{ "generated_at": "2026-09-05T16:05:35Z", "source_health": { "healthy": 8, "total": 8, "sources": { "nvd": true, "cisa": true, "exploitdb": true, "poc_in_github": true, "cxsecurity": true, "sploitus": true, "cve_intel": true, "github": true } }, "is_demo": false, "entries": [ { "id": "CVE-2026-86197", "vendor": "getgrav", "product": "grav", "title": "grav vulnerability", "summary": "Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\\Common\\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.", "updated_at": "2026-09-05T13:18:15.110", "published_at": "2026-09-05T13:18:15.110", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 2.0.20 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\\Common\\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/getgrav/grav/security/advisories/GHSA-8hgv-xc77-jmcr", "https://www.vulncheck.com/advisories/grav-before-2.0.20-cross-site-scripting-via-assets-sandbox" ], "timeline": [ { "at": "2026-09-05T13:18:15.110", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86197" } ] }, { "id": "CVE-2026-86196", "vendor": "getgrav", "product": "grav-plugin-api", "title": "grav-plugin-api vulnerability", "summary": "Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.", "updated_at": "2026-09-05T13:18:14.980", "published_at": "2026-09-05T13:18:14.980", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 1.0.20 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-290", "what_happened": "Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/getgrav/grav/security/advisories/GHSA-262p-56vv-7v5r", "https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.20-authentication-bypass-via-host-header" ], "timeline": [ { "at": "2026-09-05T13:18:14.980", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86196" } ] }, { "id": "CVE-2026-86195", "vendor": "getgrav", "product": "grav-plugin-api", "title": "grav-plugin-api vulnerability", "summary": "grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write permissions can create an invitation with a dot-keyed super flag in the access payload that bypasses the guard and persists to the new account. Attackers can accept the invitation through the public endpoint without real invitee interaction to create a super-admin account and immediately receive a valid JWT for full site control.", "updated_at": "2026-09-05T13:18:14.853", "published_at": "2026-09-05T13:18:14.853", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 1.0.20 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-269", "what_happened": "grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write permissions can create an invitation with a dot-keyed super flag in the access payload that bypasses the guard and persists to the new account. Attackers can accept the invitation through the public endpoint without real invitee interaction to create a super-admin account and immediately receive a valid JWT for full site control.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/getgrav/grav/security/advisories/GHSA-m363-3hww-gcwc", "https://www.vulncheck.com/advisories/grav-plugin-api-1.0.0-through-1.0.19-privilege-escalation-via-dot-keyed-super-flag" ], "timeline": [ { "at": "2026-09-05T13:18:14.853", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86195" } ] }, { "id": "CVE-2026-86194", "vendor": "getgrav", "product": "grav-plugin-form", "title": "grav-plugin-form vulnerability", "summary": "Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.", "updated_at": "2026-09-05T13:18:14.727", "published_at": "2026-09-05T13:18:14.727", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 9.1.22 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/getgrav/grav/security/advisories/GHSA-33m4-m988-5fvh", "https://www.vulncheck.com/advisories/grav-form-plugin-before-9.1.22-cross-page-form-execution" ], "timeline": [ { "at": "2026-09-05T13:18:14.727", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86194" } ] }, { "id": "CVE-2026-86193", "vendor": "getgrav", "product": "grav-plugin-api", "title": "grav-plugin-api vulnerability", "summary": "grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.", "updated_at": "2026-09-05T13:18:14.593", "published_at": "2026-09-05T13:18:14.593", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 1.0.20 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-863", "what_happened": "grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/getgrav/grav/security/advisories/GHSA-vv8m-jqpm-38x4", "https://www.vulncheck.com/advisories/grav-api-plugin-authentication-bypass-via-group-inherited-super" ], "timeline": [ { "at": "2026-09-05T13:18:14.593", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86193" } ] }, { "id": "CVE-2026-86192", "vendor": "siyuan-note", "product": "siyuan", "title": "siyuan vulnerability", "summary": "SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.", "updated_at": "2026-09-05T13:18:14.443", "published_at": "2026-09-05T13:18:14.443", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 3.8.2 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vc7j-5f5p-3x75", "https://www.vulncheck.com/advisories/siyuan-before-3.8.2-information-disclosure-via-attribute-view" ], "timeline": [ { "at": "2026-09-05T13:18:14.443", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86192" } ] }, { "id": "CVE-2026-86191", "vendor": "siyuan-note", "product": "siyuan", "title": "siyuan vulnerability", "summary": "SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.", "updated_at": "2026-09-05T13:18:14.300", "published_at": "2026-09-05T13:18:14.300", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 3.8.2 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4qq-w6qx-6839", "https://www.vulncheck.com/advisories/siyuan-before-3.8.2-private-attribute-view-key-enumeration" ], "timeline": [ { "at": "2026-09-05T13:18:14.300", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86191" } ] }, { "id": "CVE-2026-86190", "vendor": "WWBN", "product": "AVideo", "title": "AVideo vulnerability", "summary": "WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.", "updated_at": "2026-09-05T13:18:14.150", "published_at": "2026-09-05T13:18:14.150", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 29.0 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-200", "what_happened": "WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/WWBN/AVideo/security/advisories/GHSA-82q2-88mq-p44q", "https://www.vulncheck.com/advisories/wwbn-avideo-broken-access-control-via-videoviewsinfo-hash-parameter" ], "timeline": [ { "at": "2026-09-05T13:18:14.150", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86190" } ] }, { "id": "CVE-2026-86189", "vendor": "WWBN", "product": "AVideo", "title": "AVideo vulnerability", "summary": "WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.", "updated_at": "2026-09-05T13:18:14.000", "published_at": "2026-09-05T13:18:14.000", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 29.0 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-73", "what_happened": "WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/WWBN/AVideo/security/advisories/GHSA-cprx-fggj-7vpq", "https://www.vulncheck.com/advisories/wwbn-avideo-unauthenticated-path-traversal-via-notify-ffmpeg-json-php" ], "timeline": [ { "at": "2026-09-05T13:18:14.000", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86189" } ] }, { "id": "CVE-2026-86188", "vendor": "WWBN", "product": "AVideo", "title": "AVideo vulnerability", "summary": "AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.", "updated_at": "2026-09-05T13:18:13.843", "published_at": "2026-09-05T13:18:13.843", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 29.0 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/WWBN/AVideo/security/advisories/GHSA-xpx7-h2x7-59qq", "https://www.vulncheck.com/advisories/avideo-yptsocket-plugin-unauthenticated-cross-site-scripting" ], "timeline": [ { "at": "2026-09-05T13:18:13.843", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86188" } ] }, { "id": "CVE-2026-86187", "vendor": "WWBN", "product": "AVideo", "title": "AVideo vulnerability", "summary": "WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing.", "updated_at": "2026-09-05T13:18:13.703", "published_at": "2026-09-05T13:18:13.703", "cvss": 7.4, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 29.0 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "High", "cwe": "CWE-330", "what_happened": "WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/WWBN/AVideo/security/advisories/GHSA-h3ff-c2qq-pr2g", "https://www.vulncheck.com/advisories/wwbn-avideo-weak-prng-password-generation-via-external-login" ], "timeline": [ { "at": "2026-09-05T13:18:13.703", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86187" } ] }, { "id": "CVE-2026-86186", "vendor": "WWBN", "product": "AVideo", "title": "AVideo vulnerability", "summary": "AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing attempts against any account from a single IP address.", "updated_at": "2026-09-05T13:18:13.560", "published_at": "2026-09-05T13:18:13.560", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 29.0 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-307", "what_happened": "AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing attempts against any account from a single IP address.