Catálogo de exploits

Trace untrusted OAuth endpoint URLs from source to shell sink — the CVE-2026-119025 attack class, checked in your code, lockfile and MCP configs.

krevetkqqq/CVE-2026-82384

CVE-2026-98432 (CVSS 9.8) Linux IPv4 TCP use-after-free Red/Blue team toolkit. Kernel exposure checks, live marker-based race proof, KASLR slide recovery from captures, pcap analysis, and one-shot host hardening. Interactive menu or direct flags, zero setup & dependencies, Python. Built for authorized security testing.

You should patch, but not worry about CVE-2026-98432

Toy project

CVE-2026-106378 is a privilege escalation in the Google Chrome sandbox on macOS. An attacker who has already compromised the renderer process can execute arbitrary code **outside the sandbox** via a crafted HTML page.

Advisory for node-forge ⌯⌲ 53 mill weekly downloads

Temporary root for the Vivo iQOO 13 via CVE-2026-98260 posix-cpu-timer UAF, with KernelSU and FinaSU late-load

Proof-only PoC for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free): race trigger, heap-reuse oracle, no code execution

CVE-2026-103056 (CVSS 4.0 9.4 Critical) — AiSOC < 12.0.0 OS command injection into CrowdStrike RTR command strings. Verified standalone PoC.

Ubuntu Noble backport and regression evidence for the upstream CVE-2026-98432 IPv4 RCU lifetime repair

krevetkqqq/CVE-2019-7256

CVE-2026-111497 two-stage Brotli harness: local trigger/error-semantics verification, no exploitation

CVE 2026 98260 vivo s60 poc

initial-access

Local kernel version checker, remote MPTCP capability probe, and interactive scan-and-probe CLI for assessing exposure to the Linux kernel IPv4 TCP use-after-free (CVSS 9.8).

Analisis dan panduan remediasi CVE-2026-98432 untuk Ubuntu 22.04 LTS

Source-validated Ubuntu 6.8 backport candidate for Eric Dumazet’s upstream CVE-2026-98432 fix, with provenance and CI. Not yet compiled or boot-tested.

Drop incoming IPv4 TCP packets whose IP header contains options.

Check a Linux server for CVE-2026-98432 (IPv4 TCP use-after-free, CVSS 9.8): root cause explained, read-only check script and mitigations.

Read-only, agentless Linux kernel security configuration auditor (local & SSH). Initial focus: TCP migration / MPTCP checks for CVE-2026-98432.

CVE-2026-98432 (Linux IPv4 TCP use-after-free): how to check your server, apply a stopgap, and clean up after the fix

Race trigger, heap-reuse oracle, pcap analysis, detection and mitigation tooling for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free).

client-side

isukasanuj/CVE-2026-92744

CVE-2026-103688: Checkout Files Upload for WooCommerce < 2.4.0 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).

client-side

Open-source hotfix for PAN-OS firewall chain attack PHP2Shell and Fragnesia CVE-2026-109618 and CVE-2026-46300

Diagnosis and remediation prompt for PHP2Shell (CVE-2026-109618/109619), the Node.js Oct 2026 security release and Brotli CVE-2026-111497. EN + PT-BR. Facts as of 29 Oct 2026.

Authenticated Stored XSS via SafeUrlValidator bypass on the rich-text render path in Spina CMS (<= 2.21.0). Payload executes on the public site. CVE-2026-117182.