CVE-2026-97578

A flaw was found in the Linux kernel's Verisilicon Rockchip AV1 video decoder driver. A local user could exploit this vulnerability by submitting a specially crafted video stream with invalid tile parameters. This flaw can trigger a division-by-zero error or an out-of-bounds write to memory,...

CVE-2022-41218

Introduction This vulnerability is a race condition vulnerability that occurs in drivers/media/dvb-core/dmxdev.c. Therefore, a race condition may occur in the usb device driver using this dmxdev. This vulnerability could be used to trigger 3 UAFs. Vulnerability 1. vmalloc UAF write First, the...

CVE-2019-9730

CVE-2019-9730: Synaptics Audio Driver LPE The vulnerability in this driver package was with the CxUtilSvc system service. It hosted a COM object that low-privileged code can use to perform arbitrary reads and writes to the registry as SYSTEM. The .NET code adds the IRegistryHelper COM interface a...

CVE-2026-43284

🚨 CVE-2026-43284 - Dirty Frag 🚨 Universal Linux Kernel Local Privilege Escalation 📋 Overview Dirty Frag also known as Copy Fail 2 is a high-impact local privilege escalation vulnerability in the Linux kernel. It allows an unprivileged local user to obtain root privileges on affected systems...

CVE-2017-5123

CVE-2017-5123 Linux privilege escalation exploiting waitid syscall. The exploit is brought to you by @XeR0x2A and @chaignc from HexpressoTeam for educational purposes only. The bug was introduced the 2017-05-21 and fixed 2017-10-09, 4.14.0-rc4+ is known vulnerable. asciicast If you have a...

CVE-2025-5419

CVE-2025-5419 An uninitialized read vulnerability by incorrect Turboshaft Store-Store Elimination in V8. This repository contains analysis and stablized exploit to escalate this vulnerability to achieve in-V8-sandbox Arbitrary Read / Write, AddressOf & FakeObject primitives. Analysis:...

dirtyfrag

Dirty Frag: Universal Linux LPE Abstract This document describes the Dirty Frag vulnerability class, first discovered and reported by Hyunwoo Kim @v4bel, which can obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write CVE-2026-43284 vulnerability and the...

CVE-2026-54992-PoC

CVE-2026-54992 PoC Proof of concept for the Microsoft Message Queuing remote-read integer overflow tracked as CVE-2026-54992. The PoC uses two Windows VMs. A normal user on the vulnerable target asks the local MSMQ service to read from a queue hosted by the helper. The helper returns a malformed...

bl_sbx

blsbx itunesstored & bookassetd Sandbox Escape This repository contains a proof-of-concept demonstrating how maliciously crafted downloads.28.sqlitedb and BLDatabaseManager.sqlite databases can escape the sandbox of itunesstored and bookassetd on iOS. By abusing their download mechanisms, the POC...

CVE-2023-29343

CVE-2023-29343 This is PoC for arbitrary file write bug in Sysmon version 14.14 After last patch Sysmon would check if Archive directory exists and if it exists it would check if archive directory is owned by NT AUTHORITY\SYSTEM and access is only granted to NT AUTHORITY\SYSTEM. If both condition...

exploits

exploits CVE-2021-22600: Linux kernel LPE exploit CVE-2021-3156: Linux local privilege escalation through heap overflow in sudo Demo CVE-2021-3156: One shot exploit for heap overflow vulnerability in sudo CVE-2020-6507: Out of bounds write in V8. Chrome versions = 83.0.4103.97. RCE CVE-2020-16040...

ActiveMQ_Crack

ActiveMQCrack Overview ActiveMQ series vulnerability detection and exploitation tool, including ActiveMQ default password vulnerability and ActiveMQ arbitrary file write vulnerability CVE-2016-3088, supports batch detection and exploitation. Usage Batch detection: Write the URLs to be detected li...

CVE-2026-97024 Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2026-97024

A path traversal vulnerability exists in Flatpak 's handling of the files/etc directory during app deployment. A malicious Flatpak app can exploit this to empty or replace critical host system files—such as passwd , group , machine-id , or resolv.conf —with a symlink. In system-wide installations...

EUVD-2026-88624

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2022-22965

CVE-2022-22965-POC CVE-2022-22965 spring-core batch detection script Disclaimer: This script is for learning purposes only. Prohibited for illegal use. If there is any malicious destruction or illegal use, it has nothing to do with me!!! Usage: python3 CVE-2022-22965-POC.py url.txt After successf...

CVE-2025-6554

CVE-2025-6554 This repository contains This repository constructed and proved the addressof and fakeobj primitives, as well as the arbitrary address read/write primitives in V8 sandbox. Reproduce Information Commit: 609a85c2a1bd77d6f6905369f4bc4fcf34c5db09 Command Line: out\x64.release\d8...

CVE-2021-21551

CVE-2021-21551 Proof of concept exploit for CVE-2021-21551, vulnerability comes from user provided addresses being provided as arguments to a memmove call allowing for an arbitary read/write ioctls 0x9B0C1EC4 and 0x9B0C1EC8 as well as the physical address parameter for a MmMapIoSpace call that...

UnPlus

unplus CVE-2026-43499 Futex PI UAF kernel arbitrary-address-write exploit core logic code, used to bypass SELinux and gain root. This repository only contains the core exploit logic source src/ and the single-binary packager wrapper/. src/target.h is a template ; you must fill in parameters for...