CVE-2022-3699

CVE-2022-3699 Incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory read/write. Thank you to ch3rn0byl for helping with this and I totally 100% ripped two of his functions. Explanatio...

CVE-2026-102734

The asteval Python expression evaluator (prior to version 1.0.9 ) contains a sandbox escape vulnerability in asteval/astutils.py . When numpy is enabled, the default Interpreter exposes a ctypes type and allows memory access via from_address. While safe_getattr blocks the ctypes module, it fails ...

CVE-2024-2887-REPORT

SSD Advisory – Google Chrome RCE Source: ssd-disclosure.com/ssd-advisory-google-chrome-rce Summary A critical remote code execution vulnerability in Google Chrome versions 123 and earlier affecting WebAssembly WASM garbage-collection type handling. The bug allows type confusion that can be...

CVE-2022-3699

CVE-2022-3699 Proof of Concept exploit for CVE-2022-3699 Exploit tested on Windows 10 22H2 build 19045.4651 and build 19045.3803 Vulnerability deals with allowing unprivileged users to access functionality that lets you read and write from physical memory from the instance of the kernel, however...

CVE-2026-96265

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory,...

CVE-2017-16995

Vulnerability Description Ubuntu is an open-source GNU/Linux operating system primarily used on desktops, based on Debian GNU/Linux. Recently, a white hat hacker disclosed a local privilege escalation vulnerability in the latest version of Ubuntu Ubuntu 16.04, with vulnerability ID CVE-2017-16995...

CVE-2026-56129

Description Arbitrary physical memory read/write using Toshiba qiomem.sys from ring 3 only works upto 4GB physical addresses. Driver is distributed via Microsoft Update Catalog. Other variants. Not listed on Microsoft Vulnerable Driver List, no previous CVE alloted. first run acpi.exe to create t...

CVE-2024-5633

PoC for CVE-2024-5633 Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the same local network to an undocumented binary service CoolView on one of the ports. An attacker with a knowledge of the available commands...

cve-2018-4233

CVE-2018-4233 Exploit for CVE-2018-4233, a bug in the JIT compiler of WebKit. Tested on Safari 11.0.3 on macOS 10.13.3. For more details see https://saelo.github.io/presentations/blackhatus18attackingclientsidejitcompilers.pdf The exploit gains arbitrary memory read/write by constructing the addr...

Exploit for Incorrect Authorization in Qualcomm Aqt1000_Firmware

Research on Vivo iQOO Neo 9 Rooting CVE-2025-21479 This pro...

CVE-2026-19185 Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode

The system-call verifier for i3cdoccc in drivers/i3c/i3chandlers.c validated the outer struct i3ccccpayload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3cccctargetpayload carries its ow...

CVE-2026-19185

In Zephyr RTOS builds with CONFIG_USERSPACE, a vulnerability exists in the i3c_do_ccc() system call handler within drivers/i3c/i3c_handlers.c. The system-call verifier fails to validate per-target data buffers, allowing an unprivileged user-mode thread with I3C controller access to provide arbitr...

CVE-2026-19185 Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode

The system-call verifier for i3cdoccc in drivers/i3c/i3chandlers.c validated the outer struct i3ccccpayload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3cccctargetpayload carries its ow...

Exploit for Incorrect Authorization in Qualcomm Aqt1000_Firmware

iQOO Neo7 Racing Edition PD2232 – BL-Free Privilege Escalati...

EUVD-2026-91136

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...

CVE-2026-103764 Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...

CVE-2026-93495

Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the ' Security Update for Multiple ASUS Motherboards ' section on the ASUS Security Advisory for more information...

CVE-2026-93495

Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the ' Security Update for Multiple ASUS Motherboards ' section on the ASUS Security Advisory for more information...

CVE-2026-102757

A vulnerability in ThreadX allows an unprivileged, memory-protected module to gain privileged memory read and write access. The root cause is a flaw in the Module Manager , which incorrectly validates object addresses by only checking if they fall outside the module. An attacker can bypass this b...

Astra Linux – Vulnerability in ntfs-3g

The file handle created in fuselibopendir, and later used in fuselibreaddir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite...