DEBIAN-CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

cve-2026-31431

CVE-2026-31431 — Copy Fail: Linux Kernel LPE Research Lab Educational purposes only. Do NOT use on systems without explicit authorization. Index Description of the vulnerability Affected components How it works Lab setup Docker PoC — Demonstration Mitigation References Vulnerability Description...

EUVD-2026-76061

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in walletlog.information. Administrators viewing pending...

CVE-2024-22120-RCE-with-gopher

Usage root@kitploit: python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime Example Scenario You have identified a Zabbix server running on IP 192.168.1.100, and you have access to a low-privileged user with the following details: Session ID sid: d82bf6715e1d3c1f25 Host ID hosti...

CVE-2026-82329-poc

CVE-2026-82329 Artifactory Security Assessment Tool PoC dan alat validasi untuk mengidentifikasi instalasi JFrog Artifactory self-hosted yang terdampak CVE-2026-82329. Alat ini memvalidasi rantai autentikasi berikut: 1. Membuat join JWT HS256 menggunakan signing key default yang kosong. 2. Mengir...

NextJS-RCE-Root-Takeover

🚨 Do you know how to get RCE with Next.js 16.0.6 then privilege escalation with python3? 🚨 Let me teach you from a real lab from TryHackMe "Love at First Breach 2026" competition Advanced Track... 📄 Full Report Here: 🔥 Inside: CVE-2025-55182 → Shell PoC → Privilege Escalation → Root + Remediation...

CVE-2026-77159 Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

EUVD-2026-76034

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

CVE-2026-47839

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

Fsociety-CVE-2024-0670-CheckMK-LPE

🚀 Fsociety-CVE-2024-0670-CheckMK-LPE - Powerful System Access Made Simple 📦 Overview Hello friend. This tool unlocks advanced access for CheckMK CVE-2024-0670. It takes advantage of weak file handling to gain SYSTEM support. The software includes a specialized persistence feature. It is developed...

CVE-2026-47839

Cloud Foundry UAA and cf-deployment are vulnerable to a privilege-escalation flaw in federated OIDC authentication. When an OIDC identity provider is configured with groupMappingMode: AS_SCOPES and a wildcard externalGroupsWhitelist entry, users can obtain the uaa.admin scope despite operators in...

CVE-2026-47839 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

EUVD-2026-76026

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

CVE-2020-24030

CVE-2020-24030 Description ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and to access sensitive data via token reuse. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Incorrect...

LeakedWallpaper

Leaked Wallpaper This is a privilege escalation tool fixed with CVE-2024-38100 in KB5040434 that allows us to leak a user's NetNTLM hash from any session on the computer, even if we are working from a low-privileged user. Usage root@kitploit: .\LeakedWallpaper.exe \\c$\1.jpg -downgrade Example...

Disable-TamperProtection

Disabling Tamper Protection and other Defender / MDE components It is possible to abuse SYSTEM / TrustedInstaller privileges to tamper or delete WdFilter settings ALTITUDE regkey and unload the kernel minidriver to disable Tamper protection and other Defender components. This also affects...

germy

Overview germy is an NGSM Linux kernel privilege escalation exploit for versions 5.15-rc1 to 6.6-rc1. See TECHNICALDETAILS.md for information on the vulnerabilities and exploit techniques used. Tested on: Ubuntu LTS 20.04.6 5.15.x and 22.04.4 6.5.x Ubuntu non-LTS 23.10 6.5.x Debian 12.5 6.1.x Usa...

WHS4_CVE-2021-4034

CVE-2021-4034 PwnKit - Local Privilege Escalation PoC 🔗 Original Project : berdav/CVE-2021-4034 This project is an educational analysis and modification based on the original. MIT License Compliant | White Hat School Training Task 📋 Overview CVE-2021-4034 is a local privilege escalation...