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/WWBN/AVideo/security/advisories/GHSA-qmmw-hmm4-xxp7", "https://www.vulncheck.com/advisories/avideo-api-rate-limit-bypass-via-bot-user-agent-header" ], "timeline": [ { "at": "2026-09-05T13:18:13.560", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86186" } ] }, { "id": "CVE-2026-86185", "vendor": "Bilibili", "product": "Bilibili Desktop", "title": "Bilibili Desktop vulnerability", "summary": "Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.", "updated_at": "2026-09-05T12:16:49.240", "published_at": "2026-09-05T12:16:49.240", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.18.0 (custom)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Adjacent", "authentication": "None", "complexity": "Low", "cwe": "CWE-295", "what_happened": "Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://app.bilibili.com/", "https://github.com/LeoWSY-hashblue/bilibili-desktop-tls-disabled-rce", "https://github.com/LeoWSY-hashblue/bilibili-desktop-tls-disabled-rce/blob/main/advisory.md", "https://www.vulncheck.com/advisories/bilibili-desktop-through-1.18.0-remote-code-execution-via-tls-verification-bypass" ], "timeline": [ { "at": "2026-09-05T12:16:49.240", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86185" } ] }, { "id": "CVE-2026-86184", "vendor": "laradashboard", "product": "laradashboard", "title": "laradashboard vulnerability", "summary": "Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint with a registered email address to receive a fully authenticated session, enabling access to user administration, settings, database contents, and arbitrary code execution through the module installer.", "updated_at": "2026-09-05T12:16:49.090", "published_at": "2026-09-05T12:16:49.090", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 1.3.0 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "what_happened": "Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint with a registered email address to receive a fully authenticated session, enabling access to user administration, settings, database contents, and arbitrary code execution through the module installer.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/laradashboard/laradashboard", "https://github.com/laradashboard/laradashboard/blob/v1.2.2/app/Http/Controllers/Backend/Auth/ScreenshotGeneratorLoginController.php", "https://github.com/laradashboard/laradashboard/commit/50986e4ac58c883dd8f064cf32be3e2a87c11b24", "https://github.com/laradashboard/laradashboard/releases/tag/v1.3.0", "https://github.com/laradashboard/laradashboard/security/advisories/GHSA-wj35-4h53-phfp", "https://www.vulncheck.com/advisories/lara-dashboard-before-1.3.0-missing-authentication-in-screenshot-login-route" ], "timeline": [ { "at": "2026-09-05T12:16:49.090", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86184" } ] }, { "id": "CVE-2026-86178", "vendor": "pixelfed", "product": "pixelfed", "title": "pixelfed vulnerability", "summary": "Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.", "updated_at": "2026-09-05T11:16:46.537", "published_at": "2026-09-05T11:16:46.537", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.12.9 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/geo-chen/oss/blob/main/Pixelfed.md", "https://github.com/pixelfed/pixelfed", "https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeController.php#L487-L501", "https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeController.php#L566-L580", "https://github.com/pixelfed/pixelfed/blob/v0.12.9/routes/web-api.php#L154-L155", "https://www.vulncheck.com/advisories/pixelfed-through-0.12.9-unauthorized-story-access-via-api" ], "timeline": [ { "at": "2026-09-05T11:16:46.537", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86178" } ] }, { "id": "CVE-2026-86177", "vendor": "pterodactyl", "product": "panel", "title": "panel vulnerability", "summary": "Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.", "updated_at": "2026-09-05T11:16:46.397", "published_at": "2026-09-05T11:16:46.397", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 1.14.1 (semver)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/geo-chen/oss/blob/main/panel.md", "https://github.com/pterodactyl/panel", "https://github.com/pterodactyl/panel/blob/v1.14.0/app/Http/Requests/Api/Client/Servers/Schedules/StoreTaskRequest.php#L10-L25", "https://github.com/pterodactyl/panel/blob/v1.14.0/app/Jobs/Schedule/RunTaskJob.php#L60-L75", "https://github.com/pterodactyl/panel/commit/913b354aff43ff04fce95357ed68a675a1dd0fa6", "https://github.com/pterodactyl/panel/releases/tag/v1.14.1", "https://www.vulncheck.com/advisories/pterodactyl-panel-before-1.14.1-privilege-escalation-via-schedule-tasks" ], "timeline": [ { "at": "2026-09-05T11:16:46.397", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86177" } ] }, { "id": "CVE-2026-86176", "vendor": "netbox-community", "product": "netbox", "title": "netbox vulnerability", "summary": "NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.", "updated_at": "2026-09-05T11:16:46.263", "published_at": "2026-09-05T11:16:46.263", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.7.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/geo-chen/oss/blob/main/netbox.md#finding-1-cross-user-disclosure-of-private-notifications-subscriptions-and-bookmarks-via-rest-api-and-graphql-missing-per-user-scoping", "https://github.com/netbox-community/netbox", "https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/extras/api/views.py#L153-L178", "https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/netbox/settings.py#L667-L673", "https://www.vulncheck.com/advisories/netbox-through-4.7.0-information-disclosure-via-rest-and-graphql-apis" ], "timeline": [ { "at": "2026-09-05T11:16:46.263", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86176" } ] }, { "id": "CVE-2026-86175", "vendor": "netbox-community", "product": "netbox", "title": "netbox vulnerability", "summary": "NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.", "updated_at": "2026-09-05T11:16:46.123", "published_at": "2026-09-05T11:16:46.123", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.7.0 (semver)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-522", "what_happened": "NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/geo-chen/oss/blob/main/netbox.md#finding-2-netbox-data-source-backend-credentials-git-password--s3-secret-key-returned-in-plaintext-via-rest-api-and-graphql-to-users-with-only-view-permission-incomplete-fix-of-12625", "https://github.com/netbox-community/netbox", "https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/api/serializers_/data.py#L26-L32", "https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/data_backends.py#L80", "https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/graphql/types.py#L30-L38", "https://github.com/netbox-community/netbox/issues/12625", "https://www.vulncheck.com/advisories/netbox-through-4.7.0-credential-disclosure-via-rest-and-graphql-apis" ], "timeline": [ { "at": "2026-09-05T11:16:46.123", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86175" } ] }, { "id": "CVE-2026-86174", "vendor": "makeplane", "product": "plane", "title": "plane vulnerability", "summary": "Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.", "updated_at": "2026-09-05T11:16:45.990", "published_at": "2026-09-05T11:16:45.990", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.4.2 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/makeplane/plane", "https://github.com/makeplane/plane/blob/v1.4.2/apps/api/plane/space/views/issue.py#L258-L275", "https://github.com/makeplane/plane/issues/9441", "https://www.vulncheck.com/advisories/plane-through-1.4.2-arbitrary-comment-write-via-public-deploy-board" ], "timeline": [ { "at": "2026-09-05T11:16:45.990", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86174" } ] }, { "id": "CVE-2026-86173", "vendor": "mindsdb", "product": "mindsdb", "title": "mindsdb vulnerability", "summary": "MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.", "updated_at": "2026-09-05T11:16:45.850", "published_at": "2026-09-05T11:16:45.850", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 26.1.0 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-918", "what_happened": "MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mindsdb/mindshub", "https://github.com/mindsdb/mindshub/blob/v26.1.0/mindsdb/integrations/handlers/web_handler/web_handler.py#L50-L65", "https://github.com/mindsdb/mindshub/blob/v26.1.0/mindsdb/utilities/config.py#L273", "https://github.com/mindsdb/mindshub/issues/12480", "https://www.vulncheck.com/advisories/mindsdb-through-26.1.0-unauthenticated-ssrf-via-web-crawler" ], "timeline": [ { "at": "2026-09-05T11:16:45.850", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86173" } ] }, { "id": "CVE-2026-86169", "vendor": "axolotl-ai-cloud", "product": "axolotl", "title": "axolotl vulnerability", "summary": "Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained.", "updated_at": "2026-09-05T11:16:45.703", "published_at": "2026-09-05T11:16:45.703", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.18.0 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-829", "what_happened": "Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/axolotl-ai-cloud/axolotl", "https://github.com/axolotl-ai-cloud/axolotl/blob/v0.18.0/src/axolotl/loaders/patch_manager.py#L794-L806", "https://github.com/axolotl-ai-cloud/axolotl/blob/v0.18.0/src/axolotl/monkeypatch/multipack.py#L86-L96", "https://github.com/axolotl-ai-cloud/axolotl/commit/b62d60b101eea7f32532ee3c0b17c2f2430a9262", "https://github.com/axolotl-ai-cloud/axolotl/pull/3858", "https://www.vulncheck.com/advisories/axolotl-through-0.18.0-remote-code-execution-via-multipack-patching" ], "timeline": [ { "at": "2026-09-05T11:16:45.703", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86169" } ] }, { "id": "CVE-2026-86145", "vendor": "PCRE", "product": "PCRE2", "title": "PCRE2 vulnerability", "summary": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "updated_at": "2026-09-05T14:17:23.897", "published_at": "2026-09-05T06:17:10.370", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "10.32 through before 10.48 (custom)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-424", "what_happened": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf", "http://www.openwall.com/lists/oss-security/2026/09/05/3" ], "timeline": [ { "at": "2026-09-05T06:17:10.370", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145" } ] }, { "id": "CVE-2026-86144", "vendor": "xmlsoft", "product": "libxml2", "title": "libxml2 vulnerability", "summary": "In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).", "updated_at": "2026-09-05T05:17:13.407", "published_at": "2026-09-05T05:17:13.407", "cvss": 5.6, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "before 2.15.4 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-669", "what_happened": "In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4" ], "timeline": [ { "at": "2026-09-05T05:17:13.407", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144" } ] }, { "id": "CVE-2026-86143", "vendor": "xmlsoft", "product": "libxml2", "title": "libxml2 vulnerability", "summary": "In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.", "updated_at": "2026-09-05T05:17:13.270", "published_at": "2026-09-05T05:17:13.270", "cvss": 6.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "before 2.15.4 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-192", "what_happened": "In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111" ], "timeline": [ { "at": "2026-09-05T05:17:13.270", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143" } ] }, { "id": "CVE-2026-86142", "vendor": "xmlsoft", "product": "libxml2", "title": "libxml2 vulnerability", "summary": "In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.", "updated_at": "2026-09-05T05:17:13.133", "published_at": "2026-09-05T05:17:13.133", "cvss": 6.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "before 2.15.4 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-122", "what_happened": "In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113" ], "timeline": [ { "at": "2026-09-05T05:17:13.133", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142" } ] }, { "id": "CVE-2026-86141", "vendor": "xmlsoft", "product": "libxml2", "title": "libxml2 vulnerability", "summary": "xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.", "updated_at": "2026-09-05T05:17:13.007", "published_at": "2026-09-05T05:17:13.007", "cvss": 2.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "before 2.15.4 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-252", "what_happened": "xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107" ], "timeline": [ { "at": "2026-09-05T05:17:13.007", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86141" } ] }, { "id": "CVE-2026-86140", "vendor": "xmlsoft", "product": "libxml2", "title": "libxml2 vulnerability", "summary": "In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.", "updated_at": "2026-09-05T05:17:12.877", "published_at": "2026-09-05T05:17:12.877", "cvss": 8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "before 2.15.4 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-121", "what_happened": "In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4" ], "timeline": [ { "at": "2026-09-05T05:17:12.877", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140" } ] }, { "id": "CVE-2026-86139", "vendor": "xmlsoft", "product": "libxml2", "title": "libxml2 vulnerability", "summary": "In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.", "updated_at": "2026-09-05T05:17:12.730", "published_at": "2026-09-05T05:17:12.730", "cvss": 6.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "before 2.15.4 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-190", "what_happened": "In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4" ], "timeline": [ { "at": "2026-09-05T05:17:12.730", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86139" } ] }, { "id": "CVE-2026-86138", "vendor": "xmlsoft", "product": "libxml2", "title": "libxml2 vulnerability", "summary": "In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.", "updated_at": "2026-09-05T05:17:12.600", "published_at": "2026-09-05T05:17:12.600", "cvss": 6.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "before 2.15.4 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-190", "what_happened": "In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4" ], "timeline": [ { "at": "2026-09-05T05:17:12.600", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138" } ] }, { "id": "CVE-2026-86137", "vendor": "xmlsoft", "product": "libxml2", "title": "libxml2 vulnerability", "summary": "In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.", "updated_at": "2026-09-05T05:17:11.490", "published_at": "2026-09-05T05:17:11.490", "cvss": 2.