sunfish-admin/AXP-Resurection
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

009: Polish bacon fixes, OTA host scripts, and migration docs.

Browse Source 
Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
sunfish-adminandCursor committed 2026-10-16 21:06:45 +02:00
1 parent 3f941e8451
commit 2d145c2878
3193 files changed
+21264 -371
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/public/AXP-Resurrection-Pro-sunfish.md
+436
View File
@@ -0,0 +1,436 @@
# AXP Resurrection Pro — Pixel 4a (sunfish)
**LineageOS 23.2 · Android 16 · Privacy-oriented custom ROM**
AXP Resurrection Pro (*AXPR*) brings the **AXP.OS Pro** experience forward onto
**LineageOS 23.2** for the **Google Pixel 4a**. It is aimed at users who want a
maintained Android 16 base, **microG** instead of proprietary Google Play
services, optional **root via Magisk**, and **extra kernel and system
hardening** drawn from established community sources (including
**GrapheneOS-class** kernel work), without tying you to deprecated AXP update
servers.
This document describes **what the ROM contains**. It is written for end users
and reviewers, not for build infrastructure.
**Current generation (example build id):** `23.2-20261008` · `BP4A.251205.006`
· `release-keys`
---
## 1. At a glance
| Topic | What you get |
|--------|----------------|
| **Base** | LineageOS **23.2**, Android **16**, Pixel 4a only |
| **Google services** | **microG** + **GSF proxy**; no built-in Google account requirement |
| **Play Store** | **Play Store (Phonesky)** build patched for this project (exact-alarm and related fixes) |
| **Root** | **Magisk** embedded at build time; you activate from the Magisk app after flash |
| **Privacy apps** | **Aurora Store**, **Droidify**, **Fossify Gallery**, **Jelly** browser, **OpenEUICC** |
| **Hardening** | Kernel patches (Graphene-derived + CVE backports), **hardened_malloc**, trimmed system surface |
| **Updates** | Full ROM via **recovery sideload**; individual system apps can be updated in place when signed compatibly |
| **Bootloader** | **Unlocked** workflow (orange state); not designed for relocked retail boot |
---
## 2. Everything added on top of LineageOS 23.2
Stock **LineageOS 23.2 for sunfish** is a clean AOSP-derived system: no microG,
no Play Store, no Magisk, **test-keys** or UNOFFICIAL builds in typical user
trees, default Private DNS list, default connectivity check (Google), Gallery2
or Glimpse, full Lineage tool bundle on system, Google carrier/eUICC apps from
vendor makefiles, and the upstream **4.14** kernel without the AXP/Graphene
CVE and hardening layers below.
**AXP Resurrection Pro** keeps the Lineage base (Launcher3, Dialer, updaters,
device support) and layers the following.
### 2.1 Product identity and visuals
| Change | LineageOS default | AXPR |
|--------|-------------------|------|
| Build channel | Often UNOFFICIAL / nightly naming | **PRO** product (`…-PRO-sunfish`) |
| Signing | Test-keys on many community builds | **release-keys** (project keys) |
| Manufacturer / brand props | Lineage | **AXP Resurrection** system branding |
| Setup welcome | Lineage wording | **“Welcome to AXP Resurrection”** |
| Boot animation | Narrow band layout | **Full-screen** 1080×2340 animation |
| OTA zip name | `lineage-*.zip` | Matching **`AXP-Resurrection-Pro-*.zip`** (same payload) |
### 2.2 Google replacement stack (not in vanilla LOS)
| Component | Purpose |
|-----------|---------|
| **microG Services (GmsCore)** | Open-source reimplementation of Play Services |
| **GSF Proxy** | Framework stub for apps expecting Google Services Framework |
| **Play Store (Phonesky)** | Play client build maintained for this ROM (exact-alarm and related fixes) |
| **GmsCore native libraries** | ARM64 JNI libs shipped **inside the image** (required for Maps / TLS stacks) |
Vanilla Lineage does **not** ship these; you would install microG yourself on a
separate track.
