autotimeliner

AutoTimeliner Automagically extract forensic timeline from volatile memory dumps. AutoTimeliner runs multiple Volatility3 plugins against Windows, Linux, and macOS memory images, then merges their output into a single, sorted CSV timeline: Generic Timeline Plugin Plugin| What it captures ---|---...

avml

AVML Adquisición de memoria volátil para Linux Resumen Una herramienta portátil de adquisición de memoria volátil para Linux. AVML es una herramienta de adquisición de memoria volátil en el espacio de usuario userland para X8664, escrita en Rust, pensada para desplegarse como un binario estático...

Douglas-042

Douglas-042 - 威胁狩猎 应急响应 - PowerShell 狩猎 DOUGLAS-042 是一款设计精妙的 PowerShell 脚本，旨在加速分类（triage）流程，并协助系统性地收集来自取证工件以及短暂易失性数据中的关键证据。其核心使命是在 Windows 生态系统中定位潜在安全漏洞这一艰巨任务中提供不可或缺的协助。DOUGLAS-042...

LiME

LiME Extractor de Memoria de Linux Un Módulo de Kernel Cargable LKM para la adquisición de memoria volátil desde Linux y dispositivos basados en Linux, como Android. LiME minimiza su interacción entre los procesos de espacio de usuario y de kernel durante la adquisición, produciendo capturas de...

CryKeX

属性： 跨平台 极简主义 简洁 交互性 兼容性/可移植性 应用无关性 进程包装 进程注入 依赖： Unix - 应适用于任何基于Unix的操作系统 BASH - 整个脚本 root权限（可选） 限制： 仅支持AES和RSA密钥 对Firefox浏览器大多情况下失败 不适用于磁盘加密（LUKS）和PGP/GPG 需要适当的用户权限和内存授权 工作原理 你可能已经听说过甚至使用过我的 AES-REX 项目，它做的是类似的事情，但方式不同。AES-REX从寄存器中提取加密密钥，而CryKeX则从易失性内存（RAM）中提取。 关于DRAM中加密密钥的安全性，已有一些研究...

dwarf2json

Introduction dwarf2json is a Go utility that processes files containing symbol and type information to generate Volatility3 Intermediate Symbol File ISF JSON output suitable for Linux and macOS analysis. To build Go 1.18+ required: root@kitploit: $ go build To run: root@kitploit: $ ./dwarf2json...

varc

varc Volatile Artifact Collector varc 从系统中收集易失性数据的快照。 它告诉你系统上正在发生什么，在调查安全事件时尤其有用。 它创建一个 zip 文件，其中包含用于了解系统上正在发生的多种不同数据： JSON 文件，例如正在运行的进程及其建立的网络连接 按进程划分的正在运行进程的内存。还会从中提取日志和文本数据 活动连接的 netstat 数据 打开文件的内容，例如正在运行的二进制文件 触发提供的编译 YARA 规则文件的进程详细信息 我们已在以下环境中成功执行： Windows Linux OSX 云环境，如 AWS EC2 容器化...

IonStack_S21

IonStackS21 — exploit de CVE-2026-43499 portado para Galaxy S21 SM-G991B Payload de IonStack específico para el dispositivo Samsung Galaxy S21 o1s en firmware G991BXXSJHZC2. Proporciona root volátil mediante exploit LDPRELOAD + demonio root-helper callusermodehelper misma forma que IonStack-S22U ...

Exploit for Use After Free in Linux Linux_Kernel

IonStackS21 — CVE-2026-43499 exploit port for Galaxy S21 SM-...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nvme: Fixed a multipath crash caused by the flush request when blktrace is enabled. The flush request initialized by blkkickflush has a NULL bio. This issue may be addressed during the nvmeendreq operation during io completion...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fixed the issue of freeing the HMB descriptor table. The HMB descriptor table is sized based on the maximum number of descriptors that can be used for a given device. However, nvmeallochostmem might break out of the loo...

CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573

The CVE-2026-64573 issue affects the Linux kernel Bluetooth stack (qca TLV parser). In the TLV_TYPE_NVM branch of qca_tlv_check_data(), the loop bound used length - sizeof(struct tlv_type_nvm) with length as a signed int promoted to size_t, which could underflow when firmware

CVE-2026-64510

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface ACPI Non-Volatile Memory NVM Firmware Interface Table NFIT core. Improper error handling during the initialization process can leave a dangling pointer. A local attacker could potentially trigger an ACPI Machine Che...

CVE-2026-64511

A flaw was found in the Linux kernel's ACPI NFIT core component. This vulnerability allows a local attacker to cause a system crash by triggering a specific notification related to Non-Volatile Memory NVM before the NVM table is fully set up. This improper handling of NVM notifications can lead t...

CVE-2026-64321

In the Linux kernel, the following vulnerability has been resolved: nvme: target: rdma: fix ndev refcount leak on queue connect nvmetrdmaqueueconnect calls nvmetrdmafindgetdevice which acquires a reference on the returned ndev via krefget. On the path where the host queue backlog is exceeded and...

SUSE CVE-2026-64016

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbdreopendurablefd republishes the same ksmbdfile into the session volatile-id table. If smb2open then takes a later error path, cleanup...

Linux Distros Unpatched Vulnerability : CVE-2026-64016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds,...

CVE-2026-64072

In the Linux kernel, the following vulnerability has been resolved: nvme: fix bio leak on mapping failure The local bio is always NULL, so we'd leak the bio if the integrity mapping failed. Just get it directly from the request...