PT-2026-90341

In the Linux kernel, the following vulnerability has been resolved: HID: sony: fix UAF of ghl poke timer / ghl urb at driver unbind For GHL Guitar Hero Live dongles, sony probe arms a periodic timer: ghl magic poke the timer callback submits sc-ghl urb, and the URB completion ghl magic poke cb...

PT-2026-90229

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENT GET INFO stores guest-controlled num events sizeofeinfo in a 32-bit integer. On RV64, num events = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates...

PT-2026-90478

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begin current label crit section AppArmor's begin current label crit section is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label...

PT-2026-90233

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix rq-core pick corruption under core scheduling Core scheduling's pick next task picks what to run on every SMT sibling of the core in a single pass under the shared core-wide rq lock. The selection state is consiste...

PT-2026-90466

In the Linux kernel, the following vulnerability has been resolved: tracing/user events: Clear copied tracing state before fork duplication dup task struct copies user event mm from the parent into the child, without grabbing a reference to it. user event mm dup should replace it, but it leaves...

PT-2026-90195

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp endpoint bh rcv looks the association up only when chunk-asoc is NULL, and caches the result in chunk-asoc and chunk-transport without taking a reference. A pack...

PT-2026-90101

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000 free usb related resources frees both URBs and leaves the pointers behind: usb kill urbbcd2k-midi out urb; usb kill urbbcd2k-midi in urb; usb free urbbcd2k-midi out urb;...

PT-2026-90143

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate password input computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first...

PT-2026-90131

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in sl sync slip devs stores bare net device pointers and takes no reference on them. sl sync and sl alloc walk that table from slip open under rtnl lock, while an entry is dropped by sl free netdev, which...

PT-2026-90469

In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: report RCU-tasks quiescent states in shrink lruvec I am seeing some rcu tasks stalls in the Meta fleet during reclaim. INFO: rcu tasks detected stalls on tasks: 0000000088620d09: .. nvcsw: 6735/6735 holdout: 1 idle cpu...

PT-2026-90103

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6fire comm receiver handler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

PT-2026-90235

In the Linux kernel, the following vulnerability has been resolved: sched ext: Replace SCX RQ BAL KEEP with a dispatch verdict return SCX RQ BAL KEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works...

PT-2026-90076

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuse uring copy to ring and req-out.h back in fuse uring commit. Both headers live inside the fuse request...

Pixel_GPU_Exploit

Mali GPU Kernel LPE This article provides an in-depth analysis of two kernel vulnerabilities within the Mali GPU, reachable from the default application sandbox, which I independently identified and reported to Google. It includes a kernel exploit that achieves arbitrary kernel r/w capabilities...

ScheduleRunner

ScheduleRunner - 一个具有更高灵活性的C工具，用于定制红队操作中的计划任务，以支持持久化和横向移动 计划任务是过去十年中最流行的攻击技术之一，如今黑客/红队成员仍常将其用于持久化和横向移动。 已有多种C工具被开发出来模拟使用计划任务的攻击。我尝试过其中一些，但每个工具在定制计划任务方面都有其局限性。因此，本项目旨在提供一个C工具（兼容CobaltStrike的execute-assembly），包含我所需要的功能，并提供足够的灵活性来定制计划任务。 截图： 方法 /method: 方法| 功能 ---|--- create| 创建一个新的计划任务 delete|...

CVE-2025-57833

Django FilteredRelation Alias SQL注入漏洞CVE-2025-57833 Django时隔一年爆出来的SQL注入漏洞，大概一看大概是别名引起的注入（毕竟别名是无法预编译的 ） 该漏洞影响 Django 框架中的 FilteredRelation 功能，当使用 QuerySet.annotate 或 QuerySet.alias方法，并通过 Python 的字典扩展 kwargs 提供列别名时，存在 SQL 注入风险。这是由于对字典键（即列别名）未进行充分验证，导致攻击者可构造恶意字典注入不受限制的 SQL 语句 该漏洞的影响范围为 Django 4.2 之前...

fuzztruction

Fuzztruction Fuzztruction is an academic prototype of a fuzzer that does not directly mutate inputs as most fuzzers do but instead uses a so-called generator application to produce an input for our fuzzing target. As programs generating data usually produce the correct representation, our fuzzer...

CmdLineSpoofer

Spoofer de Línea de Comandos Un ejemplo de uso de C para inyectar un shell meterpreter, mientras se falsifica la línea de comandos. La línea de comandos se almacena en el Bloque de Entorno del Proceso, se registra cuando se inicia un nuevo proceso y se muestra en herramientas como Process Hacker ...

remediate_cesa_2019_2091

cesa20192091 This module contains a Bolt Task that will remediate CVEs described in CESA-2019:2091 and parallel issues present on other Enterprise Linux 7 EL7 platforms. Table of Contents 1. Description 2. Setup - The basics of getting started with cesa20192091 Beginning with cesa20192091 3. Usag...

graphicator

Graphicator Graphicator is a GraphQL "scraper" / extractor. The tool iterates over the introspection document returned by the targeted GraphQL endpoint, and then re-structures the schema in an internal form so it can re-create the supported queries. When such queries are created is using them to...