstyle", 'doc' = $doc, 'excerpt' = $excerpt, 'dictionarylearnmoretext' = $learnmoretext, 'itemheadingtag' = $itemheadingtag, ; 문제점: $docstyle 변수사용자 제어가 views-get에 전달되는 파일 경로에 직접 포함되어 파일을 포함합니다. 데이터 흐름 HTTP POST 요청 ↓ $POST'docstyle' =...

CVE-2026-43499-pmg110-root

pmg110-root CVE-2026-43499futex PI rtmutexwaiter use-after-free 로컬 권한 상승, OPPO PMG110 / K15 Pro+ — MediaTek MT6991, ColorOS 16용으로 포팅됨. 파일 하나만 푸시하고 LDPRELOAD로 실행합니다: adb push out/preload-pmg110-16.0.9.400.so /data/local/tmp/preload.so adb shell chmod 644 /data/local/tmp/preload.so adb shell...

CVE-2026-28641: Undefined Security Weakness

In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

PT-2026-106254

Name of the Vulnerable Software and Affected Versions Docling versions 2.107.0 through 2.120.2 Description In the ODF backend, the software improperly handles the xlink:href attribute of a draw:image element. When a referenced part is not found within the document archive, the image ref from odf...

CVE-2026-105679: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

PT-2026-106192

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

EUVD-2026-92786

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2026-78860

The Mercusys AC12 V2 is affected by a vulnerability that allows a local attacker to achieve arbitrary code execution . The root cause is identified as the storage of information in plaintext , which is associated with CWE-311 (Missing Encryption of Sensitive Data) and CWE-347 (Improper Verificati...

CVE-2026-78860

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2026-20532: Double Free

In apu, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249024; Issue ID: MSV-9168...

PT-2026-106157

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An incorrect bounds check in multiple locations allows for a possible out of bounds write, which is a condition where data is written outside the intended memory...

CVE-2026-58815: Improper Restriction of Operations within the Bounds of a Memory Buffer

In multiple locations, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55269: Improper Input Validation

In FilterCapturedPacket of snooplogger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-104691

Name of the Vulnerable Software and Affected Versions apu affected versions not specified Description A memory corruption issue exists due to a use after free, which occurs when a program continues to use a pointer after it has been freed. This can lead to local escalation of privilege without...

CVE-2026-45524: Missing Authorization

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-104697

Name of the Vulnerable Software and Affected Versions Android AIDL affected versions not specified Description A memory corruption issue exists in aidl caused by a use-after-free condition, which occurs when a program continues to use a pointer after it has been freed. This flaw could allow a...

PT-2026-105990

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode...

CVE-2026-20533: Integer Overflow or Wraparound

In display, there is a possible escalation of privilege due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11296678; Issue ID: MSV-9167...