### 2.3 Extra applications (vs typical LOS sunfish)
| App | Notes |
|-----|--------|
| **Aurora Store** | Play store front-end |
| **Droidify** | F-Droid client (instead of shipping classic F-Droid) |
| **Fossify Gallery** | Replaces **Gallery2 / Glimpse** on this product |
| **Jelly** | Lightweight browser added on **product** (Lineage 23 does not include Jelly in the default sunfish product set) |
| **OpenEUICC** | Privileged eSIM manager where Google EUICC is removed |
| **Magisk** | Preroot boot integration + manager (see §5 Root and Magisk) |
**Unchanged vs LOS intent:** **Launcher3** (no NeoLauncher), standard Lineage
core apps, **Lineage WebView** as default provider.
### 2.4 Settings and framework behaviour (AXP / GrapheneOS / Calyx class)
These are **code changes in the platform**, not separate APKs.
#### Privacy and network
| Feature | What Lineage does | What AXPR adds |
|---------|-------------------|----------------|
| **Private DNS presets** | Small default set | **15+ named providers** (AdGuard, Mullvad, Quad9, Cloudflare, regional DoT hosts, etc.) |
| **Internet connectivity check** | Fixed Google-style check | **User-selectable** provider (Disabled, Amazon, Cloudflare, Google, Huawei, Kuketz, Microsoft, openSUSE, Ubuntu, …) — no AXP-owned servers |
| **Force disable SUPL** | Not exposed | Settings toggle; forces SUPL off for stricter GNSS |
| **Stop extra location assistance** | Not exposed | Toggle to stop extra Qualcomm / XTRA-style assistance when disabled |
| **Kernel command line privacy** | `/proc/cmdline` often world-readable | **Mode 0440** on `/proc/cmdline` for unprivileged apps (GOLDEN/AXP class) |
#### Security, biometrics, and media metadata
| Feature | What Lineage does | What AXPR adds |
|---------|-------------------|----------------|
| **Fingerprint permanent lockout** | Higher failed-attempt threshold | **Stricter lockout** (AXP constant: fewer attempts before permanent lockout) |
| **Build serial exposure** | Legacy paths may expose serial via deprecated APIs | **`Build.SERIAL` stays unknown**; real serial only via `Build.getSerial()` + permission |
| **Screenshot EXIF** | OS name, time, unique id in metadata | **Minimal EXIF** (width/height only — Calyx/AXP class) |
| **Recovery OTA metadata** | Can accept packages restricted to device serial | **Rejects** update packages that carry a `serialno=` constraint |
| **Signature spoofing** | microG base only | Developer option **`allow_signature_fake`** (default **off**) for microG / compatible apps |
| **Call recording** | Region/carrier gated | Developer option **`extendrom_call_recording`** unlocks recording path in Dialer where supported |
| **FLAG_SECURE / screen capture** | Apps can block capture | Optional **`disable_secure_windows`** (default **off**), works on **user** builds without `ro.debuggable=1` |
| **Disable app** | Android 16 emphasises **Archive**; disable hidden for many user apps | **Disable** restored for **user-installed** apps in Settings |
| **Native debug** | Standard ptrace policy | **`persist.native_debug`** — when enabled, relaxes ptrace scope for debugging (default off) |
#### Timeouts and System UI
| Feature | What Lineage does | What AXPR adds |
|---------|-------------------|----------------|
| **Automatic reboot** | Not in stock LOS Settings | Idle **auto-reboot** (Security settings) |
| **Bluetooth timeout** | Manual only | Turns **Bluetooth off** after configurable inactivity |
| **Wi‑Fi timeout** | Manual only | Turns **Wi‑Fi off** after configurable inactivity |
| **Quick Settings tiles** | Usable from lock screen per tile | **Sensitive tiles require unlock** first (GrapheneOS SystemUI patch) |
| **Keyguard / reboot** | Standard | SystemUI / SystemServer hooks for timeout and reboot integration (AXP server extensions) |
### 2.5 Packages and binaries removed (vs Lineage sunfish)
Selective **deblob**, not a generic “remove all Google” script.