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "before 2.15.4 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-125", "what_happened": "In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1099" ], "timeline": [ { "at": "2026-09-05T05:17:11.490", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86137" } ] }, { "id": "CVE-2026-86124", "vendor": "HKUDS", "product": "AutoAgent", "title": "AutoAgent vulnerability", "summary": "AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining access to bind-mounted host workspace directories.", "updated_at": "2026-09-05T10:16:43.900", "published_at": "2026-09-05T10:16:43.900", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 16c12b052ef2330a198063c62a07a7f9723031e3 (git)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "what_happened": "AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining access to bind-mounted host workspace directories.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/HKUDS/AutoAgent", "https://github.com/HKUDS/AutoAgent/blob/16c12b052ef2330a198063c62a07a7f9723031e3/autoagent/environment/docker_env.py", "https://github.com/HKUDS/AutoAgent/blob/16c12b052ef2330a198063c62a07a7f9723031e3/autoagent/environment/tcp_server.py", "https://github.com/HKUDS/AutoAgent/issues/96", "https://www.vulncheck.com/advisories/autoagent-unauthenticated-remote-code-execution-via-the-sandbox-tcp-command-server" ], "timeline": [ { "at": "2026-09-05T10:16:43.900", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86124" } ] }, { "id": "CVE-2026-86123", "vendor": "sqlchat", "product": "sqlchat", "title": "sqlchat vulnerability", "summary": "SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's network without authentication.", "updated_at": "2026-09-05T10:16:43.750", "published_at": "2026-09-05T10:16:43.750", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 665af875413affadfeefff81794f1d7758782bc2 (git)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-918", "what_happened": "SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's network without authentication.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/sqlchat/sqlchat", "https://github.com/sqlchat/sqlchat/blob/665af875413affadfeefff81794f1d7758782bc2/src/pages/api/connection/execute.ts", "https://github.com/sqlchat/sqlchat/blob/665af875413affadfeefff81794f1d7758782bc2/src/pages/api/connection/test.ts", "https://github.com/sqlchat/sqlchat/issues/189", "https://www.vulncheck.com/advisories/sql-chat-unauthenticated-database-connection-proxy-in-the-api-connection-endpoints" ], "timeline": [ { "at": "2026-09-05T10:16:43.750", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86123" } ] }, { "id": "CVE-2026-86122", "vendor": "rowboatlabs", "product": "rowboat", "title": "rowboat vulnerability", "summary": "Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology.", "updated_at": "2026-09-05T10:16:43.610", "published_at": "2026-09-05T10:16:43.610", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.9.1 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-918", "what_happened": "Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/rowboatlabs/rowboat", "https://github.com/rowboatlabs/rowboat/blob/v0.9.1/apps/rowboat/src/application/lib/agents-runtime/agent-tools.ts", "https://github.com/rowboatlabs/rowboat/blob/v0.9.1/apps/rowboat/src/application/use-cases/projects/add-custom-mcp-server.use-case.ts", "https://github.com/rowboatlabs/rowboat/issues/621", "https://www.vulncheck.com/advisories/rowboat-through-0.9.1-server-side-request-forgery-via-custom-mcp-server" ], "timeline": [ { "at": "2026-09-05T10:16:43.610", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86122" } ] }, { "id": "CVE-2026-86121", "vendor": "trycua", "product": "cua-computer-server", "title": "cua-computer-server vulnerability", "summary": "Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication.", "updated_at": "2026-09-05T10:16:43.463", "published_at": "2026-09-05T10:16:43.463", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.3.42 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "what_happened": "Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/trycua/cua", "https://github.com/trycua/cua/blob/10a2e71792db/libs/python/computer-server/computer_server/cli.py", "https://github.com/trycua/cua/blob/10a2e71792db/libs/python/computer-server/computer_server/main.py", "https://github.com/trycua/cua/commit/59cf25c0ec54", "https://github.com/trycua/cua/issues/1892", "https://www.vulncheck.com/advisories/cua-computer-server-before-0.3.42-unauthenticated-rce-via-desktop-control" ], "timeline": [ { "at": "2026-09-05T10:16:43.463", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86121" } ] }, { "id": "CVE-2026-86120", "vendor": "apitable", "product": "apitable", "title": "apitable vulnerability", "summary": "APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been explicitly denied access to by exploiting the unhandled exception in the permission guard.", "updated_at": "2026-09-05T10:16:43.307", "published_at": "2026-09-05T10:16:43.307", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.13.0-beta.1 (custom)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-636", "what_happened": "APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been explicitly denied access to by exploiting the unhandled exception in the permission guard.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/apitable/apitable", "https://github.com/apitable/apitable/blob/88b24ce9f359/packages/room-server/src/fusion/middleware/guard/node.permission.guard.ts", "https://github.com/apitable/apitable/issues/1814", "https://www.vulncheck.com/advisories/apitable-through-1.13.0-beta.1-fail-open-authorization-in-the-fusion-api-node-permission-guard" ], "timeline": [ { "at": "2026-09-05T10:16:43.307", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86120" } ] }, { "id": "CVE-2026-86119", "vendor": "webstudio-is", "product": "webstudio", "title": "webstudio vulnerability", "summary": "Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.", "updated_at": "2026-09-05T10:16:43.157", "published_at": "2026-09-05T10:16:43.157", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.296.0 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-918", "what_happened": "Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/webstudio-is/webstudio", "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.asset.$.ts", "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.image.$.ts", "https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.video.$.ts", "https://github.com/webstudio-is/webstudio/issues/5816", "https://www.vulncheck.com/advisories/webstudio-through-0.296.0-ssrf-via-cgi-proxy-routes" ], "timeline": [ { "at": "2026-09-05T10:16:43.157", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86119" } ] }, { "id": "CVE-2026-86118", "vendor": "sentriz", "product": "gonic", "title": "gonic vulnerability", "summary": "gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.", "updated_at": "2026-09-05T10:16:43.007", "published_at": "2026-09-05T10:16:43.007", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.22.0 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/sentriz/gonic", "https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/ctrl.go", "https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/handlers_common.go", "https://github.com/sentriz/gonic/releases/tag/v0.22.0", "https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pq", "https://www.vulncheck.com/advisories/gonic-before-0.22.0-missing-administrator-check-on-the-subsonic-startscan-endpoint" ], "timeline": [ { "at": "2026-09-05T10:16:43.007", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86118" } ] }, { "id": "CVE-2026-86117", "vendor": "coollabsio", "product": "coolify", "title": "coolify vulnerability", "summary": "Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.", "updated_at": "2026-09-05T10:16:42.860", "published_at": "2026-09-05T10:16:42.860", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.3.17 