CVE-2025-14174-Poc

CVE-2025-14174 PoC Exploit Overview This repository contains a fully functional Proof-of-Concept PoC exploit for CVE-2025-14174 also tracked as EUVD-2025-203113, a critical memory corruption vulnerability in the ANGLE graphics engine. The flaw stems from improper restriction of operations within...

CVE-2024-1939

CVE-2024-1939 This is a short writeup for the CVE-2024-1939, which I used to claim V8CTF M122. The root cause of this issue is the lack of support for kWasmS128 in wasm-to-js conversion. Specifically, wasmS128Const operations occurring in parameter stacks are ignored, leading to type confusion wh...

CVE-2022-26711

CVE-2022-26711: Apple ImageIO WebP Integer Overflow An integer overflow vulnerability in Apple's ImageIO framework when parsing WebP images, leading to an out-of-bounds memory access. Full Writeup - Detailed root cause analysis with disassembly walkthrough. Overview An integer overflow occurs...

CVE-2022-1015-1016

CVE-2022-1015 & CVE-2022-1026 This README.md is a translation of David's blog. David found CVEs 1015 and 1016 in the Linux kernel. You can visit his website to read the original document. Here are his social media links: Twitter Github An analysis of the two new Linux vulnerabilities in nftables...

CVE-2016-8863

Targets pupnp release-1.6.18 ... ... running on i386 Ubuntu 16.04. Fix commit 9c099c2923ab "Fix out-of-bound access in createurllist CVE-2016-8863"...

cve-2024-0519-rca-research

CVE-2024-0519 — RCA Research Root cause analysis artifacts for CVE-2024-0519 V8 out-of-bounds memory access, Chrome 120, exploited in the wild. Fix : e0f2a195d87c9a06685121e0e783efd92d030df3 — Toon Verwaest, 2024-01-12 V8 version studied : 12.0.267.16 fbc4963bbff, ARM64 macOS Files...

CVE-2026-80844

🔥 CVE-2026-80844 - DirtyAH6 Linux Kernel IPv6 AH6 Local Privilege Escalation CVE-2026-80844 is a Linux kernel vulnerability affecting the IPv6 Authentication Header AH6 / XFRM subsystem. The vulnerability is caused by insufficient validation of the IPv6 Routing Header segmentsleft field,...

CVE-2025-40019-POC

proof of concept for CVE-2025-40019 CVE-2025-40019 is the Encrypted Salt-Sector Initialization Vector mechanism crypto/essiv.c which has insufficient validation of Associated Authentication Data AAD length relative to the Initialization Vector IV size, leading to out-of-bounds memory access. The...

CVE-2021-1732

CVE-2021-1732 The vulnerability occurs in the Windows graphics driver win32kfull!NtUserCreateWindowEx function due to a desynchronization between kernel callback user-mode memory allocation and the setting of the tagWND-flag attribute. This allows an attacker to forge the tagWND-offset value,...

CVE-2022-1015

CVE-2022-1015 target: linux kernel 5.17.0 config: .config requirements: root@kitploit: apt install libmnl-dev libnftnl-dev build: root@kitploit: gcc exploit.c -o exploit -lmnl -lnftnl -lpthread -no-pie References...

CVE-2025-51495

I would like to report a security vulnerability identified in the latest release of Mongoose v7.17. The issue resides in the WebSocket module, specifically within the mgwscb function responsible for handling incoming WebSocket frames. The function is vulnerable to an integer overflow, which may...

d-os-descriptor

d-os-descriptor Summary The USB Gadget Subsystem includes security issues in the OS descriptor handling section of compositesetup function composite.c. Processing of properly crafted control transfer request messages result in device crash due to null pointer dereference or memory corruption...

CVE-2024-29943-but-with-wasm

CVE-2024-29943, but with wasm An end-to-end exploit chain for CVE-2024-29943 that achieves arbitrary native code execution by smuggling shellcode into SpiderMonkey's WebAssembly JIT code page as f64.const immediates — no ROP, no VirtualProtect, no external toolchain. Verified working against the...

CVE-2026-21001-WebAssembly-Linear-Memory-OOB-via-Table-Index-Confusion

CVE-2026-21001 – WebAssembly Linear Memory OOB via Table Index Confusion Overview A WebAssembly module uses an imported function with no bounds check on an array index. An attacker can supply an out-of-bounds index to read or write outside the linear memory, potentially leaking host secrets or...

CVE-2021-32537

CVE-2021-32537: Out-of-bounds access in RTKVHD64 leading to pool corruption. This is a bug that I reported to Realtek beginning of April 2021. The affected driver is named RTKVHD64.sys and seems to be available on a bunch of mainstream hardware tested the below hardware configurations but probabl...

CVE-2019-9810

CVE-2019-9810 Exploit for Firefox on Windows CVE-2019-9810 is a vulnerability that has been found and exploited at Pwn2Own 2019 by Richard Zhu and Amat Cama. It affects Mozilla's JavaScript engine, Spidermonkey and was used to achieve renderer compromise. The issue has been fixed in mfsa2019-09...

Linux Distros Unpatched Vulnerability : CVE-2026-93127

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX,...

AZL-102294 CVE-2026-93177 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL wh...

CVE-2026-93127

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

DEBIAN-CVE-2026-93127

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...