#### Wave 1 — Google eUICC LPA
| Removed | Replaced by |
|---------|-------------|
| **EuiccGoogle**, **EuiccGoogleOverlay** | **OpenEUICC** (EuiccSupportPixel support packages **kept**) |
#### Wave 2 — Carrier / RCS Google & AOSP entitlement
| Removed (examples) | Kept for radio |
|--------------------|----------------|
| **CarrierServices**, **CarrierSettings**, **CarrierWifi**, **CarrierSetup**, **RilConfigService**, **grilservice** | **ims**, **QtiTelephonyService**, Qualcomm daemons, **Dialer**, **GoogleParts** |
| **PresencePolling**, **RcsService** (device makefile) | |
| **ImsServiceEntitlement** (telephony product) | |
#### Wave 3 — Lineage maintenance tools on system
| Removed from system / system_ext | Still on AXPR (AXP parity) |
|----------------------------------|----------------------------|
| **bash**, **htop**, **nano**, **unrar**, **addon.d/50-lineage.sh** | **curl**, **vim**, **zstd**, recovery **nano** |
#### Wave 4 — Debug / diag surface
| Removed | Explicitly kept |
|---------|-----------------|
| Qualcomm **diag_*** tools, **test_diag**, **imsrcsd** | **loc_launcher**, **lowi-server**, **xtra-daemon**, IMS RTP/data daemons, **cnss-daemon**; keep Lineage **disable_configstore** (overrides HIDL configstore HAL — required on A16 VINTF) |
| Some **AOSP debug** host tools on device where safe | **bpftool**, **alloctop**, **apexd-lsof** remain in build where the OS requires them |
#### Product OpenSSH (US-S4-1)
| Removed | Kept |
|---------|------|
| **ssh**, **sshd**, **scp**, **sftp**, **rsync**, **procmem** on product | **`init.openssh.rc`** stub only (no `sshd` binary) — remote admin via **adb** / Magisk |
### 2.6 Kernel, allocator, and CVEs (summary)
On top of the **same msm-4.14** tree Lineage ships:
- **30 GrapheneOS-derived** kernel patches (Deny USB, allocsize, fortify, slab, sanitize, ro_after_init, randomisation, …) — see §8 below.
- Extra **Kconfig**: FORTIFY, init-on-alloc/free, dmesg restrict, slab hardened, **SLAB_FREELIST_RANDOM**; **no Yama** (app compatibility).
- **449** documented **CVE** backport identifiers + companion fixes (e.g. USB lock-scope instead of raw **CVE-2022-49980** one-liner).
- **hardened_malloc** in **bionic** for 64-bit processes (with graphics/camera exclusions).
Lineage’s existing hardening (CFI, shadow stack, KASLR, PAN, …) is **retained**.
### 2.7 Intentionally **not** changed vs Lineage
- **No** GrapheneOS-style **location lockdown** kernel (GPS behaviour stays LOS-like).
- **No** Aosmium / proprietary AXP WebView baked in.
- **No** AXP online OTA or external market repositories.
- **No** KernelSU in the standard product.
- **No** bundled Play Integrity / banking Magisk modules.
- **Device tree / modem firmware** line unchanged (Pixel 4a vendor blobs).
---
## 3. Who this ROM is for
- You use **microG** and install apps via **Aurora** / **Droidify** / Play as you choose.
- You want **AXP-style settings** (private DNS presets, connectivity controls, classic **Disable app**, timeouts, optional signature spoofing and call-recording unlock) on a **current Lineage** tree.
- You accept **custom ROM risks**: unlocked bootloader, community maintenance, no warranty.
**Not goals of this ROM:** banking attestation guarantees, locked bootloader,
proprietary AXP OTA infrastructure, or shipping every Google / carrier app from
stock Pixel firmware.
---
## 4. Preinstalled applications
| App | Role |
|-----|------|
| **microG Services (GmsCore)** | Replaces Google Play Services for many apps |
| **GSF Proxy** | Google Services Framework compatibility layer |
| **Play Store (Phonesky)** | Google Play client (project-maintained APK) |
| **Aurora Store** | Alternative store front-end for Play |
| **Droidify** | Lightweight F-Droid client |
| **Fossify Gallery** | Gallery (replaces Lineage Gallery2 / Glimpse on this product) |
| **Jelly** | Small browser on the product partition |
| **OpenEUICC** | eSIM / EUICC management (replaces Google EUICC where removed) |
| **Magisk** | Root manager (stub until you complete first-time setup) |
| **LineageOS core** | Launcher3, Dialer, Messaging, etc. |
**WebView:** default is **Lineage / AOSP WebView**. You may install another
WebView provider and select it under **Developer options → WebView
implementation** (Aosmium and other legacy AXP WebViews are **not** shipped as
default).
