Vulnerabilities & fixes · Archive

Vulnerabilities & fixes

Dates are publishers’ publication dates, source update dates, or CISA catalog-added dates. First collected records when SecSIG first saw the entry.

• A Technical Deep Dive into CVE-2024-23380: Exploiting GPU Memory Corruption to Android Root ↗ (opens in a new tab)

  Android Offensive Security Blog · Published 2026-03-28 · First collected 2026-10-24

• CVE-2025-14325: SpiderMonkey Type Confusion in Baseline JIT Inline Cache ↗ (opens in a new tab)

  Qrious Secure · Published 2026-03-28 · First collected 2026-10-24

• Bypass GuardDuty Pentest Findings via Botocore Config ↗ (opens in a new tab)

  Hacking The Cloud · Published 2026-03-24 · First collected 2026-10-24

• iStat Menus < 7.20.5 local privilege escalation ↗ (opens in a new tab)

  Markuta · Published 2026-03-24 · First collected 2026-10-24

• Lenovo DCC: Part 2 - Trusted IPC and a Malicious Firmware Update ↗ (opens in a new tab)

  Neodyme’s Blog · Published 2026-03-24 · First collected 2026-10-24

• Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs ↗ (opens in a new tab)

  Project V4bel · Published 2026-03-23 · First collected 2026-10-24

• Beyond the Model: Neo Hunts, Exploits, and Proves 22 Zero-Days. ↗ (opens in a new tab)

  ProjectDiscovery Blog · Published 2026-03-20 · First collected 2026-10-24

• Roundcube round two: three more sanitizer bypasses ↗ (opens in a new tab)

  NULL CATHEDRAL · Published 2026-03-18 · First collected 2026-10-24

• More egress filtering bypasses in harden-runner ↗ (opens in a new tab)

  devansh · Published 2026-03-15 · First collected 2026-10-24

• Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools ↗ (opens in a new tab)

  The Hacker’s Choice Knowledge Base · Published 2026-02-14 · First collected 2026-10-24

• Revisiting Two-Shot Kernel Shellcode Execution From Control Flow Hijacking ↗ (opens in a new tab)

  zolutal’s blog · Published 2026-02-10 · First collected 2026-10-24

• Why does zsteg not work on JPEG files? ↗ (opens in a new tab)

  Elma · Published 2026-02-08 · First collected 2026-10-24

• TP-Link ER605 DDNS Pre-Auth RCE: Chaining Three CVEs ↗ (opens in a new tab)

  Research on Out of Bounds · Published 2026-02-03 · First collected 2026-10-24

• Supporting Wayland’s XDG activation protocol with Gtk/Glib ↗ (opens in a new tab)

  Almost Secure · Published 2026-02-03 · First collected 2026-10-24

• Some useless NAS bugs ↗ (opens in a new tab)

  XploitBengineer · Published 2026-01-30 · First collected 2026-10-24

• Improving Linux Heap Exploit Reliability with FreshSlices and CPU-Bullying ↗ (opens in a new tab)

  lolcads tech blog · Published 2026-01-29 · First collected 2026-10-24

• 社内勉強会をきっかけにハイパーバイザの脆弱性を見つけた話 ↗ (opens in a new tab)

  Ricerca Security · Published 2026-01-26 · First collected 2026-10-24

• Look at FortiCloud SSO Bypass Exploitation (CVE-2025-59718/59719) ↗ (opens in a new tab)

  CERT.at news · Published 2026-01-22 · First collected 2026-10-24

• Unauthenticated RCE in NetSupport Manager - A Technical Deep Dive ↗ (opens in a new tab)

  Blog on CODE WHITE | Red Teaming & Attack Surface Management · Published 2026-01-13 · First collected 2026-10-24

• PatchGuard Peekaboo: Hiding Processes on Systems with PatchGuard in 2026 ↗ (opens in a new tab)

  Outflank · Published 2026-01-07 · First collected 2026-10-24

• CVE-2025-38352 (Part 3) - Uncovering Chronomaly ↗ (opens in a new tab)

  faith2dxy · Published 2026-01-02 · First collected 2026-10-24

• CVE-2025-43530: Exploiting a private API for VoiceOver ↗ (opens in a new tab)

  Mickey’s Blogs · Published 2025-12-31 · First collected 2026-10-24

• When Vulnerability Management Turns into Incident Response ↗ (opens in a new tab)

  Dark Roast Security - Medium · Published 2025-12-24 · First collected 2026-10-24

• CVE-2025-55182 Exploitation Hits the Smart Home ↗ (opens in a new tab)

  Bitdefender Labs · Published 2025-12-09 · First collected 2026-10-24

• Exploiting: NetSupport Gateway ↗ (opens in a new tab)

  ret2.me · Published 2025-12-04 · First collected 2026-10-24

• Security analysis of AIxCC Nginx with CHERI ↗ (opens in a new tab)

  RoundofThree · Published 2025-11-14 · First collected 2026-10-24

• Flare-On 12: NTFSM - Solving a Finite State Machine with Binary Ninja ↗ (opens in a new tab)

  Jack Hacks · Published 2025-11-13 · First collected 2026-10-24

• KodCloud KodExplorer Remote Download web.function.php request_url_safe server... ↗ (opens in a new tab)

  CVE: New · Published 2026-10-25 · First collected 2026-10-25

• U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog ↗ (opens in a new tab)

  Security Affairs · Published 2026-10-24 · First collected 2026-10-24

• CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud ↗ (opens in a new tab)

  The Hacker News · Published 2026-10-24 · First collected 2026-10-24