Third-party vulnerability intel indexed from public sources — Sploitus, Project Nightcrawler, Church of Malware, vx-underground, Hacker News, and others — for security research inquiry. OFFSITE.DARK does not discover or weaponize exploits; we index, analyze, attribute sources, and ask whether they have research value.
news
invalid/ByePg mirrors a pure-Rust WDK #PF/PatchGuard observation driver on Project Nightcrawler — research continuation of can1357’s 2019 technique, not a new NightmareEclipse drop.
news
CTI pack covering five config-dependent NGINX data-plane CVEs (OCSP bypass, HTTP/2 injection, rewrite/map/gRPC heap overflows); public scanners indexed on Sploitus.
news
Futex PI use-after-free (kernel 2.6.39–pre-7.1) powers GhostLock/unplus-style locked-bootloader root on GKI 6.12; dual PoCs topped Sploitus weekly list.
news
Kernel LPE via AF_ALG crypto sockets and splice() heap corruption; public PoCs claim Ubuntu/RHEL/Amazon/SUSE reachability; patch and blacklist algif_aead.
news
Query-parameter path override on /userfiles/{path} yields unauth arbitrary file read (Laravel .env, etc.) in Microweber ≤ 2.0.20; PoC indexed on Sploitus.
news
Critical Fireware IKEv2 flaw with version-pinned PoC and detection-only scanner resurfaced in Sploitus weekly list; triage internet-facing VPN endpoints.
news
July 2026 AD CS chase fallback lets low-priv users coerce CA into issuing DC-identity certs; patched Patch Tuesday; public Certighost PoC indexed.
news
Public reservation endpoint accepted client-supplied appointment id and overwrote victim bookings; fixed in Easy Appointments 3.12.28; PoC on Sploitus.
news
Default-config RCE in fastjson 1.2.68–1.2.83 on Spring Boot fat-JARs; ITW since late July; fix in 1.2.84 or SafeMode / migrate to fastjson2.
news
Unauthenticated REST batch route confusion yields SQLi and optional admin→plugin RCE; CISA KEV, Rapid Escalation scanning, public checkers indexed on Sploitus.
news
MSNightmare ninth drop — stripped ProfSvc PoC redirects UsrClass.dat across user boundaries on July 2026-patched Windows; Cyderes reproduced; no CVE, no Microsoft OS patch as of 2026-07-31.
news
CRLF in CURLOPT_MAIL_RCPT operand injects full MAIL/RCPT/DATA transaction after authenticated EXPN — stock curl completes injected message.
news
ZIP64 entry advertises 109 bytes but stock bsdunzip streams 4GiB+109 — debuginfod indexes and serves ELF sections past the metadata boundary.
news
Dangling Wasm FunctionType reference plus memory64 ImageData leak chains to native code execution in WebContent — marker touch /tmp/ladybird_wasm_esm_rce.
news
Signed remote Create(Note) with numeric attributedTo binds to local uid — private chat and public posts appear from spoofed administrator account.
news
Passing Request, URLSearchParams, or FormData into unstable_cache() collapses cache keys to {} while callbacks read live per-request data — first writer wins across restarts.
news
Mutating transform.output_mode after RGB→RGBA build allocates L image while LittleCMS copies 4-byte stride — heap OOB write in _imagingcms.
news
Guest CXL mailbox GET_LOG/SET_FEATURE bugs leak host pointers and forge MemoryRegionOps — host marker id>/tmp/qemu_cxl_escape_marker on QEMU 11.0.50.
news
bikini/exploitarium bundles 30 standalone PoC folders — MotW chains, libssh2, FFmpeg, hypervisor escape, and client RCE candidates.
news
162 malicious artifacts across 108 packages in npm, Go, Packagist, and Chrome; DPRK-linked loaders hide in config files and fake .woff2 fonts.
news
Metasploit auxiliary scanner detects unanchored regex auth bypass on /api/libraries — versions 2.17.0–2.19.0.
news
dalfox server mode POST /scan accepts FoundAction/FoundActionShell in JSON — unauthenticated RCE on 0.0.0.0:6664 when no --api-key.
news
Broken REST validate_callback lets order reach ORDER BY — blind boolean/time extraction of wp_users hashes via tec/v1 API.
news
GODofExploit/exploit-arsenal bundles stdlib Python 3 PoCs — CVE-2026-0920, 0926, 1470, CVSS up to 9.9.
news
Crafted RAR5 STM streams overwrite extracted file bytes and Zone.Identifier on 7-Zip 26.01 — MotW bypass chain.
news
AnyDesk printer worker unmarshals attacker COM bytes on the adprinterpipe named pipe with RPC_C_IMP_LEVEL_IMPERSONATE — SYSTEM when installed as service.