---
## 5. Root and Magisk
- Magisk is integrated into the **boot image at ROM build time** (AXP / EXTENDROM
style **preroot**), not as a normal preinstalled Play-style system app only.
- After flashing, open **Magisk** once and allow it to **download and install**
the current manager APK if prompted.
- **Do not** use “Install to inactive slot” or repeated boot repatching unless
you know you need it: the boot image is already prepared. Extra patching often
confuses the app and can break A/B slots.
- The home screen line **“Ramdisk: Yes/No”** describes how Magisk would install
on a *stock* device; on preroot builds it may read **No** even when root works.
Check **Magisk version** and whether apps can request superuser.
- **Zygisk**, **DenyList**, and modules are **your choice** after activation;
the ROM does not ship banking or Play Integrity fix modules.
**KernelSU** is **not** part of this product line.
---
## 6. Settings and toggles (reference)
Same features as **§2.4**; quick lookup by menu area.
These appear in **Settings** / **Developer options** (exact menus follow AOSP
Lineage layout). Names may be localized.
### 6.1 Privacy and network
| Feature | What it does |
|---------|----------------|
| **Private DNS providers** | Extended preset list (AdGuard, Mullvad, Quad9, Cloudflare, Google DoT, regional providers, etc.) in addition to Lineage defaults |
| **Internet connectivity check** | Configurable connectivity validation (AXP-style behaviour; no dependency on AXP-owned servers) |
| **Force disable SUPL** | When enabled, disables SUPL-assisted GNSS (stricter location privacy) |
| **Stop extra location assistance** | When enabled, reduces extra Qualcomm / XTRA-style assistance daemons |
### 6.2 Security and developer
| Feature | What it does |
|---------|----------------|
| **Signature spoofing** | Developer option to allow microG / selected apps to spoof signatures (restricted API) |
| **Call recording unlock** | Toggle to allow call recording where supported (AXP / EXTENDROM class) |
| **FLAG_SECURE override** | Optional global override for screen capture blocking (default **off**) |
| **Native debug / ptrace** | `persist.native_debug` — when enabled, relaxes ptrace scope for debugging (default off) |
| **Disable app** | Classic **disable** for user apps restored alongside Android’s archive behaviour |
### 6.3 Timeouts (Security / connected devices)
| Feature | What it does |
|---------|----------------|
| **Automatic reboot** | Reboot after configurable idle time |
| **Bluetooth timeout** | Turn off Bluetooth after inactivity |
| **Wi‑Fi timeout** | Turn off Wi‑Fi after inactivity |
### 6.4 Branding
- **Build type:** Lineage **PRO** channel naming (`AXP Resurrection Pro` product)
- **Release keys** (not `test-keys`) on shipped builds
---
## 7. System surface changes (deblob summary)
Full package-level detail is in **§2.5**. Short overview:
AXP Resurrection Pro **selectively removes** components that AXP Pro omitted or
that are unnecessary on a microG device. This is **not** a blind “remove
everything Google” script.
**Typical removals (by category):**
| Category | Examples of what is removed or not shipped |
|----------|---------------------------------------------|
| **Google EUICC / LPA** | Google’s eUICC app (OpenEUICC replaces user-facing LPA) |
| **Carrier / RCS Google** | Selected Google carrier and RCS packages not needed for microG |
| **Lineage maintenance tools on device** | Interactive shells and convenience packages on **system** that AXP Pro did not ship (e.g. `bash`, `htop`, `nano`, `unrar`, Lineage `addon.d` helper) |
| **Lab / debug commands** | Further debug-only binaries trimmed in the full “wave 4” product |
**Retained (examples):** IMS, telephony services, Wi‑Fi / cellular stack,
Widevine, camera, Qualcomm services required for daily use, `curl` / `vim` where
AXP Pro kept them.
**Product partition:** OpenSSH **binaries** are not shipped; an **`init.openssh.rc`
stub** may remain (AXP Pro parity) without shipping `sshd` on product.
---
## 8. Kernel and memory hardening
**Kernel version line:** Linux **4.14** (Qualcomm msm-4.14), as shipped by
Lineage for Pixel 4a — **not** upgraded to a GKI 6.x kernel.
