kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

A flaw was found in the Linux kernel's iSCSI Internet Small Computer System Interface target functionality. This vulnerability, a heap overrun, occurs because the iscsiencodetextoutput function does not properly check buffer capacity when processing login requests. A remote attacker could exploit...

kernel: KEYS: fix overflow in keyctl_pkey_params_get_2()

A flaw was found in the Linux kernel's keyctlpkeyparamsget2 function within the KEYS subsystem. The vulnerability arises from an incorrect calculation of the internal output buffer's length, which can lead to a buffer overflow when a user-provided buffer is too small. This flaw could allow a loca...

kernel: NFSv4/flexfiles: reject zero filehandle version count

A flaw was found in the Linux kernel's NFSv4 Network File System version 4 flexfiles component. This vulnerability occurs when the fflayoutalloclseg function processes a malformed flexfiles layout that specifies a zero filehandle version count. An attacker could exploit this by providing a...

kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()

A flaw was found in the Linux kernel. The rtspinunlock function, and similar real-time RT locking mechanisms, incorrectly release Read-Copy-Update RCU protection before fully unlocking, leading to a Use-After-Free UAF vulnerability. This issue could allow a local attacker to potentially cause a...

kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

A flaw was found in the Linux kernel's NFSv4/pNFS implementation. The nfs4decodempdsaddr function, responsible for decoding network address information, does not properly handle zero-length raddr opaque data. A malicious or compromised metadata server can exploit this by providing a zero-length...

kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

A flaw was found in the Linux kernel's crypto QAT QuickAssist Technology module. A race condition exists during the teardown of Virtual Function to Physical Function VF2PF work in the adfdisablesriov function. This allows a concurrently scheduled or already queued worker to attempt to access memo...

badsuccessor

BadSuccessor.py A penetration testing tool that exploits the dMSA delegated Managed Service Account privilege escalation vulnerability in Windows Server 2025 Active Directory environments. ⚠️ Legal Disclaimer This tool is for authorized penetration testing and security research purposes only. Use...

Pishi

Pishi Pishi is a static binary rewriting tool designed to instrument basic blocks in XNU kernel and in arbitrary macOS kernel extensions kexts. for XNU kernel, Pishi allows you to instrument at a function, file, or folder level. For example, you can instrument everything in the /bsd/net/ director...

EUVD-2026-70867

A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSinglePresp of the file includes/presp/PrespController.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated...

CVE-2026-85399 code-projects Hospital Information System PrespController.php getSinglePresp sql injection

A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSinglePresp of the file includes/presp/PrespController.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated...

CVE-2026-85399

A SQL injection vulnerability exists in code-projects Hospital Information System 1.0 , specifically in the function getSinglePresp within the file includes/presp/PrespController.php . An unauthenticated remote attacker can manipulate the ID argument to inject SQL, potentially affecting confident...

kernel: KEYS: fix overflow in keyctl_pkey_params_get_2()

A flaw was found in the Linux kernel's keyctlpkeyparamsget2 function within the KEYS subsystem. The vulnerability arises from an incorrect calculation of the internal output buffer's length, which can lead to a buffer overflow when a user-provided buffer is too small. This flaw could allow a loca...

kernel: exfat: fix potential use-after-free in exfat_find_dir_entry()

A flaw was found in the Linux kernel's exFAT filesystem driver. A local attacker could exploit a use-after-free vulnerability in the exfatfinddirentry function. This occurs because a buffer is prematurely released while still being referenced, which can be triggered by processing a specially...

kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...

PMD

Practical Malware Development Exercise 1 - Environment Setup 1. Get a Windows virtual machine setup within a hypervisor. a. Make sure to take a snapshot of your base installation. 2. Download and install Visual Studio 2022 - https://visualstudio.microsoft.com/vs/ a. Select Desktop development wit...

sleep_python_bridge

Cobalt Strike Sleep Python Bridge This project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need for the standard GUI client. NOTE: This project is very much in BETA. The goal is to provide a playground for testi...

DataInject-BOF

Data Inject BOF A beacon object file implementation of the process injection proof-of-concept from my blog post Control Flow Hijacking via Data Pointers. Hijacks control flow via overwriting combase.dll's Control Flow Guard function pointers called by COM proxying functions. Important Notes From ...

delete-self-poc

🗑️ delete-self-poc The delete-self-poc is a demonstration of a method to delete a locked executable or currently running file from disk. This concept was initially discovered by Jonas Lykkegaard, and I have created the proof of concept POC for it. Additionally, it can be used to delete locked file...

PhoneNumber-OSINT

PhoneNumber-OSINT An OSINT tool for gathering information about phone numbers It was created by Spider Anongreyhat Anonspidey Screenshot How To install PhoneNumber-OSINT on termux: root@kitploit: apt update && apt upgrade apt install python3 apt install git apt install pip git clone...

CVE-2022-2333

CVE-2022-2333 Después de medio año de trabajo, les muestro algo bueno. ¿Les gusta sxf vpn? No me gusta mucho. Después de medio año, ya obtuve una shell. Después de obtenerla, descubrí que era firmware antiguo. En M7.6.8 ya no estaba. Olvídalo, olvídalo. No es que no confíe en ti, es que todos...