news
Loopback DNS-over-TCP EDNS retry sequence leaves stale skip-list state; cleanup reaches attacker-shaped destructor — calc proof on main and v1.34.6.
news
Container races host `docker cp` copy-out so extraction writes sibling path outside requested destination — validated on Engine 29.6.0.
news
Velocity templates in Floci API Gateway integration responses reach ProcessBuilder; wrong SigV4 credential scope bypasses IAM enforcement.
news
Custom MCP stdio blocks `NODE_OPTIONS` by exact case; Windows honors `node_options` — preload arbitrary JS in child Node process.
news
Smart Window sets privateData without untrustedInput — attacker titles coerce get_page_content to fetch expanded private tab/history URL tokens.
news
Packaged calc PoCs for Swift demangler tool path ACE, conditional TraceRMI agent command execution, and SevenZipJBinding reachability.
news
Crafted RASC bitstream in AVI/RIFF overwrites adjacent callback pointer in PAL8 one-row decode — Calculator proof on upstream master.
news
Workflow `container.options` preserves --pid=host and cap-add=ALL while Privileged=false — nsenter writes host marker from job container.
news
Bare `gswin64c.exe` delegate on Windows resolves from CWD — planted binary executes when processing PDF/PS in attacker-writable directory.
news
Win32 attrs allocation wrap and Win64 cleanup arbitrary-free chains in publickey list fetch — live SSH session calc replay included.
news
ACP user-manager permission alone can create gid=4 Administrator accounts — verify_usergroup() accepts any group.
news
Unchecked SSH packet_length wraps allocation to 19 bytes while logical length stays 0xffffffff — local RCE harness models post-allocation misuse.
news
Upgrade request with Content-Length leaves backend bytes parsed as next request — smuggled response delivered to victim client on reused connection.
news
rehypeRaw Markdown + preload IPC forges Modrinth profile overrides and openExternal local launcher — critical candidate CVSS ~9.6.
news
Crafted ELF/DLX objects via objdump -g reach calc callback — ASLR-relative delta strategy; credit 4D4J/objdump-Out-Of-Bounds-write.
news
Malicious server push decodes script.win.user.disconnect via echo option — runs on disconnect despite scriptsPermissionGranted=false.
news
Hop-by-Hop ext len=1 on 48-byte capture advances payload offset past buffer — wrapped payload_len 4294967288 in harness.
news
Relay can force non-secure session after auth; FileTransfer-authorized sessions reach screen/input handlers gated only by broad authorized flag.
news
StreamBucket type confusion chains to fake HashTable write and zend_execute_internal hook — marker PHP857_RCE validated locally.
news
phsvc accepts any Authenticode-trusted client image — code in rundll32 connects to SiSvcApiPort and runs elevated helper APIs.
news
405-byte IVF 64×64 then 64×8192 frame hits stale slice-thread entries allocation — research ongoing toward stronger impact.
news
libavcodec/magicyuv.c OOB write — crafted AVI crashes unpatched FFmpeg < 8.1.2; CVSS 8.8, distinct from Exploitarium RASC PoC.
news
wp_kses_post runs before forminator_replace_variables — javascript: in form_name bypasses sanitization; CVSS 4.4.
news
act_pedit skb_ensure_writable() computes COW range before runtime offsets — page cache corruption, potential LPE, CVSS 7.8.
news
TPAS coursework repo: React storefront + vulnerable Log4j 2.14 Spring API + JNDI exploit script with WAF-bypass toggle.
news
Authorization bearer interpolated into PostgreSQL token lookup — pre-auth blind SQLi on LiteLLM 1.81.16–1.83.6; fixed 1.83.7, CVSS 9.8.
news
x-middleware-subrequest header skips middleware auth gates on self-hosted Next.js < 12.3.5 / 13.5.9 / 14.2.25 / 15.2.3 — CVSS 9.1.
news
WebSocket keyboard simulation on port 1313 chains to arbitrary commands; indexed PoCs include Python and LNK upload variants.
news
Six lab scripts demonstrate LOGJAM, LUCKY13, session ticket hijack, SSL strip, cert MITM, and RC4 JWT forgery against deliberate nginx 1.18 misconfig.
news
Unauthenticated User-Agent POI stored in audit log; WP_HTML_Token gadget deserializes on admin dashboard view — blind RCE, CVSS 9.8.
news
Sploitus-indexed flaw in is_mainwp_authenticated() lets unauthenticated attackers impersonate admins with any Basic Auth password.
news
Sploitus-indexed PoC analysis chains unauthenticated WebDialer SSRF through Axis internals to arbitrary file write and RCE.
news
Sploitus-indexed local flaw: Cowork trusts rootfs.img existence/version without hash or signature, enabling VM persistence.
news
Sploitus-indexed authenticated PoC uploads PHP via /admin/tinymce/upload to public storage for www-data execution.