### 7.1 Already strong on Lineage (kept)
Examples: Clang CFI, shadow call stack, stack protector, KASLR, PAN, hardened
usercopy, restricted perf events, and related options in the upstream sunfish
defconfig.
### 7.2 GrapheneOS-derived Stage 1 pack (30 patches)
Backported **GrapheneOS / Android Hardening** series via the AXP kernel patch
collection, including:
| Series | Purpose (summary) |
|--------|-------------------|
| **Deny USB** | Optional hardening around USB attack surface |
| **allocsize** | Allocation size hardening helpers |
| **bugon** | `ksize` / BUG_ON integrity checks |
| **fortify** | Intra-object FORTIFY helpers in kernel |
| **misc** | Miscellaneous hardening commits |
| **random** | Brk / argument randomization |
| **ro** | `__ro_after_init` and related read-only data hardening |
| **sanitize** | Page / slab sanitization helpers |
| **slab** | SLAB hardening companions |
| **unused** | Removal of unused kernel API noise |
**Kernel config enabled with this stack (examples):**
- `CONFIG_FORTIFY_SOURCE`
- `CONFIG_INIT_ON_ALLOC_DEFAULT_ON` / `CONFIG_INIT_ON_FREE_DEFAULT_ON`
- `CONFIG_SECURITY_DMESG_RESTRICT`
- `CONFIG_SLAB_HARDENED`
- `CONFIG_SLAB_FREELIST_RANDOM` (US-S5-1 class)
- **Yama LSM not enabled** (compat with apps using self-ptrace; matches classic AXP kernel posture)
**Not ported:** GrapheneOS **location lockdown** kernel policy (this ROM keeps
Lineage-style location behaviour and precision).
### 7.3 Userspace allocator
- **hardened_malloc** (64-bit) integrated into **bionic** for eligible processes,
with exclusions for graphics / camera stacks where required for stability.
### 7.4 CVE backports
The ROM applies a large set of **Linux kernel CVE backports** on top of the
4.14 sunfish kernel, from the same curated lists used in AXP / Divest-style
trees:
| Set | Count | Notes |
|-----|-------|--------|
| **Primary backport set** | **429** patch entries | Stable “clean offset” apply list |
| **High-offset batches 1–3** | **27** extra patch entries | Larger backports with relaxed offset matching |
| **Unique CVE identifiers (combined)** | **449** | Deduplicated ids in the list file below |
**Full CVE identifier list:** [`kernel-cve-backport-list.txt`](kernel-cve-backport-list.txt)
(one CVE id per line, sorted).
**Special cases (not in the 449 list as-is):**
- **CVE-2022-49980** — raw one-liner backport is **denied**; a **lock-scope /
UAF companion patch** is applied instead (USB subsystem stability).
- Additional CVE paths may appear on a **denylist** when they conflict with
sunfish drivers (Wi‑Fi, audio, etc.); those are skipped intentionally.
Platform **Android security patch** level follows **LineageOS merges** (e.g.
`2026-09-01` on recent builds). **Vendor** (bootloader/modem) patch level
remains on the **2023-09-05** line appropriate for Pixel 4a vendor blobs.
---
## 9. Verified Boot and signing
- Builds are signed with **project release keys** (`release-keys`).
- **AVB** metadata uses the project key; **verification flags** suit an
**unlocked** bootloader with Magisk (not a locked retail verified-boot product).
- **Do not** downgrade vendor security patch below the ROM’s minimum without
expecting install blocks or encryption init failures.
---
## 10. Installation (summary)
1. **Unlock bootloader** (erases data).
2. Flash **boot** + **dtbo** from the **same** ROM package if you are not already
on this ROM’s recovery (Pixel 4a uses recovery-in-boot).
3. Boot **recovery** → **Factory reset / format data**.
4. **Apply update → ADB sideload** the full `AXP-Resurrection-Pro-*.zip`.
5. Reboot, complete setup, then **Magisk** first-time APK install as above.
Use the **full OTA zip**; flashing only `boot.img` does not update system,
microG, or apps.
---
## 11. What this ROM does **not** promise
- No official Google certification or Play Protect “device integrity” guarantee.
