EUVD-2026-77953

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB share may disclose kernel memory...

CVE-2026-65365

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB share may disclose kernel memory...

PwnKit

PwnKit 此仓库包含一个我开发的漏洞利用程序，用于理解 Polkit Pkexec 漏洞：CVE-2021-4034 Pkexec 本地权限提升。Polkit（原名 PolicyKit）是一个组件，其功能是控制类 Unix 操作系统上的权限。它以有序的方式提供了一种机制，让无特权进程能够与有特权进程通信。该漏洞允许任何用户——系统上的普通用户，无管理权限——达到系统最高权限。 该漏洞发生在 pkexec 的 main 函数处理命令行参数时，当参数为 0 时。该函数尝试访问参数列表，最终试图访问 argvvoid（一个命令行参数控制器），也就是说，当 pkexec...

dnsobserver

DNSObserver Goで書かれた便利なDNSサービスで、いくつかの種類のブラインド脆弱性の検出を支援します。ペンテスターのサーバーを監視してアウトオブバンドDNSインタラクションを検出し、受信したリクエストの詳細をSlack経由で通知します。DNSObserverは、ブラインドOSコマンドインジェクション、ブラインドSQLi、ブラインドXXEなどのバグを見つけるのに役立ちます！ 詳細な概要とセットアップ手順については、以下を参照してください： https://www.allysonomalley.com/2020/05/22/dnsobserver/ Setup 必要なもの：...

kernel-exploits

内核漏洞利用 各种内核漏洞利用 CVE-2021-22555 Linux 本地 root 提权漏洞利用。 theflow 针对 CVE-2021-22555 的 漏洞利用 的更新版本。 在 net/netfilter/xtables.c 中发现了一个堆越界写入漏洞，影响自 v2.6.19-rc1 起的 Linux 内核。该漏洞允许攻击者通过用户命名空间获取权限，或造成 DoS（通过堆内存破坏）。 CVE-2019-13272 Linux 本地 root 提权漏洞利用。 Jann Horn 针对 CVE-2019-13272 的 漏洞利用 的更新版本。 在 5.1.17 之前的 Linux...

CVE-2026-90815

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup3x3 of the file libavfilter/vfconvolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploi...

CVE-2026-54333

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable in uefifirmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream rema...

CVE-2026-16147

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

CVE-2026-53716

Envoy Gateway (open-source application gateway managing Envoy Proxy) has an unbounded gzip decompression vulnerability in getFileFromGZ within internal/wasm/httpfetcher.go. The function calls io.ReadAll on a gzip.Reader without limiting the decompressed output size. When a tenant-controlled Envoy...

CVE-2026-53717

Envoy Gateway (open-source Envoy Proxy management) is vulnerable in internal/wasm/imagefetcher.go prior to 1.7.4 and 1.8.1 . The function extractWasmPluginBinary allocates memory using the untrusted tar-header h.Size value (via make([]byte, h.Size)) before validating the entry name or declared si...

CVE-2026-54334

CVE-2026-54334 is a heap out-of-bounds write in the uefi-firmware Python package's native Tiano/EFI decompressor. The flaw is in ReadCLen() within uefi_firmware/compression/Tiano/Decompress.c: it reads a 9-bit value (up to 511) and writes into the 510-element Sd->mCLen heap array without bound...

CVE-2026-54333 UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable in uefifirmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream rema...

libput_user_exploit

注意！！！ 该漏洞利用会多写入3个字节的零。 root@kitploit: 但这足以安装 ptmx.fsync 处理程序并修改 ueventhelper 字符串。...

CVE-2026-55209 resdata insufficiently validates untrusted GRDECL files

resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes while parsing untrusted GRDECL files in lib/resdata/rdkwgrdecl.cpp and...

CVE-2026-55209

resdata is a library for reading and writing result files from the Eclipse reservoir simulator. Prior to version 6.2.9 , it insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes while parsing untrusted GRDECL files in lib/resdata/rd_kw_grdecl.cpp and lib/resda...

CVE-2026-55093 tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs readtensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length...

CVE-2026-55093

Tract (a self-contained TensorFlow/ONNX inference toolkit by Sonos) is affected by an integer overflow in tract-nnef's read_tensor function that leads to an out-of-bounds heap read when loading a crafted NNEF model archive. The unchecked usize multiplication over attacker-controlled tensor dimens...

CVE-2026-90815 FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup3x3 of the file libavfilter/vfconvolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploi...

EUVD-2026-77791

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup3x3 of the file libavfilter/vfconvolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploi...

CVE-2026-90815

FFmpeg is vulnerable to an out-of-bounds read in the Convolution Filter component, specifically in the function setup_3x3 of libavfilter/vf_convolution.c. The vulnerability is remotely exploitable and can be triggered without authentication, though user interaction is required (CVSS 3.1 score 6.3...