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-287", "what_happened": "Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/coollabsio/coolify", "https://github.com/coollabsio/coolify/blob/v4.3.17/app/Http/Controllers/OauthController.php", "https://github.com/coollabsio/coolify/blob/v4.3.17/routes/web.php", "https://github.com/geo-chen/oss/blob/main/coolify.md", "https://www.vulncheck.com/advisories/coolify-through-4.3.17-oauth-account-takeover-via-unverified-email-matching" ], "timeline": [ { "at": "2026-09-05T10:16:42.860", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86117" } ] }, { "id": "CVE-2026-86116", "vendor": "metabase", "product": "metabase", "title": "metabase vulnerability", "summary": "Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.", "updated_at": "2026-09-05T10:16:42.713", "published_at": "2026-09-05T10:16:42.713", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.57.0 through before 0.63.1 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/geo-chen/oss/blob/main/metabase.md", "https://github.com/metabase/metabase", "https://github.com/metabase/metabase/blob/v0.62.1/src/metabase/glossary/api.clj", "https://github.com/metabase/metabase/commit/0a0589299cfd", "https://github.com/metabase/metabase/releases/tag/v0.63.1", "https://www.vulncheck.com/advisories/metabase-before-0.63.1-missing-function-level-authorization-on-the-glossary-management-api" ], "timeline": [ { "at": "2026-09-05T10:16:42.713", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86116" } ] }, { "id": "CVE-2026-86115", "vendor": "simstudioai", "product": "sim", "title": "sim vulnerability", "summary": "Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP blocks to reach internal-only endpoints like POST /api/function/execute.", "updated_at": "2026-09-05T10:16:42.567", "published_at": "2026-09-05T10:16:42.567", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.8.14 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-441", "what_happened": "Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP blocks to reach internal-only endpoints like POST /api/function/execute.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/geo-chen/oss/blob/main/sim.md", "https://github.com/simstudioai/sim", "https://github.com/simstudioai/sim/blob/v0.8.13/apps/sim/lib/auth/hybrid.ts", "https://github.com/simstudioai/sim/blob/v0.8.13/apps/sim/tools/index.ts", "https://github.com/simstudioai/sim/pull/7179", "https://www.vulncheck.com/advisories/sim-before-0.8.14-confused-deputy-in-tool-url-routing-mints-an-internal-token-for-a-user-supplied-api-path" ], "timeline": [ { "at": "2026-09-05T10:16:42.567", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86115" } ] }, { "id": "CVE-2026-86114", "vendor": "getarcaneapp", "product": "arcane", "title": "arcane vulnerability", "summary": "Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.", "updated_at": "2026-09-05T10:16:42.423", "published_at": "2026-09-05T10:16:42.423", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.19.1 through before 2.0.0 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/geo-chen/oss/blob/main/arcane.md", "https://github.com/getarcaneapp/arcane", "https://github.com/getarcaneapp/arcane/blob/v1.19.5/backend/api/handlers/templates.go", "https://github.com/getarcaneapp/arcane/commit/1500646aa91f", "https://github.com/getarcaneapp/arcane/releases/tag/v2.0.0", "https://www.vulncheck.com/advisories/arcane-before-2.0.0-missing-administrator-authorization-on-the-compose-template-mutation-endpoints" ], "timeline": [ { "at": "2026-09-05T10:16:42.423", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86114" } ] }, { "id": "CVE-2026-86113", "vendor": "bookwyrm-social", "product": "bookwyrm", "title": "bookwyrm vulnerability", "summary": "BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.", "updated_at": "2026-09-05T10:16:42.273", "published_at": "2026-09-05T10:16:42.273", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.9.1 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/bookwyrm-social/bookwyrm", "https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/status.py", "https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-3-authenticated-idor-in-edit-readthrough-allows-tampering-with-other-users-reading-progress", "https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-insecure-direct-object-reference-in-edit-readthrough-allows-tampering-with-other-users-reading-records" ], "timeline": [ { "at": "2026-09-05T10:16:42.273", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86113" } ] }, { "id": "CVE-2026-86112", "vendor": "bookwyrm-social", "product": "bookwyrm", "title": "bookwyrm vulnerability", "summary": "BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.", "updated_at": "2026-09-05T10:16:42.130", "published_at": "2026-09-05T10:16:42.130", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.9.1 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/bookwyrm-social/bookwyrm", "https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/interaction.py", "https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-2-authenticated-idor-in-favoriteunfavorite-allows-interaction-with-private-statuses", "https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-missing-authorization-on-the-favorite-and-unfavorite-endpoints" ], "timeline": [ { "at": "2026-09-05T10:16:42.130", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86112" } ] }, { "id": "CVE-2026-86111", "vendor": "bookwyrm-social", "product": "bookwyrm", "title": "bookwyrm vulnerability", "summary": "BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.", "updated_at": "2026-09-05T10:16:40.963", "published_at": "2026-09-05T10:16:40.963", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.9.1 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/bookwyrm-social/bookwyrm", "https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/templates/snippets/create_status/content_field.html", "https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/status.py", "https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-1-authenticated-idor-in-editstatus-exposes-private-review-comment-and-quotation-content", "https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-insecure-direct-object-reference-in-editstatus-exposes-followers-only-and-direct-statuses" ], "timeline": [ { "at": "2026-09-05T10:16:40.963", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86111" } ] }, { "id": "CVE-2026-85665", "vendor": "usebruno", "product": "bruno", "title": "bruno vulnerability", "summary": "Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.", "updated_at": "2026-09-05T11:16:45.577", "published_at": "2026-09-04T15:17:44.247", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.1.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-22", "what_happened": "Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/usebruno/bruno", "https://github.com/usebruno/bruno/blob/v4.1.0/packages/bruno-cli/src/runner/prepare-request.js", "https://github.com/usebruno/bruno/issues/8230", "https://www.vulncheck.com/advisories/bruno-3.4.2-arbitrary-file-read-via-unconfined-body-file-path" ], "timeline": [ { "at": "2026-09-04T15:17:44.247", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85665" } ] }, { "id": "CVE-2026-85604", "vendor": "getgrav", "product": "grav", "title": "grav vulnerability", "summary": "Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; the remaining denylist misses spl_autoload, which performs a PHP include. An authenticated user with only page-write rights (admin.pages or api.pages.write) can supply a crafted payload (e.g., via form frontmatter rendered by the Email plugin) that invokes spl_autoload through the sort filter, resulting in arbitrary PHP execution as the web server user.", "updated_at": "2026-09-05T11:16:45.460", "published_at": "2026-09-04T12:17:24.177", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 2.0.18 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-94", "what_happened": "Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; the remaining denylist misses spl_autoload, which performs a PHP include. An authenticated user with only page-write rights (admin.pages or api.pages.write) can supply a crafted payload (e.g., via form frontmatter rendered by the Email plugin) that invokes spl_autoload through the sort filter, resulting in arbitrary PHP execution as the web server user.