- No bundled **Play Integrity Fix** or banking modules.
- No **AXP.OS** online update servers or external market repositories.
- No **NeoLauncher** (Lineage Launcher3 remains).
- No **KernelSU** in the standard build.
- **Banking apps** may work in work profiles or Island; that is **app-specific**
and not a ship guarantee.
---
## 12. Credits and lineage
- **LineageOS** — base operating system and device support.
- **microG project** — free Google services reimplementation.
- **Magisk** (topjohnwu) — root framework.
- **AXP.OS / EXTENDROM** — product philosophy, preroot Magisk packaging, and
many userspace behaviours cloned on this port.
- **GrapheneOS / Android Hardening** — kernel patch series (via AXP kernel
patch collection).
- **Community apps:** Aurora, Droidify, Fossify, OpenEUICC, Jelly, etc.
AXP Resurrection Pro is an **independent community port**. It is not an official
LineageOS, Google, or AXP.OS GmbH product.
---
## 13. Document history
| Version | Date | Notes |
|---------|------|--------|
| 1.1 | 2026-10-11 | Added **§2** delta vs LineageOS (features, removals, framework) |
| 1.0 | 2026-10-11 | Initial public feature list for `23.2-20261008` generation |
For maintainers: internal engineering docs remain separate under `docs/` in the
source repository.
docs/public/kernel-cve-backport-list.txt
+449
View File
@@ -0,0 +1,449 @@
CVE-2015-7837
CVE-2016-3695
CVE-2017-18232
CVE-2017-5754
CVE-2018-20855
CVE-2018-5897
CVE-2018-9415
CVE-2019-10520
CVE-2019-11191
CVE-2019-12378
CVE-2019-12455
CVE-2019-12456
CVE-2019-12819
CVE-2019-15291
CVE-2019-16921
CVE-2019-18786
CVE-2019-19051
CVE-2019-19068
CVE-2019-19602
CVE-2019-20908
CVE-2019-3874
CVE-2019-9444
CVE-2020-0255
CVE-2020-15780
CVE-2020-16119
CVE-2020-29372
CVE-2020-8832
CVE-2020-BleedingToothExtras
CVE-2021-28039
CVE-2021-28950
CVE-2021-29154
CVE-2021-30337
CVE-2021-3493
CVE-2021-46912
CVE-2021-46958
CVE-2021-46999
CVE-2021-47010
CVE-2021-47058
CVE-2021-47173
CVE-2021-47209
CVE-2021-47234
CVE-2021-47266
CVE-2021-47299
CVE-2021-47346
CVE-2021-47430
CVE-2021-47472
CVE-2021-47583
CVE-2021-47616
CVE-2021-47618
CVE-2021-47636
CVE-2022-21546
CVE-2022-27950
CVE-2022-3061
CVE-2022-3903
CVE-2022-4382
CVE-2022-48674
CVE-2022-48713
CVE-2022-48781
CVE-2022-48785
CVE-2022-48966
CVE-2022-49034
CVE-2022-49061
CVE-2022-49073
CVE-2022-49078
CVE-2022-49146
CVE-2022-49194
CVE-2022-49205
CVE-2022-49209
CVE-2022-49285
CVE-2022-49318
CVE-2022-49341
CVE-2022-49363
CVE-2022-49364
CVE-2022-49380
CVE-2022-49412
CVE-2022-49425
CVE-2022-49428
CVE-2022-49433
CVE-2022-49500
CVE-2022-49513
CVE-2022-49563
CVE-2022-49564
CVE-2022-49566
CVE-2022-49641
CVE-2022-49642
CVE-2022-49705
CVE-2022-49710
CVE-2022-49777
CVE-2022-49779
