CVE-2026-39259

SmallerC scanf s Stack.md SmallerC - scanf %s Stack Buffer Overflow Project: https://github.com/alexfru/SmallerC SmallerC's scanf implementation does not enforce an upper bound on string reads when %s or % is used without an explicit field width in the format string The runtime will continue...

uEmu

Overview uEmu is a tiny cute emulator plugin for IDA based on unicorn engine. Supports following architectures out of the box: x86 , x64 , ARM , ARM64 , MIPS , MIPS64 What is it GOOD for? Emulate bare metal code bootloaders, embedded firmware etc Emulate standalone functions What is it BAD for?...

BareMetal-RAM-Dumper

BareMetal RAM Dumper A simple x86 bare-metal tool designed to boot from a disk/USB and dump the system's RAM directly to the booting medium. It relies on BIOS interrupts to boot and perform disk operations, and enters unreal mode to access memory above the 1MB barrier. Background: Cold Boot Attac...

PongoOS

pongoOS A pre-boot execution environment for Apple boards built on top of checkra1n. Building on macOS Install Xcode + command-line utilities Run make all Building on Linux Install clang if in doubt, from apt.llvm.org Install ld64 and cctools' strip. On Debian/Ubuntu these can be installed from t...

tamago

TamaGo - bare metal Go tamago | https://github.com/usbarmory/tamago Copyright c The TamaGo Authors. All Rights Reserved. Introduction TamaGo is a framework that enables compilation and execution of unencumbered Go applications on bare metal processors. The projects spawns from the desire of...

CVE-2025-14174-analysis

CVE-2025-14174 Analysis: ANGLE Metal Staging Buffer Out-of-Bounds Write Technical analysis and proof-of-concept for CVE-2025-14174 | ---|--- CVE| CVE-2025-14174 Severity| High Exploited ITW| Yes - targeted attacks on iOS 26 Affected| iOS Safari, macOS Chrome/Chromium/Electron not macOS Safari...

CVE-2023-32407-a-macOS-TCC-bypass-in-Metal

CVE-2023-32407-a-macOS-TCC-bypass-in-Metal...

iBSSloader

iBSSloader Research and tooling to boot Linux on iPad mini 1 P105AP / iPad2,5, Apple A5 via checkm8, patched iBSS/iBEC, and custom bare-metal payloads — without writing to the iOS install. This repo combines: Device tree port — Apple ADT → Linux DTS/DTB for P105AP Kernel build — ARMv7 zImage +...

NeuroCore

NeuroCore High-Performance Structural Binary Analysis and Visualization Utility Abstract NeuroCore is a native macOS utility engineered for the structural analysis of binary data through high-velocity visualization. By leveraging General-Purpose Computing on Graphics Processing Units GPGPU via...

CVE-2026-9999-exploit

CVE-2026-9999 — Chrome ANGLE/Metal WebGL PoC Hunting Harness macOS 1. Vulnerability summary Field| Value ---|--- CVE| CVE-2026-9999 Vendor / product| Google Chrome Affected| Chrome 148.0.7778.216, macOS only 1 Fixed in| 148.0.7778.216 1 Impact| Arbitrary code execution inside a sandbox via a...

CVE-2026-113743

A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function loadhfstatedictfiltered of the file models/tttransformers/tt/loadcheckpoints.py. This manipulation of the argument weightmap causes path traversal. The attack may be initiated remotely. The...

CVE-2026-113743

A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function loadhfstatedictfiltered of the file models/tttransformers/tt/loadcheckpoints.py. This manipulation of the argument weightmap causes path traversal. The attack may be initiated remotely. The...

CVE-2026-113743 Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal

A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function loadhfstatedictfiltered of the file models/tttransformers/tt/loadcheckpoints.py. This manipulation of the argument weightmap causes path traversal. The attack may be initiated remotely. The...

CVE-2026-113743

Tenstorrent tt-metal versions up to 0.80.0 are vulnerable to a path traversal issue within the load_hf_state_dict_filtered function of models/tt_transformers/tt/load_checkpoints.py. The vulnerability is caused by the improper manipulation of the weight_map argument, which could allow an attacker ...

EUVD-2026-107030

A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function loadhfstatedictfiltered of the file models/tttransformers/tt/loadcheckpoints.py. This manipulation of the argument weightmap causes path traversal. The attack may be initiated remotely. The...

CVE-2026-113743 Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal

A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function loadhfstatedictfiltered of the file models/tttransformers/tt/loadcheckpoints.py. This manipulation of the argument weightmap causes path traversal. The attack may be initiated remotely. The...

PT-2026-120345

A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load hf state dict filtered of the file models/tt transformers/tt/load checkpoints.py. This manipulation of the argument weight map causes path traversal. The attack may be initiated remotely...

CVE-2026-100839

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack "BadAML". ACPI tables containing AML bytecode are passed from the untrusted host QEMU to the guest firmware OVMF and on to the Linu...

CVE-2025-71424

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

CVE-2026-100839

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack "BadAML". ACPI tables containing AML bytecode are passed from the untrusted host QEMU to the guest firmware OVMF and on to the Linu...