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/getgrav/grav/security/advisories/GHSA-p6qj-p5m7-f62h", "https://www.vulncheck.com/advisories/grav-before-2.0.19-remote-code-execution-via-sort-filter" ], "timeline": [ { "at": "2026-09-04T12:17:24.177", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85604" } ] }, { "id": "CVE-2026-85602", "vendor": "getgrav", "product": "grav-plugin-form", "title": "grav-plugin-form vulnerability", "summary": "The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 field name (g-recaptcha-response instead of token), causing validation to use the v2 branch, which never applies the score threshold or verifies the expected action. This results in a complete bypass of reCAPTCHA v3 bot protection. The issue is fixed in version 9.1.20.", "updated_at": "2026-09-05T11:16:45.337", "published_at": "2026-09-04T12:17:23.903", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 9.1.20 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-807", "what_happened": "The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 field name (g-recaptcha-response instead of token), causing validation to use the v2 branch, which never applies the score threshold or verifies the expected action. This results in a complete bypass of reCAPTCHA v3 bot protection. The issue is fixed in version 9.1.20.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/getgrav/grav/security/advisories/GHSA-89j6-8h38-2cc3", "https://www.vulncheck.com/advisories/grav-form-plugin-before-9.1.20-recaptcha-v3-authentication-bypass" ], "timeline": [ { "at": "2026-09-04T12:17:23.903", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85602" } ] }, { "id": "CVE-2026-85600", "vendor": "getgrav", "product": "grav-plugin-admin2", "title": "grav-plugin-admin2 vulnerability", "summary": "Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts), which substitutes untrusted parameters such as usernames into translation templates before parsing the result as markdown. Grav's server-side username validation (DataUser::isValidUsername) blocks filesystem-dangerous characters but not <, >, \", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml()—such as the two-factor force-disable confirmation prompt or the 'page is locked' editor notice—the payload executes in their authenticated session. Fixed in 2.0.21.", "updated_at": "2026-09-05T11:16:45.213", "published_at": "2026-09-04T12:17:23.630", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.0.19 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts), which substitutes untrusted parameters such as usernames into translation templates before parsing the result as markdown. Grav's server-side username validation (DataUser::isValidUsername) blocks filesystem-dangerous characters but not <, >, \", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml()—such as the two-factor force-disable confirmation prompt or the 'page is locked' editor notice—the payload executes in their authenticated session. Fixed in 2.0.21.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/getgrav/grav/security/advisories/GHSA-96xm-c5hr-59rx", "https://www.vulncheck.com/advisories/grav-admin-before-2.0.21-stored-xss-via-username" ], "timeline": [ { "at": "2026-09-04T12:17:23.630", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85600" } ] }, { "id": "CVE-2026-85599", "vendor": "getgrav", "product": "grav-plugin-shortcode-core", "title": "grav-plugin-shortcode-core vulnerability", "summary": "Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browsers of all page visitors, including administrators.", "updated_at": "2026-09-05T11:16:45.100", "published_at": "2026-09-04T12:17:23.490", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 6.2.5 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browsers of all page visitors, including administrators.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/getgrav/grav/security/advisories/GHSA-hvm8-wx3f-j774", "https://www.vulncheck.com/advisories/grav-shortcode-core-before-6.2.5-stored-xss-via-unescaped-parameters" ], "timeline": [ { "at": "2026-09-04T12:17:23.490", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85599" } ] }, { "id": "CVE-2026-85598", "vendor": "getgrav", "product": "grav", "title": "grav vulnerability", "summary": "Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.", "updated_at": "2026-09-05T11:16:44.983", "published_at": "2026-09-04T12:17:23.340", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.0.0 through 2.0.17 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/getgrav/grav/security/advisories/GHSA-fg8g-663r-f366", "https://www.vulncheck.com/advisories/grav-2.0.0-through-2.0.17-stored-xss-via-modular-pages" ], "timeline": [ { "at": "2026-09-04T12:17:23.340", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85598" } ] }, { "id": "CVE-2026-85597", "vendor": "traefik", "product": "traefik", "title": "traefik vulnerability", "summary": "Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.", "updated_at": "2026-09-05T11:16:44.863", "published_at": "2026-09-04T12:17:23.210", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 2.11.55 (semver); 3.0.0 through 3.7.10 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-863", "what_happened": "Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/traefik/traefik/security/advisories/GHSA-g55h-rg46-x9c5", "https://www.vulncheck.com/advisories/traefik-before-2.11.55-mtls-bypass-via-tls-option-conflict" ], "timeline": [ { "at": "2026-09-04T12:17:23.210", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85597" } ] }, { "id": "CVE-2026-85596", "vendor": "traefik", "product": "traefik", "title": "traefik vulnerability", "summary": "Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress objects sharing the same host, the same client CA secret, and the same client-authentication mode produced two distinct TLS option names for that host. Traefik treats this as a TLS options conflict and falls back to the entry point's default TLS configuration, which does not request a client certificate, so a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: \"on\" becomes reachable without a client certificate. Only the v3.7 line is affected; the issue is fixed in v3.7.11.", "updated_at": "2026-09-05T11:16:44.743", "published_at": "2026-09-04T12:17:23.087", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.7.0 through 3.7.10 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-287", "what_happened": "Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress objects sharing the same host, the same client CA secret, and the same client-authentication mode produced two distinct TLS option names for that host. Traefik treats this as a TLS options conflict and falls back to the entry point's default TLS configuration, which does not request a client certificate, so a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: \"on\" becomes reachable without a client certificate. Only the v3.7 line is affected; the issue is fixed in v3.7.11.