CVE-2022-49784
CVE-2022-49823
CVE-2022-49824
CVE-2022-49825
CVE-2022-49839
CVE-2022-49863
CVE-2022-49990
CVE-2022-49993
CVE-2022-50013
CVE-2022-50062
CVE-2022-50074
CVE-2022-50246
CVE-2022-50248
CVE-2022-50273
CVE-2022-50326
CVE-2022-50358
CVE-2022-50364
CVE-2022-50397
CVE-2022-50473
CVE-2022-50522
CVE-2022-50537
CVE-2023-1989
CVE-2023-21657
CVE-2023-23000
CVE-2023-28554
CVE-2023-33070
CVE-2023-3777
CVE-2023-52523
CVE-2023-52595
CVE-2023-52604
CVE-2023-52676
CVE-2023-52707
CVE-2023-52746
CVE-2023-52884
CVE-2023-52979
CVE-2023-53001
CVE-2023-53016
CVE-2023-53098
CVE-2023-53125
CVE-2023-53129
CVE-2023-53131
CVE-2023-53137
CVE-2023-53214
CVE-2023-53227
CVE-2023-53250
CVE-2023-53259
CVE-2023-53265
CVE-2023-53288
CVE-2023-53312
CVE-2023-53436
CVE-2023-53443
CVE-2023-53487
CVE-2023-53537
CVE-2023-53594
CVE-2023-53599
CVE-2023-53626
CVE-2023-53641
CVE-2023-53669
CVE-2023-53693
CVE-2023-53695
CVE-2023-53709
CVE-2023-53712
CVE-2023-53719
CVE-2024-26643
CVE-2024-26645
CVE-2024-26720
CVE-2024-26760
CVE-2024-26920
CVE-2024-26961
CVE-2024-26972
CVE-2024-27009
CVE-2024-27033
CVE-2024-27393
CVE-2024-33032
CVE-2024-34027
CVE-2024-35812
CVE-2024-35824
CVE-2024-35879
CVE-2024-35933
CVE-2024-35950
CVE-2024-35954
CVE-2024-35962
CVE-2024-39501
CVE-2024-40917
CVE-2024-40954
CVE-2024-40996
CVE-2024-41041
CVE-2024-42077
CVE-2024-42102
CVE-2024-42296
CVE-2024-43879
CVE-2024-43894
CVE-2024-44938
CVE-2024-44939
CVE-2024-44952
CVE-2024-46681
CVE-2024-46754
CVE-2024-47747
CVE-2024-50017
CVE-2024-50019
CVE-2024-50184
CVE-2024-50186
CVE-2024-50195
CVE-2024-50201
CVE-2024-50210
CVE-2024-50265
CVE-2024-50267
CVE-2024-50269
CVE-2024-50279
CVE-2024-50287
CVE-2024-50290
CVE-2024-50292
CVE-2024-50295
CVE-2024-50299
CVE-2024-50301
CVE-2024-52332
CVE-2024-53045
CVE-2024-53101
CVE-2024-53103
CVE-2024-53112
CVE-2024-53127
CVE-2024-53140
CVE-2024-53141
CVE-2024-53156
CVE-2024-53157
CVE-2024-53165
CVE-2024-53171
CVE-2024-53172
CVE-2024-53183
CVE-2024-53190
CVE-2024-53194
CVE-2024-53214
CVE-2024-53227
CVE-2024-53239
CVE-2024-53680
CVE-2024-53690
CVE-2024-56531
CVE-2024-56532
CVE-2024-56536
CVE-2024-56539
CVE-2024-56548
CVE-2024-56569
CVE-2024-56570
CVE-2024-56586
CVE-2024-56587
CVE-2024-56593
CVE-2024-56595
CVE-2024-56597
CVE-2024-56600
CVE-2024-56602
CVE-2024-56603
CVE-2024-56619
CVE-2024-56629
CVE-2024-56637
CVE-2024-56643
CVE-2024-56659
CVE-2024-56670
CVE-2024-56681
CVE-2024-56687
CVE-2024-56700
CVE-2024-56739
CVE-2024-56747
CVE-2024-56767
CVE-2024-56769
CVE-2024-57802
CVE-2024-57850
CVE-2024-57893
CVE-2024-57901
CVE-2024-57902
CVE-2024-57904
CVE-2024-57908
CVE-2024-57912
CVE-2024-57929
CVE-2024-57938
CVE-2024-57948
CVE-2024-57973
CVE-2024-58001
CVE-2024-58010
CVE-2024-58055
CVE-2024-58094
