physmem

physmem physmem — это инструмент для инспектирования физической памяти и локального повышения привилегий, нацеленный на macOS вплоть до версии 10.12.1. Он эксплуатирует либо CVE-2016-1825, либо CVE-2016-7617 в зависимости от целевой платформы. Эти две уязвимости практически идентичны, и...

RingBufferDetonator

Détonateur de Tampon Annulaire Ceci est un programme de preuve de concept pour déclencher et prouver un bug logique dans rbpercpuempty. Les programmes qui rencontrent le bug seront bloqués dans une boucle infinie dans l'espace noyau dans tracingreadpipe et impossibles à suspendre ou terminer avec...

enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

Summary A crafted SVG bypasses enshrined/svg-sanitize's href validation and delivers a javascript: URL through the sanitizer unchanged. The bypass exploits a semantic mismatch between XML entity resolution used during sanitization and HTML5 Named Character Reference resolution used by the browser...

LSPromise

LSPromise Полная цепочка эксплуатации, которая позволяет повысить привилегии от локального ненадёжного приложения до root/ядра. Она не включает повреждения памяти или гонки данных, поэтому атакующим не нужно выполнять сложный heap spraying или обходить механизмы защиты от уязвимостей повреждения...

TLPE

Это PoC и разбор CVE-2026-49881 — логической ошибки в классе InCallController в Telecom-сервисе Android 17, которая позволяет непривилегированному приложению получить выполнение произвольного кода с UID 1000 systemserver без дополнительного взаимодействия с пользователем. Мы также показываем, что...

ubuntu-cve-2026-31431-mitigation

우분투에서 보안 취약점CVE 해결을 위한 커널 및 kmod 업데이트 완벽 가이드 CVE-2026-31431 Copy Fail이라고도 알려진 이 취약점은 AFALG / algifaead 경로에서 발생하는 리눅스 커널의 논리적 결함입니다. 공개자에 따르면, 권한이 없는 로컬 사용자가 리눅스 커널이 읽기 가능한 파일의 page cache에 제어된 4바이트 쓰기를 수행하도록 만들 수 있습니다. 그 결과 파일의 in-memory 버전이 손상되는 반면, 디스크의 파일은 온전하게 유지됩니다. 이 가이드는 시스템 관리자와 이란 기술 커뮤니티...

CVE-2026-31431

Copy Fail CVE-2026-31431 — Подробный разбор 1. Обзор уязвимости Название уязвимости: Copy Fail Идентификатор CVE: CVE-2026-31431 Обнаружено / Авторы: Xint Code Research Team на основе первоначальных фундаментальных исследований исследователя Theori Таэянга Ли. «Copy Fail» — это критическая...

CVE-2024-20674

CVE-2024-20674 Это моя реализация эксплойта публичного CVE CVE-2024-20674 для обхода взаимной аутентификации Kerberos с использованием логической ошибки в обработке клиентской стороной Kerberos U2U TGT-REP. Это может быть использовано, например, для передачи произвольных GPO при подмене DC для...

wordpress-batch-rce-lab

wp2shell: Пакетное RCE для WordPress Технический разбор CVE-2026-63030 — логической ошибки в конечной точке пакетной обработки REST API ядра WordPress, которая позволяет анонимному запросу выполняться под маршрутом и проверкой разрешений другого запроса, что приводит к CVE-2026-60137 SQL-инъекция...

check-cve-2026-23111

CVE-2026-23111 방어적 검증 스크립트 개요 CVE-2026-23111은 nftables에서 발생하는 리눅스 커널 취약점으로, 사용자 네임스페이스user namespaces와 nftables가 활성화된 시스템에서 권한이 없는 사용자가 로컬 권한 상승에 악용할 수 있습니다.12 공공 벤더 및 정부 권고에서는 이를 리눅스 배포판에 영향을 미치는 로컬 문제로 설명하며, 패치 적용을 주요 해결 방안으로 강조합니다.34 이 리포지토리는 방어적 검증 스크립트 를 포함하고 있으며, 이는 권한 상승 익스플로잇을 제공하지 않고 호스트...

CVE-2026-0073-Android-client-TLS-auth-bypass

CVE‑2026‑0073 est un bug logique dans le démon ADB d'Android adbd qui permet à un attaquant de contourner l'authentification mutuelle TLS et d'ouvrir un shell distant sur un appareil dont le débogage sans fil est activé et qui a été appairé avec un ordinateur au moins une fois. La cause racine es...

Linux-Kernel-Dirty-Pipe-Exploitation-Logic-Bug-

Exploitation du Dirty Pipe du noyau Linux Bogue logique par : Antonius w1sdom https://www.bluedragonsec.com https://github.com/bluedragonsecurity Dirty Pipe CVE-2022-0847 est l'une des vulnérabilités de sécurité les plus importantes dans le noyau Linux 5.8 – 5.15.24, découverte par Max Kellermann...

CVE-2026-93199

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Do not treat master device as a duplicate target i3cmastersearchi3cdevduplicate searches the bus for another I3C device with the same PID as the reference device. The search can match master-this, causing the...

AZL-102824 CVE-2026-90279 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5bitmapsectormap aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunksectors multiplied by the number of data...

AZL-100121 CVE-2026-89773 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not have a valid dmstreamctx that should skip configuring HDCP routine. The routine is valid to go through only when a valid stream is created...

DEBIAN-CVE-2026-89748

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...

CVE-2026-89773 drm/amd/display: Skip Update HDCP Config In Transition State

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not have a valid dmstreamctx that should skip configuring HDCP routine. The routine is valid to go through only when a valid stream is created...

CVE-2026-89748 tracing: Fix retry exhaustion in simple ring buffer reader swap

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...

CVE-2026-89748

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...

GHSA-72R2-7MFR-5XR9 NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol

Summary There's a logic bug in FileSystemPathPointer.open inside nltk/data.py that makes the sandbox check permanently inert. The guard condition is always False — meaning any file the process can read is accessible by passing a file:// URL to nltk.data.load. --- Details In nltk/data.py,...