CVE-2024-2887

CVE-2024-2887 This is a short writeup for the CVE-2024-2887, which I used to claim V8CTF M123. When define more types than kV8MaxWasmTypes, which can be achieved by padding more types in RecGroup, the types index can be more than 20bits and then overflowed. Then two types can be considered same a...

cve-2014-0038

Local root exploit for CVE-2014-0038 Bug: The X86X32 recvmmsg syscall does not properly sanitize the timeout pointer passed from userspace. Exploit primitive: Pass a pointer to a kernel address as timeout for recvmmsg, if the original byte at that address is known it can be overwritten with known...

CVE-2026-98107

A flaw was found in the Linux kernel's Bluetooth subsystem. A local user can trigger an out-of-bounds memory write by establishing multiple concurrent Logical Link Control and Adaptation Protocol L2CAP connections. Due to improper channel limit verification, this flaw allows memory corruption tha...

CVE-2017-16995

The latest version of Ubuntu Ubuntu 16.04 has a high-risk local privilege escalation vulnerability, numbered CVE-2017-16995. This vulnerability exists in the Linux kernel system that calls eBPF bpf2. When a user provides a malicious BPF program, the eBPF verifier module generates a calculation...

CVE-2012-6422

Exynos Exploit This is a POC for exploiting the /dev/exynos-mem vulnerability introduced in earlier samsung phones. It was done out of interest in kernel vulnerability research and as a part of a CTF challenge. The Exploit The vulnerability introduced in these phones is the permissions for the...

CVE-2026-80431

A flaw was found in kitty. This vulnerability allows a program outputting to the terminal to cause a Denial of Service DoS by sending a specially crafted Operating System Command OSC escape sequence. Due to missing boundary checks when handling text sizing commands with overly long character...

CVE-2026-97580

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity computetilesuniform and computetilesnonuniform loop over numtilecolumnsminus1 + 1 / numtilerowsminus1 + 1 entries, and assemblehwpps writes one COLUMNWIDTH /...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libwebp (UTSA-2023-002880)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002880 advisory. Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-000283)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000283 advisory. A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory location beyond the header value sent. This cou...

SUSE SLED15 / SLES15 Security Update : jq (SUSE-SU-2026:4275-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4275-1 advisory. Security issues fixed: - CVE-2015-8863: heap buffer overflow in tokenadd function bsc976992. - CVE-2023-50246:...

CVE-2026-17052 Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace

The Time-aware GPIO syscall verification handler zvrfytgpiopinreadtsec in drivers/timeawaregpio/timeawaregpiohandlers.c validated only the port device object and passed the caller-supplied timestamp and eventcount output pointers to the driver without a KSYSCALLMEMORYWRITE check. The other handle...

CVE-2026-17052 Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace

The Time-aware GPIO syscall verification handler zvrfytgpiopinreadtsec in drivers/timeawaregpio/timeawaregpiohandlers.c validated only the port device object and passed the caller-supplied timestamp and eventcount output pointers to the driver without a KSYSCALLMEMORYWRITE check. The other handle...

CVE-2026-17052

CVE-2026-17052 affects Zephyr RTOS builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y enabled (practically, v3.6.0 through v4.4.0). The syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated the port device object but omitt...

chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia in Google Chrome

Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Chromium security severity: High...

Cisco UCS Manager UEFI Shell Secure Boot Bypass (cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW)

According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials fo...

CVE-2026-48977

OpenSlide is a C library for reading whole slide image files. Versions 3.4.1 through 4.0.1 are affected by an arbitrary memory write vulnerability in parse_level0_xml() within src/openslide-vendor-ventana.c. A crafted Ventana BIF file can supply nonpositive row or column tile counts, producing at...

CVE-2026-48977 OpenSlide: Arbitrary memory write with crafted Ventana BIF file

OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parselevel0xml processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memo...