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/traefik/traefik/security/advisories/GHSA-j994-9gqj-9hwq", "https://www.vulncheck.com/advisories/traefik-3.7-authentication-bypass-via-tls-option-conflict" ], "timeline": [ { "at": "2026-09-04T12:17:23.087", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85596" } ] }, { "id": "CVE-2026-85595", "vendor": "traefik", "product": "traefik", "title": "traefik vulnerability", "summary": "Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.", "updated_at": "2026-09-05T11:16:43.577", "published_at": "2026-09-04T12:17:22.960", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 2.11.55 (semver); 3.0.0 through 3.7.10 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-287", "what_happened": "Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c", "https://www.vulncheck.com/advisories/traefik-before-2.11.55-authentication-bypass-via-digestauth" ], "timeline": [ { "at": "2026-09-04T12:17:22.960", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85595" } ] }, { "id": "CVE-2026-85444", "vendor": "moos-ivp", "product": "moos-ivp", "title": "moos-ivp vulnerability", "summary": "MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODE_REPORT messages with leading or trailing whitespace to read past buffer bounds and access adjacent memory.", "updated_at": "2026-09-05T03:17:24.557", "published_at": "2026-09-03T23:17:24.180", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 24.8.1 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODE_REPORT messages with leading or trailing whitespace to read past buffer bounds and access adjacent memory.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/moos-ivp/moos-ivp", "https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/lib_mbutil/MBUtils.cpp#L1710", "https://github.com/moos-ivp/moos-ivp/commit/faff8adfa1a69d68614461f679ebbc1d741c51aa", "https://github.com/moos-ivp/moos-ivp/pull/128", "https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-out-of-bounds-read-in-isbraced-isquoted-and-ischevroned" ], "timeline": [ { "at": "2026-09-03T23:17:24.180", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85444" } ] }, { "id": "CVE-2026-85439", "vendor": "moos-ivp", "product": "moos-ivp", "title": "moos-ivp vulnerability", "summary": "MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.", "updated_at": "2026-09-05T03:17:24.433", "published_at": "2026-09-03T23:17:23.427", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 24.8.1 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-78", "what_happened": "MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/moos-ivp/moos-ivp", "https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/lib_logutils/SplitHandler.cpp#L608", "https://github.com/moos-ivp/moos-ivp/commit/f684d77d9d6e9e96dbfce46f05988d5a643f2b60", "https://github.com/moos-ivp/moos-ivp/pull/127", "https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-alogsplit-command-injection-via-input-pathname" ], "timeline": [ { "at": "2026-09-03T23:17:23.427", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85439" } ] }, { "id": "CVE-2026-85434", "vendor": "moos-ivp", "product": "moos-ivp", "title": "moos-ivp vulnerability", "summary": "MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.", "updated_at": "2026-09-05T03:17:24.303", "published_at": "2026-09-03T23:17:22.643", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 24.8.1 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-345", "what_happened": "MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/moos-ivp/moos-ivp", "https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/uFldShoreBroker/ShoreBroker.cpp#L93", "https://github.com/moos-ivp/moos-ivp/commit/2f5224dcd68f92ce9ae10c261bb45dd7000f4d33", "https://github.com/moos-ivp/moos-ivp/pull/123", "https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-ufldshorebroker-bridge-route-injection-via-unverified-node-ping" ], "timeline": [ { "at": "2026-09-03T23:17:22.643", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85434" } ] }, { "id": "CVE-2026-85429", "vendor": "moos-ivp", "product": "moos-ivp", "title": "moos-ivp vulnerability", "summary": "MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation.", "updated_at": "2026-09-05T03:17:24.180", "published_at": "2026-09-03T23:17:21.910", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 24.8.1 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-345", "what_happened": "MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/moos-ivp/moos-ivp", "https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/uFldNodeComms/FldNodeComms.cpp#L114", "https://github.com/moos-ivp/moos-ivp/commit/3907ac07cdfd8a7255d65657dc18dc6b77b30b64", "https://github.com/moos-ivp/moos-ivp/pull/122", "https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-ufldnodecomms-node-message-source-spoofing" ], "timeline": [ { "at": "2026-09-03T23:17:21.910", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85429" } ] }, { "id": "CVE-2026-85424", "vendor": "themoos", "product": "core-moos", "title": "core-moos vulnerability", "summary": "MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues.", "updated_at": "2026-09-05T03:17:24.050", "published_at": "2026-09-03T23:17:21.170", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 10.4.0 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "what_happened": "MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/themoos/core-moos", "https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/MOOSDB.cpp#L1163", "https://github.com/themoos/core-moos/commit/5ff5cdec44242156a168cc1a545a6a21357bd3ac", "https://github.com/themoos/core-moos/pull/84", "https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-missing-authentication-for-moosdb-publish-subscribe-and-db-clear" ], "timeline": [ { "at": "2026-09-03T23:17:21.170", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85424" } ] }, { "id": "CVE-2026-85414", "vendor": "fooplugins", "product": "Gallery : FooGallery", "title": "Gallery : FooGallery vulnerability", "summary": "The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "updated_at": "2026-09-05T08:16:40.993", "published_at": "2026-09-05T08:16:40.993", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.3.2 (semver)", "fixed": "See vendor advisory", "source_count": 12, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/foogallery/tags/3.2.6/assets/js/foogallery.4cc6f51b.js#L6599", "https://plugins.trac.wordpress.org/browser/foogallery/tags/3.2.6/assets/js/foogallery.4cc6f51b.js#L7367", "https://plugins.trac.wordpress.org/browser/foogallery/tags/3.2.6/assets/js/foogallery.4cc6f51b.js#L8048", "https://plugins.trac.wordpress.org/browser/foogallery/tags/3.2.6/includes/class-gallery-advanced-settings.php#L138", "https://plugins.trac.wordpress.org/browser/foogallery/tags/3.2.6/includes/functions.php#L301", "https://plugins.trac.wordpress.org/browser/foogallery/trunk/assets/js/foogallery.4cc6f51b.js#L6599", "https://plugins.trac.wordpress.org/browser/foogallery/trunk/assets/js/foogallery.4cc6f51b.js#L7367", "https://plugins.trac.wordpress.org/browser/foogallery/trunk/assets/js/foogallery.4cc6f51b.js#L8048", "https://plugins.trac.wordpress.org/browser/foogallery/trunk/includes/class-gallery-advanced-settings.php#L138", "https://plugins.trac.wordpress.org/browser/foogallery/trunk/includes/functions.php#L301", "https://plugins.trac.wordpress.org/changeset/3680965/foogallery", "https://www.wordfence.com/threat-intel/vulnerabilities/id/859e78cd-3dfe-41b9-86dd-6f9db319cad8?source=cve" ], "timeline": [ { "at": "2026-09-05T08:16:40.993", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85414" } ] }, { "id": "CVE-2026-85395", "vendor": "unopim", "product": "unopim", "title": "unopim vulnerability", "summary": "UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.", "updated_at": "2026-09-05T03:17:23.880", "published_at": "2026-09-03T19:17:31.390", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 2.1.3 (semver)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/geo-chen/oss/blob/main/unopim.md", "https://github.com/unopim/unopim", "https://github.com/unopim/unopim/blob/v2.1.2/packages/Webkul/User/src/Http/Middleware/Bouncer.php", "https://github.com/unopim/unopim/commit/acbf2e160ced78446d6e4267e89f264bf04612c4", "https://github.com/unopim/unopim/releases/tag/v2.1.3", "https://www.vulncheck.com/advisories/unopim-before-2.1.3-missing-authorization-on-integration-management-routes" ], "timeline": [ { "at": "2026-09-03T19:17:31.390", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85395" } ] }, { "id": "CVE-2026-85390", "vendor": "bluewave-labs", "product": "Checkmate", "title": "Checkmate vulnerability", "summary": "Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase incident evidence.", "updated_at": "2026-09-05T03:17:23.703", "published_at": "2026-09-03T19:17:30.690", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.11.0 (semver)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase incident evidence.