PT-2026-106065

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

CVE-2026-93319: Unsynchronized Access to Shared Data in a Multithreaded Context

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

CVE-2022-42864

CVE-2022-42864: Diabolical Cookies 이 저장소는 무엇인가요? 이것은 CVE-2022-42864에 대한 불완전한 개념 증명 익스플로잇입니다. 이 취약점은 iOS 16.2 / macOS Ventura 13.1에서 수정된 IOHIDFamily의 검사 시점-사용 시점time-of-check-time-of-use 취약점입니다. 개념 증명의 상태는 어떤가요? 현재 이 익스플로잇은 multicastbytecopy 익스플로잇에서 사용된 것과 동일한 "임의 kfree" 프리미티브를 달성합니다. 그러나...

CVE-2026-64705

CVE-2026-64705 — HFS xattr カーネルヒープオーバーフロー macOS CVE-2026-64705 の根本原因分析と概念実証コード。macOS Sonoma 14.8.7 HT127117 で修正された HFS カーネルエクステンションのバッファオーバーフローです: HFS — 影響: アプリが予期しないシステム終了やカーネルメモリへの書き込みを 引き起こす可能性があります。バッファオーバーフローは境界チェックの改善により 対処されました。 PoC は武器化された HFS+ ディスクイメージです。これをマウントし、細工された拡張属性を 読み取ることで、HFS...

xattr-oob-swap

xattr-oob-swap CVE-2020-27904: macOS 10.15.x 이하를 위한 tfp0 버그입니다. BlackHat ASIA 2021에서의 발표를 위한 데모 익스플로잇 코드입니다. 이 취약점은 macOS Big Sur 11.0 및 최신 10.15 및 10.14 보안 업데이트에서 수정되었습니다. 보증 사용에 따른 책임은 본인에게 있습니다. 이로 인해 macOS가 패닉 상태에 빠질 수 있습니다. 보안 연구자만을 위해 만들었습니다. 현재 상태 tfp0 획득. macOS 10.15.2 19C57 , 16GB RAM...

IOHIDFamily-PoC-Research

CVE-2026-28992 — IOHIDFamily FastPathUserClient PoC 보안 연구 저장소입니다. iOS 18.7.1 및 이전 버전에서 IOHIDFamily의 FastPathUserClient의 경쟁 조건을 보여주는 두 가지 PoC 앱입니다. ⚠️ 두 PoC 모두 커널 패닉을 일으키고 기기를 재부팅합니다. 먼저 작업을 저장하세요. 취약점 요약 필드| 세부 내용 ---|--- CVE| CVE-2026-28992 구성 요소| IOHIDFamily — IOHIDEventServiceFastPathUserClient...

CVE-2026-105113

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with...

CVE-2026-43682

概念実証 この概念実証は、影響を受ける Mac をカーネルパニックに陥らせ、再起動させることが想定されています。 使い捨てのテストシステムでのみ使用してください。証拠採取には、macOS Tahoe 26.3 25D125 を実行する Apple シリコンを使用しました。Apple は CVE-2026-43682 を Tahoe 26.6、Sequoia 15.7.8、および Sonoma 14.8.8 で修正しました。 この PoC はディスクイメージジェネレーターであり、権限昇格エクスプロイトではありません。これは以下を行います: 属性 B-tree を持つ小さな HFS+...

RUSTSEC-2026-0320 Wasmtime wasi:http implementation panics with a zero timeout supplied

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv For more information see the GitHub-hosted security advisory...

Wasmtime wasi:http implementation panics with a zero timeout supplied

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv For more information see the GitHub-hosted security advisory...

Guest can panic host through filesystem timestamp before the epoch on wasip3

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory...

RUSTSEC-2026-0324 Guest can panic host through filesystem timestamp before the epoch on wasip3

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory...

CVE-2026-104428 Zebra before 11.0.0 Denial of Service via getblock Verbosity 2

The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect, aborting the process. Remote unauthenticated attackers, directly or through...

CLEANSTART-2026-ZV78301 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process

Security vulnerability affects the consul package. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process...

CLEANSTART-2026-AG71066 SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read

Security vulnerability affects the consul package. SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read...

CLEANSTART-2026-CT85138 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

Security vulnerability affects the consul package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...

CLEANSTART-2026-DB84744 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

Security vulnerability affects the consul package. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

CLEANSTART-2026-SE64937 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

PT-2026-104239

Name of the Vulnerable Software and Affected Versions zebra-rpc versions prior to 11.0.0 Description The getblock RPC method in the Zebra node panics when verbosity is set to 2 for a side-chain block. This occurs because the block's -1 confirmations sentinel is converted to a u32 type using the...

SUSE SLES15 Security Update : wicked2nm (SUSE-SU-2026:4405-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4405-1 advisory. This update for wicked2nm fixes the following issue: - serdewith: KeyValueMap serialization panics on empty sequence or map entries...