CVE-2026-89507 RDMA/ucma: Lock the handler in ucma_write_cm_event()

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmawritecmevent ctx-file may only be changed under the handler lock and the xalock, which is what stops uevents being queued for a ctx while ucmamigrateid moves it to another file. The CM core take...

CVE-2026-89499

This Linux kernel vulnerability affects the ring-buffer subsystem. The swap_reader_page remote callback can return -EBUSY when the writer moves the head before the remote reader catches up—particularly during an event storm on a small buffer. The function __rb_get_reader_page_from_remote() previo...

EUVD-2026-76405

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

CVE-2026-89499 ring-buffer: Stop remote reader update when page swap fails

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

cve-2026-62737-lab

CVE-2026-62737: del crash a SYSTEM asistido por laboratorio Una continuación del análisis original de CVE-2026-62737 llamada indirecta arbitraria al kernel de ExecutionContext.sys. Convierte el PoC del crash en una cadena de intercambio de tokens funcional que lanza cmd.exe como SYSTEM, pero solo...

cve-2023-46813-poc

CVE-2023-46813 PoC 1. 将 host-patches 文件夹中的补丁应用于 Linux 主机和 QEMU。 2. 启动一个 SEV-SNP 虚拟机。 3. 运行此仓库中的代码，等待消息 "waiting for the hypervisor to change memory to MMIO"。 4. 在 QEMU 中多次执行 attack 命令。 5. 一旦漏洞利用检测到其部分内存类型已被更改为 MMIO，它将利用该漏洞将其凭据与 init 任务的凭据进行交换。 成功利用后效果如下： 该漏洞利用不依赖任何绝对内核偏移量，而是依赖于 struct taskstruct...

RefleXXion

简介 RefleXXion 是一款旨在帮助绕过 AV/EPP/EDR 等安全产品所实施用户态钩子的工具。为了绕过用户态钩子，它首先收集 LdrpThunkSignature 数组中的 NtOpenFile、NtCreateSection、NtOpenSection 和 NtMapViewOfSection 系统调用编号。之后，用户可以选择两种技术来绕过用户态钩子。 技术一：从 C:\Windows\System32\ntdll.dll 文件中读取 NTDLL。解析后，用干净的 NTDLL 的 .TEXT 段替换内存中已加载的 NTDLL（即钩子所在位置）的 .TEXT 段。...

PT-2026-90476

In the Linux kernel, the following vulnerability has been resolved: mm, swap: don't free a hibernation slot that is in the swap cache A slot with a folio in the swap cache is freed when the folio leaves the cache, not when its count drops. swap put entries cluster follows that rule. swap free...

PT-2026-90215

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swap reader page callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

invokeai

invokeai 这是一个用于 Endor Labs EXPOSURE 的 合成演示目标 。 当前状态是 故意存在漏洞的 （HOT）。EXPOSURE 将报告一个 HOT 结论。 跟踪的 CVE：CVE-2024-10821（没有上游修复；仅通过补偿控制缓解）。 EXPOSURE 打开的一个演示 PR 会将规范配置文件替换为强化变体，从而打破漏洞利用链—— 无需 升级易受攻击的依赖项。 客户应用修复的工作量是 一次点击 （审核 + 合并）。 此仓库不是生产应用程序。它仅用于锚定 EXPOSURE “点击 → 打开真实 PR” 演示针对一个真实 GitHub 仓库。...

http-server-node

http-server-node 此仓库是 Endor Labs EXPOSURE 的一个合成演示目标 。 当前状态故意存在漏洞 （HOT）。EXPOSURE 将对其报告 HOT 判定。 跟踪的 CVE：CVE-2021-23797（无上游修复；仅通过补偿性控制缓解）。 由 EXPOSURE 打开的演示 PR 将规范配置文件替换为加固变体，从而打破漏洞利用链—— 无需 升级易受攻击的依赖项。 客户应用修复所需的工作量为一次点击 （审查 + 合并）。 此仓库不是生产应用程序。它仅用于在真实的 GitHub 仓库上锚定 EXPOSURE 的“点击 → 真实 PR 打开”演示。...

node-prompt-here

node-prompt-here 此仓库是 Endor Labs EXPOSURE 的合成演示目标 。 当前状态为故意存在漏洞 （HOT）。EXPOSURE 将针对其报告 HOT 判定。 跟踪的 CVE：CVE-2020-7602（无上游修复；仅通过补偿性控制缓解）。 EXPOSURE 打开的演示 PR 会将规范配置文件替换为加固后的变体，从而打破漏洞利用链——而无需 升级存在漏洞的依赖项。 客户应用修复的工作量为一次点击 （审查 + 合并）。 此仓库并非生产应用。它仅用于支撑 EXPOSURE 的“点击 → 真实 PR 打开”演示，并针对真实的 GitHub 仓库进行。...

CVE-2025-4162030

Aviso de Seguridad: CVE-2025-4162030 Este resumen de seguridad fue proporcionado por CoPilot ^1^. El contenido proporcionado en este sitio web está disponible solo con fines informativos y puede ser accedido y utilizado por motores de búsqueda o modelos de lenguaje LLM con las siguientes...

CVE-2025-4162026

Aviso de Seguridad: CVE-2025-4162026 El contenido proporcionado en este sitio web está disponible únicamente con fines informativos y puede ser accedido y utilizado por motores de búsqueda o modelos de lenguaje LLM con las siguientes restricciones: El contenido puede ser reproducido, resumido o...

CVE-2026-86719

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser without calling...

EUVD-2026-72855

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser without calling...

CVE-2026-86424

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use TOCTOU vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation check-time and the file write...

DEBIAN-CVE-2026-86424

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use TOCTOU vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation check-time and the file write...

CVE-2026-86424

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) race condition in the video decoder . An attacker with local access can swap a symlink between the policy validation check and the subsequent file write operation, allowing writes to policy-denied locations an...

EUVD-2026-72382

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use TOCTOU vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation check-time and the file write...