CVE-2026-101311 Multiple vulnerabilities in bhyve device models

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering...

CVE-2026-101311 Multiple vulnerabilities in bhyve device models

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering...

CVE-2026-101310 Multiple vulnerabilities in bhyve device models

The HDA audio device model did not check for zero-length Buffer Descriptor List BDL entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious gue...

CVE-2026-101310 Multiple vulnerabilities in bhyve device models

The HDA audio device model did not check for zero-length Buffer Descriptor List BDL entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious gue...

CVE-2026-101308

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

CVE-2026-101309 Multiple vulnerabilities in bhyve device models

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

CVE-2026-101309 Multiple vulnerabilities in bhyve device models

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

CVE-2026-101308 TOCTOU race between sound(4) buffer resizing and mmap

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

CVE-2026-101308

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

EUVD-2026-101883

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

blogpost_cve-2018-19987-analysis

CVE-2018-19987 D-Link OS command injection analysis Hello there! In this short blog post I'll break down a quick analysis that I performed to better understand the details behind CVE-2018-19987. At the beginning I went after this CVE because I thought that there wasn't any public information or...

AirScout

Right now only a dutch version of the app is available. English will follow soon. User Guide – Wi-Fi Passive Monitor ESSID + Band Filter Legal & Ethics Notice Educational Use For educational and authorized testing only. You are solely responsible for how you use this tool. Intentionally disruptin...

apk-medit

apk-medit Apk-medit is a memory search and patch tool for debuggable apk without root & ndk. It was created for mobile game security testing. Many mobile games have rooting detection, but apk-medit does not require root privileges, so memory modification can be done without bypassing the rooting...

PCLink

PCLink Server The secure backbone for your personal PC remote control ecosystem. PCLink is a modern, web-first server designed for secure remote PC management and high-performance screen streaming. Featuring a high-performance FastAPI backend, a responsive Web UI, and an extensible plugin system...

shootback

shootback shootback is a reverse TCP tunnel let you access target behind NAT or firewall 反向TCP隧道, 使得NAT或防火墙后的内网机器可以被外网访问. Consumes less than 1% CPU and 8MB memory under 800 concurrency. slaver is single file and only depends on python2.7/3.4+ standard library. How it works Typical Scene 1. Access...

zclaw

zclaw The smallest possible AI personal assistant for ESP32. zclaw is written in C and runs on ESP32 boards with a strict all-in firmware budget target of = 888 KiB on the default build. It supports scheduled tasks, GPIO control, persistent memory, and custom tool composition through natural...

frida-snippets

& also output examples Table of Contents Native Load C/C++ module One time watchpoint Socket activity Intercept open Execute shell command List modules Log SQLite query Log method arguments Intercept entire module Dump memory segments Memory scan Stalker Cpp Demangler Early hook Android Binder...

opennhp

OpenNHP: Open Source Zero Trust Security Toolkit OpenNHP is a lightweight, cryptography-powered, open-source toolkit implementing Zero Trust security for infrastructure, applications, and data. It is the reference implementation of the Cloud Security Alliance CSA Network-infrastructure Hiding...

omae-wa-cheese-da

omae-wa-cheese-da Image GPU arbitrary physical R/W CVE-2025-21479 - KASLR leak - SELinux permissive - RKP-safe init-hook root server & DEFEX bypass custom binary exec LDPRELOAD It takes about 6 mins.. Be patient. I'll optimize it later. Tested devices Galaxy Z Flip 5 SM-F731N Firmware:...

phone-deck

phone-deck Turn a spare Android phone or any device with a browser into a self-hosted control deck and remote desktop for your Linux workstation — over your private Tailscale network, with no third-party apps. It started as "what do I do with an old phone?" and became a control plane for a Hyprla...