news
Pre-auth ZIP upload to com_sppagebuilder iconfont path enables .PHP execution via .htaccess bypass; CVSS 10.0.
news
Unchecked resend loop in BIND 9 bad-server handling enables remote resource exhaustion; defensive notes indexed on Sploitus.
news
ek0ms savi0r publishes REAPER on Church of Malware git — Go-based GitHub hidden secret scanner.
news
Authentication bypass in GitLab WebAuthn 2FA due to inconsistent input validation; advisory indexed on exploit search engines.
news
Sec-Fetch-Mode: no-cors misclassified as same-origin bypasses XSRF on /hub/spawn and /hub/accept-share; PoC indexed on Sploitus.
news
kit-exploits-prv indexes a curated private PoC collection for authorized security testing.
news
Researcher identifies ~10,000 GitHub repos cloning legitimate projects and pushing trojanized README zip archives.
news
Remote code execution in NGINX Open Source 1.31.0–1.31.1 when HTTP/3 QUIC is enabled; patched in 1.31.2.
news
Popa Android TV box botnet (~1.5–2.5M daily IPs) linked to publicly-traded Israeli firm Alarum/NetNut.
news
mastercodeon publishes Peercord on Church of Malware git — decentralized Discord-like social platform.
news
FortiBleed data leak exposes Fortinet VPN credentials for approximately 73,000 devices.
news
140+ @mastra packages hijacked via dormant maintainer account; typosquat easy-day-js drops cross-platform stealer.
news
Kaspersky finds dozens of trojanized Wallpaper Engine app wallpapers on Steam Workshop with tens of thousands of downloads.
news
Network of 152 Chrome live wallpaper extensions faked web traffic and AdSense clicks; 105,000+ combined installs.
news
Modified Mirai strain scanning telnet with updated credentials and DGA C2.
news
Sploitus-indexed PoC shows object-token newline in shell-quote quote() becomes POSIX command separator; fix in 1.8.4.
news
Unauthenticated stored XSS in Bookly ≤27.2 via bookly-customer-full-name cookie; scanner PoC indexed on Sploitus.
news
Single-connection HPACK bomb plus flow-control stall can exhaust gigabytes of RAM; public PoC indexed on Sploitus.
news
Sploitus-indexed PoC abuses fusion_get_widget_markup AJAX with leaked nonce to call_user_func arbitrary PHP functions.
news
Sploitus-indexed PoC chains SSRF via PSIGW HttpListeningConnector into cloud credential theft and remote code execution.
news
Sploitus-indexed PoCs chain unauthenticated JCE profile import to PHP execution in Joomla tmp/; CVSS 10.0.
news
MSNightmare PoC plants unattend.xml and Recovery artifacts on the WinRE partition — Shift+Restart into Defender offline-scan state spawns a shell with BitLocker volume access; no CVE, contested reproduction.
news
June Patch Tuesday addresses 67 CVEs including 3 actively exploited zero-days.
news
MSNightmare PoC races Defender's quarantine pipeline via NTFS junctions and oplocks to reach NT AUTHORITY\SYSTEM — no CVE, no patch, reproduced on fully patched Win11.
news
Nightmare-Eclipse weaponizes James Forshaw's 2020 cldflt!HsmOsBlockPlaceholderAccess bug — original Project Zero PoC works unchanged on fully patched Win11; race to SYSTEM shell.
news
Sploitus mass-scanner PoCs abuse wpgmp_temp_access_ajax with public fc-call-nonce to create administrator accounts.
news
18-year-old rewrite-module desync enables pre-auth RCE; depthfirst PoC indexed on Sploitus with Docker lab and exploit modes.
news
Nightmare-Eclipse PoC replays FsTx transactions in WinRE via USB/EFI staging — CTRL during recovery reboot spawns shell with BitLocker volume access; patched June 2026.
news
Nightmare-Eclipse PoC races Winlogon desktop switch to redirect CTF.AsmListCache section creation via Object Manager symlinks — stripped PoC, full SYSTEM chain left as CTF challenge.
news
Nightmare-Eclipse standard-user PoC locks Defender signature/engine files — passive mode blocks updates, aggressive mode can disable the engine on platform updates; CISA KEV.
news
Nightmare-Eclipse PoC abuses Defender's cloud-tagged file restore path to write TieringEngineService.exe into System32 as SYSTEM — CISA KEV, patched May 2026 OOB.
news
Nightmare-Eclipse PoC races MpSigStub.exe signature updates via oplocks and NTFS junctions to duplicate SAM/SYSTEM hives as SYSTEM — CISA KEV, patched April 2026.
news
Critical CVSS 10.0 RCE in react-server-dom-webpack affects React 19 and Next.js App Router; public PoC scanner indexed on Sploitus.