CVE-2024-58095
CVE-2025-21664
CVE-2025-21689
CVE-2025-21699
CVE-2025-21704
CVE-2025-21718
CVE-2025-21735
CVE-2025-21736
CVE-2025-21744
CVE-2025-21772
CVE-2025-21776
CVE-2025-21781
CVE-2025-21782
CVE-2025-21785
CVE-2025-21791
CVE-2025-21835
CVE-2025-21877
CVE-2025-21904
CVE-2025-21909
CVE-2025-21910
CVE-2025-21916
CVE-2025-21928
CVE-2025-21934
CVE-2025-21935
CVE-2025-21948
CVE-2025-21993
CVE-2025-21996
CVE-2025-22007
CVE-2025-22018
CVE-2025-22063
CVE-2025-22073
CVE-2025-22079
CVE-2025-22086
CVE-2025-23150
CVE-2025-23163
CVE-2025-37738
CVE-2025-37739
CVE-2025-37740
CVE-2025-37741
CVE-2025-37749
CVE-2025-37757
CVE-2025-37758
CVE-2025-37780
CVE-2025-37781
CVE-2025-37782
CVE-2025-37796
CVE-2025-37797
CVE-2025-37798
CVE-2025-37817
CVE-2025-37823
CVE-2025-37825
CVE-2025-37833
CVE-2025-37838
CVE-2025-37841
CVE-2025-37851
CVE-2025-37857
CVE-2025-37858
CVE-2025-37892
CVE-2025-37923
CVE-2025-37925
CVE-2025-37937
CVE-2025-37982
CVE-2025-37983
CVE-2025-37990
CVE-2025-38046
CVE-2025-38058
CVE-2025-38061
CVE-2025-38066
CVE-2025-38075
CVE-2025-38090
CVE-2025-38114
CVE-2025-38115
CVE-2025-38147
CVE-2025-38157
CVE-2025-38163
CVE-2025-38174
CVE-2025-38177
CVE-2025-38180
CVE-2025-38181
CVE-2025-38184
CVE-2025-38185
CVE-2025-38190
CVE-2025-38194
CVE-2025-38203
CVE-2025-38212
CVE-2025-38213
CVE-2025-38218
CVE-2025-38219
CVE-2025-38222
CVE-2025-38245
CVE-2025-38251
CVE-2025-38265
CVE-2025-38285
CVE-2025-38312
CVE-2025-38320
CVE-2025-38324
CVE-2025-38328
CVE-2025-38336
CVE-2025-38344
CVE-2025-38345
CVE-2025-38348
CVE-2025-38386
CVE-2025-38403
CVE-2025-38406
CVE-2025-38416
CVE-2025-38420
CVE-2025-38428
CVE-2025-38445
CVE-2025-38448
CVE-2025-38458
CVE-2025-38459
CVE-2025-38460
CVE-2025-38467
CVE-2025-38468
CVE-2025-38470
CVE-2025-38474
CVE-2025-38513
CVE-2025-38514
CVE-2025-38538
CVE-2025-38542
CVE-2025-38544
CVE-2025-38546
CVE-2025-38555
CVE-2025-38574
CVE-2025-38578
CVE-2025-38581
CVE-2025-38604
CVE-2025-38611
CVE-2025-38612
CVE-2025-38618
CVE-2025-38639
CVE-2025-38691
CVE-2025-38693
CVE-2025-38694
CVE-2025-38697
CVE-2025-38698
CVE-2025-38699
CVE-2025-38701
CVE-2025-38708
CVE-2025-38712
CVE-2025-38713
CVE-2025-38717
CVE-2025-39676
CVE-2025-39691
CVE-2025-39710
CVE-2025-39714
CVE-2025-39743
CVE-2025-39751
CVE-2025-39756
CVE-2025-39782
CVE-2025-39794
CVE-2025-39796
CVE-2025-39808
CVE-2025-39812
CVE-2025-39817
CVE-2025-39839
CVE-2025-39846
CVE-2025-39848
CVE-2025-39885
CVE-2025-39889
CVE-2025-39898
CVE-2025-39903
CVE-2025-39913
CVE-2025-39920
CVE-2025-39945
CVE-2025-39964
CVE-2025-39967
CVE-2025-39973
CVE-2025-39996
CVE-2025-40011
CVE-2025-40020
CVE-2025-40022
CVE-2025-40028
CVE-2025-40030
CVE-2025-40035
CVE-2025-40044
CVE-2025-40049
CVE-2025-40055
CVE-2025-40078
CVE-2025-40082