EUVD-2026-98813

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects,...

CVE-2026-102734

The asteval Python expression evaluator (prior to version 1.0.9 ) contains a sandbox escape vulnerability in asteval/astutils.py . When numpy is enabled, the default Interpreter exposes a ctypes type and allows memory access via from_address. While safe_getattr blocks the ctypes module, it fails ...

CVE-2026-102734 asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects,...

CVE-2026-96299 Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service

A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization...

CVE-2026-96297 MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory ca...

CVE-2026-96297

The MongoDB Server is vulnerable to a Use After Free (CWE-416) condition within its aggregation feature . When an internal aggregation stage is used in conjunction with a batch size of 0 , the server may read from memory areas that have already been released. This flaw allows an authenticated use...

Soviet

Soviet A Runtime Crypter in C for Linux. This will encrypt ELF binaries, but allow them to still run in memory while using no file handles. Then it will overwrite the program in memory with random data. The point being to make binary analyis and memory analysis more difficult. Dependencies On...

keepass_dump

Keepass-Dumper This is my PoC implementation for CVE-2023-32784 My version is a python port of @vdohney's PoC along with a few changes and additional features. Changes One change, was to use known strings that can be found within the dump file in order to more accurately jump to the location of t...

Intel-CVE-2015-2291

Intel-CVE-2015-2291 PoC exploit for CVE-2015-2291 Data-only attack to pop a system shell with the vulnerable intel driver. The code itselfs implements more "functionality" provided from the driver, like physical to virtual address translation, mapping physical memory This two combined = arbitrary...

cve-2026-24688

CVE-2026-24688 - pypdf - Circular Reference DoS Vulnerability This repo includes proof of concept code for triggering CVE-2026-24688. Summary Critical Denial of Service vulnerability in pypdf's outline bookmark parsing logic. When processing a PDF with circular outline references, the parser ente...

CVE-2026-81507

The ESF-IDF (Espressif IoT Development Framework) contains an out-of-bounds read vulnerability in the BlueDroid L2CAP configuration-option processing within l2c_main.c and l2c_utils.c. Due to inconsistent validation of option lengths against received packet bytes, a remote unauthenticated BR/EDR ...

BootStomp

BootStomp BootStomp is a boot-loader bug finder. It looks for two different class of bugs: memory corruption and state storage vulnerabilities. For more info please refer to the BootStomp paper at https://seclab.cs.ucsb.edu/academic/publishing/bootstomp-security-bootloaders-mobile-devices-2017 To...

CVE-2026-90247

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. This vulnerability allows for a memory map mmap lock to be leaked when handling interrupt work, specifically within the stackmapgetbuildidoffset and bpffindvma functions. This can lead to a situation where two read locks...

CVE-2026-90240

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit / VT-d Virtualization Technology for Directed I/O component. When tearing down Direct Memory Access DMA aliases of a device, the system fails to flush the context cache with the correct Source ID SID. This oversight...

libmsm_vfe_read_exploit

Read kernel mermory with CVE-2014-4321...

CVE-2026-90225

A flaw was found in the Near Field Communication NFC Logical Link Control Protocol LLCP subsystem of the Linux kernel. A race condition exists between the nfcllcpgetsockopt and llcpsockbind functions. This allows a local attacker to potentially cause a use-after-free vulnerability by racing a...

memdumper

memdumper memdumper reads the memory of a running macOS process under another signed binary's debugger entitlement. The aim is that taskforpid and ptrace run as that entitled binary, so an EDR records it rather than memdumper. by cenobyte [email protected] 2026...

CVE-2026-90322

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System 2 cluster heartbeat mechanism. When a local node within the cluster is reset, an internal flag is not properly cleared, leading to an inconsistent state. This inconsistency can cause the system's heartbeat monitoring process ...

CVE-2026-90309

A flaw was found in the Linux kernel's RDMA/erdma component. This vulnerability stems from improper management of Completion Queue CQ references during Event Queue EQ event processing. This can lead to a situation where a CQ is deallocated while still in use by an EQ handler, resulting in memory...

CVE-2026-90307

A flaw was found in the Linux kernel. A remote attacker could exploit a vulnerability in the SCSI Remote Protocol SRP implementation by sending a specially crafted, truncated credential request. This malformed request causes an out-of-bounds read, leading to a heap information leak of up to 8 byt...