CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1783414634)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1783414634 advisory. - In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Don't advance iterator after restart due to...

public-passwd

!WARNING Only use this on systems you own or have authorisation to test. It is recommended to keep a root shell open if you won't be able to reboot the system in case of failure, as you may not be able to clear the page cache for /etc/shadow without root. public-passwd Use CVE-2026-46333 and...

CVE-2026-98164

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvmgfniswritetracked checks only the supplied memslot, but page tracking is per-address-space and shadow pages are shared across all address spaces. With SMM, a GFN can...

CVE-2026-98164

A flaw exists in the Linux kernel's KVM subsystem involving how memory write tracking is handled when virtualized System Management Mode (SMM) is enabled. The function kvm_gfn_is_write_tracked() incorrectly checks only the supplied memslot, failing to account for the fact that shadow pages are sh...

CVE-2026-98164 KVM: x86/mmu: Check write tracking in all address spaces

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvmgfniswritetracked checks only the supplied memslot, but page tracking is per-address-space and shadow pages are shared across all address spaces. With SMM, a GFN can...

CVE-2026-98164 KVM: x86/mmu: Check write tracking in all address spaces

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvmgfniswritetracked checks only the supplied memslot, but page tracking is per-address-space and shadow pages are shared across all address spaces. With SMM, a GFN can...

Wp2shell-ioc-scanner

wp2shell IOC Scanner Version 1.4.0 · GPL-2.0-or-later · WordPress 6.0+ · PHP 7.4+ A read-only-by-default triage tool for the WordPress core vulnerabilities CVE-2026-60137 and CVE-2026-63030 “wp2shell”. It checks patch state, accounts, durable database artifacts and file integrity, separates...

CVE-2020-25223

CVE-2020-25223 A PoC script for testing CVE-2020-25223 against an affected Sophos UTM. Given an IP address, the script attempts to download a copy of the devices /etc/shadow file. Original research: https://www.atredis.com/blog/2021/8/18/sophos-utm-cve-2020-25223...

CVE-2020-13886

PoC: https://youtu.be/nNKBRx8IglI ------------------------------------------------------------------------------------------------------------- ------------- 0day: TELEFONE IP TIP200/200 LITE & TIP 300 | Local File Include | ---------------------------- ------------------------------- P0c Author:...

KVM-Januscape

KVM-XJ Hot Patch dumptool.py automatically finds offsets; how to use it? Just read the code. Vulnerability Overview CVE-2026-53359 Januscape is a use-after-free UAF vulnerability in the Linux kernel KVM shadow MMU. Lurking time : 16 years August 2010 to July 2026 Affected range : All Intel/AMD x8...

CVE-2021-3773

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ 🚀 Port Shadow...

CVE-2026-53359-Kernel-Fix

中文 | English 中文 升级 Linux Kernel 7.1.3 修复 CVE-2026-53359 教程 声明： 本文仅记录本人服务器环境下的修复过程，并非安全专业分析。如有不当之处，欢迎指正。 验证说明： 经源码比对确认，Linux Kernel 7.1.3 已包含修复 commit 81ccda30b4e8（"KVM: x86: Fix shadow paging use-after-free due to unexpected role"），该补丁在 arch/x86/kvm/mmu/mmu.c 的 kvmmmugetchildsp 函数中增加了 role.word...

CiscoRV320Dump

CiscoRV320Dump CVE-2019-1653/CVE-2019-1652 Exploits For Dumping Cisco RV320 Configurations and getting RCE Implementations of the CVE-2019-1652 and CVE-2019-1653 exploits disclosed by Red Team Pentesting GmbH. I only tested these on an RV320, but according to the Cisco advisory, the RV325 is also...

CVE-2026-53359

🚨 CVE-2026-53359 — Januscape Linux KVM Shadow Paging Use-After-Free Guest-to-Host Escape Januscape is a Linux Kernel KVM vulnerability caused by a Use-After-Free UAF condition in the x86 Shadow MMU. Under vulnerable configurations, a malicious guest can corrupt host memory, leading to host crashe...

dockerevil

dockerevil A simple repository to store my security flaws in the docker technology 2016 - 2017 Docker API Privilege EscalationLPE/RPE Escalate from Offline Server/Minimal Images/Build from TAR Dockerfile Docker SUDO Privilege Escalation PoC Nmap Scripts 2019 CodeStudent1995 Based Exploit OpenShif...

CVE-2026-64561

CVE-2026-64561 — Zapscape: KVM/x86 shadow MMU UAF, guest escape to host root HackSpeak distribution mirror. This repository is a distribution mirror of the complete PoC + technical write-up publicly released by researcher Hyunwoo Kim @v4bel , with code and documentation identical to upstream. ⚠️...

KrbRelayUp

KrbRelayUp Simple wrapper around some of the features of Rubeus and KrbRelay and a few other honorable mentions in the acknowledgements section in order to streamline the abuse of the following attack primitive: 0. Optional New machine account creation New-MachineAccount 1. Local machine account...

CVE-2020-17382

CVE-2020-17382 Windows 10 x64 2004 Build 19041.264 Exploit Kudos to @matteomalvica for asking me so many questions about this vulnerability that forced me to write an exploit for him for the latest Windows 10 release 19041.264 without KVA Shadow i.e. non Specter vulnerable CPUs and without VBS...

CVE-2021-36934-export-shadow-volume-POC

CVE-2021–36934 The derived hash is used for forgery such as PTH and bills. There is no detailed analysis here. In addition, given that access rights to most system files can be obtained, there should be more than this one method of exploitation, including Microsoft officials, which have also...

Raccine

Raccine A Simple Ransomware Protection Why We see ransomware delete all shadow copies using vssadmin pretty often. What if we could just intercept that request and kill the invoking process? Let's try to create a simple vaccine. How it works We register a debugger for vssadmin.exe and wmic.exe,...