CVE-2026-80572

A flaw was found in the Linux kernel's byd input driver. A race condition exists during device disconnection where the byddisconnect function frees private data before ensuring that a timer callback, bydcleartouch, has completed. This can lead to the callback attempting to access memory after it...

HTB-Snapped-Writeup

HTB-Snapped-Writeup Writeup da máquina HTB Snapped — Linux de dificuldade Hard. CVE-2026-27944 divulgação não autenticada de backup no Nginx UI encadeada com CVE-2026-3888 condição de corrida no snapd para escalonamento local de privilégios para comprometimento total do sistema. HTB: Snapped —...

CVE-2026-23918-test

CVE-2026-23918-test Dieses Repository enthält einen Proof of Concept PoC, der die Double-Free-Schwachstelle CVE-2026-23918 im Apache HTTP Server 2.4.66 modhttp2 demonstriert. Die Schwachstelle beruht auf einer Race Condition während der frühen Verarbeitung von RSTSTREAM-Frames. Ich habe mich auf...

CVE-2026-80559

A flaw was found in the Linux kernel's sur40 input device driver. Due to improper ordering of device registration, a local user could trigger a race condition by opening the input device immediately after its registration. This could lead to the system accessing uninitialized data, resulting in a...

CVE-2025-38561

CVE-2025-38561 ksmbd: Condizione di gara su PreauhHashValue Se il client invia più richieste di sessione a ksmbd, potrebbe verificarsi una condizione di gara su PreauhHashValue...

desc_race-1

descrace „descrace“ CVE-2021-30955 Exploit für iOS 15.0 – 15.1.1 mit stabilen Kernel-Lese-/Schreib-Primitiven Exploit-Methode 1. Erhöhe die Kapazität des IOSurfaceClient-Arrays auf 0x2000, Ziel ist es, einen Zeiger zu schreiben, dessen Inhalt vollständig kontrolliert wird, und dann...

CVE-2026-2395

CVE-2026-23950 Prova di concetto per CVE-2026-23950 - Vulnerabilità di race condition nel pacchetto tar. Descrizione Questa repository dimostra una vulnerabilità di race condition nel pacchetto npm tar versione 7.5.3 che consente una collisione di file durante l'estrazione. La vulnerabilità sfrut...

CVE-2026-3888

CVE-2026-3888 - snap-confine + systemd-tmpfiles Escalação de Privilégios Local Aviso: Este repositório é apenas para fins educacionais. Todo o conteúdo é baseado no aviso de segurança original publicado pela Qualys em 17 de março de 2026. A vulnerabilidade já foi corrigida — garanta sempre que se...

RegPwnBRc4BOF

RegPwn BOF per Brute Ratel C4 La mia reimplementazione BOF per Brute Ratel C4 del porting dell'exploit RegPwn di Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. Questa è una reimplementazione BOF BRc4 più approssimativa della reimplementazione CS BOF di Flangvik dell'exploit C originale. Tutto il...

desc_race_A15

descraceA15 CVE-2021-30955 POC para iOS 15.1.1 em dispositivos com 6GB de RAM A14-A15 Feito com SwiftUI e C Baseado no exploit de @b1n4r1b01 Artigo técnico do POC de @realBrightiup Melhora o suporte para A14-A15 Testado no iPhone 13 Pro Max Resultados Obtém privilégios de escrita Entra em pânico...

printix-CVE-2022-25090

CVE-2022-25090 Invece di stampare i tuoi compiti come utente, stampa le policy di sicurezza del tuo sistema come SYSTEM per divertimento. Esplora la documentazione » Guarda la Demo . Segnala un Bug . Richiedi una Funzionalità Indice dei Contenuti Informazioni sul Progetto Realizzato Con Per...

CVE-2026-74754

A flaw was found in the Linux kernel SCSI core. A race condition exists where the shost-ehnoresume flag is checked multiple times during error handling. This can lead to an incorrect handling of power management PM references, specifically an unmatched reference put. The consequence is a runtime ...

CVE-2026-74748

A flaw was found in the Linux kernel's netfilter ipset component. A race condition exists between the list:set garbage collection and set swap operations. This concurrency issue can lead to a kernel bug and a system crash, effectively causing a denial of service. This vulnerability can be trigger...

CVE-2023-5178

CVE-2023-5178 L'exploit per CVE-2023-5178: vulnerabilità NVMe-oF-TCP, che è un errore logico nel driver NVMe-oF-TCP durante la gestione di una Initialize Connection Request corrotta. Porta a un doppio free race condition in kmalloc-96 , che può essere sfruttato per ottenere LPE vedi demo sotto...

dirtycow-replacer

BITTE BEACHTEN SIE, DASS ICH DIESEN CODE NICHT FORMELL TESTE ER WIRD ALS LEHRWERKZEUG ENTWICKELT Was macht es? android-dirtycow-replacer nutzt den CVE-2016-5195 DirtyCOW-Exploit, um eine Liste von über 1000 Dateien zu patchen. Sie können es auf 10000 erweitern, aber 1000 sollte reichen. Es prüft...

EUVD-2026-66474

In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40probe, inputregisterdevice was previously called early before the V4L2 video device and vb2queue components were fully initialized. If userspace opened the input devic...

EUVD-2026-66471

In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmciremove due to race condition In atmciprobe, &host-bhwork is bound with atmciworkfunc, and atmciinterrupt, atmcitimeouttimer and atmcidmacomplete can all queue this work on systembhwq. If...

EUVD-2026-66487

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byddisconnect uses timerdelete before freeing the driver's private data. This does not wait for a running bydcleartouch callback, which dereferences the private...

EUVD-2026-66463

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Selectively expand iomutex The iomutex was defined to serialize the ioregions, but then has also sort of been associated with the I/O themselves because of the close relationship they share. With the handful of race...

EUVD-2026-66578

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...