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/bluewave-labs/Checkmate", "https://github.com/bluewave-labs/Checkmate/blob/v3.11.0/server/src/api/routes/checkRoutes.ts", "https://github.com/bluewave-labs/Checkmate/blob/v3.11.0/server/src/api/routes/maintenanceWindowRoutes.ts", "https://github.com/bluewave-labs/Checkmate/blob/v3.11.0/server/src/api/routes/notificationRoutes.ts", "https://github.com/bluewave-labs/Checkmate/issues/3916", "https://www.vulncheck.com/advisories/checkmate-through-3.11.0-missing-authorization-on-maintenance-window-notification-and-check-deletion-routes" ], "timeline": [ { "at": "2026-09-03T19:17:30.690", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85390" } ] }, { "id": "CVE-2026-85225", "vendor": "code-projects", "product": "Doctor Appointment System", "title": "Doctor Appointment System vulnerability", "summary": "A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.", "updated_at": "2026-09-05T03:17:18.023", "published_at": "2026-09-03T23:17:20.630", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-74", "what_happened": "A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://code-projects.org/", "https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Time-Based%20Blind%20SQL%20Injection%20in%20Doctor%20Appointment%20System%20email%20Parameter.md", "https://vuldb.com/cve/CVE-2026-85225", "https://vuldb.com/submit/894405", "https://vuldb.com/vuln/398424", "https://vuldb.com/vuln/398424/cti" ], "timeline": [ { "at": "2026-09-03T23:17:20.630", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85225" } ] }, { "id": "CVE-2026-85207", "vendor": "itsourcecode", "product": "Online Medicine Delivery System", "title": "Online Medicine Delivery System vulnerability", "summary": "A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.", "updated_at": "2026-09-05T03:17:16.520", "published_at": "2026-09-03T20:17:27.613", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/boyslikesports/202607_vul_dir/blob/main/H-06-XSS-Reflected-OrderDetails_en.md", "https://itsourcecode.com/", "https://vuldb.com/cve/CVE-2026-85207", "https://vuldb.com/submit/892997", "https://vuldb.com/vuln/398415", "https://vuldb.com/vuln/398415/cti" ], "timeline": [ { "at": "2026-09-03T20:17:27.613", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85207" } ] }, { "id": "CVE-2026-85046", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)", "updated_at": "2026-09-05T04:18:05.170", "published_at": "2026-09-03T20:17:24.210", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 75, "confidence_label": "observed", "affected": "152.0.7977.82 through before 152.0.7977.82 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": true, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-843", "what_happened": "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html", "https://issues.chromium.org/issues/542403045", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046" ], "timeline": [ { "at": "2026-09-03T20:17:24.210", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85046" }, { "at": "2026-09-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-84934", "vendor": "Unknown", "product": "JCH Optimize", "title": "JCH Optimize vulnerability", "summary": "The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.", "updated_at": "2026-09-05T07:17:14.690", "published_at": "2026-09-05T07:17:14.690", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 6.0.1 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/d808ad17-d20e-4ee5-94f3-935c10cde772/" ], "timeline": [ { "at": "2026-09-05T07:17:14.690", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84934" } ] }, { "id": "CVE-2026-84931", "vendor": "Unknown", "product": "Joli Table Of Contents", "title": "Joli Table Of Contents vulnerability", "summary": "The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of any user who views the post, including higher-privileged users such as administrators. This crosses a privilege boundary even on multisite, where such users are not permitted to post unfiltered HTML.", "updated_at": "2026-09-05T07:17:14.600", "published_at": "2026-09-05T07:17:14.600", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 3.0.3 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of any user who views the post, including higher-privileged users such as administrators. This crosses a privilege boundary even on multisite, where such users are not permitted to post unfiltered HTML.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/0dc8747c-14c2-4bb2-9b99-7978ff5128f5/" ], "timeline": [ { "at": "2026-09-05T07:17:14.600", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84931" } ] }, { "id": "CVE-2026-84930", "vendor": "Unknown", "product": "CatFolders Document Gallery & PDF Library", "title": "CatFolders Document Gallery & PDF Library vulnerability", "summary": "The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post.", "updated_at": "2026-09-05T07:17:14.503", "published_at": "2026-09-05T07:17:14.503", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 2.0.7 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/c38b69f2-60cb-46b3-aa81-451ac062f5c7/" ], "timeline": [ { "at": "2026-09-05T07:17:14.503", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84930" } ] }, { "id": "CVE-2026-84927", "vendor": "Unknown", "product": "EmbedPress", "title": "EmbedPress vulnerability", "summary": "The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.", "updated_at": "2026-09-05T07:17:14.410", "published_at": "2026-09-05T07:17:14.410", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "4.6.0 through before 4.6.4 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/12984501-5d93-4941-9e12-6bb8049bd23d/" ], "timeline": [ { "at": "2026-09-05T07:17:14.410", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84927" } ] }, { "id": "CVE-2026-84926", "vendor": "Unknown", "product": "EmbedPress", "title": "EmbedPress vulnerability", "summary": "The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.", "updated_at": "2026-09-05T07:17:14.317", "published_at": "2026-09-05T07:17:14.317", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "4.6.0 through before 4.6.4 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/5f1bc0f2-1112-4f75-b2b6-27498e43cd4b/" ], "timeline": [ { "at": "2026-09-05T07:17:14.317", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84926" } ] }, { "id": "CVE-2026-84901", "vendor": "Unknown", "product": "Eventin", "title": "Eventin vulnerability", "summary": "The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.", "updated_at": "2026-09-05T07:17:14.227", "published_at": "2026-09-05T07:17:14.227", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 4.1.22 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/b1906fd4-82ab-435f-bb07-e8f2db402029/" ], "timeline": [ { "at": "2026-09-05T07:17:14.227", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84901" } ] }, { "id": "CVE-2026-84899", "vendor": "Unknown", "product": "VikWidgetsLoader", "title": "VikWidgetsLoader vulnerability", "summary": "The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator who reviews the pending submission.", "updated_at": "2026-09-05T07:17:14.127", "published_at": "2026-09-05T07:17:14.127", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "1.11.0 through before 1.12.0 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator who reviews the pending submission.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/4e0beb72-d73b-4802-894d-141aadbd8d4f/" ], "timeline": [ { "at": "2026-09-05T07:17:14.127", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84899" } ] }, { "id": "CVE-2026-84898", "vendor": "Unknown", "product": "Eventin", "title": "Eventin vulnerability", "summary": "The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.", "updated_at": "2026-09-05T07:17:14.033", "published_at": "2026-09-05T07:17:14.033", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 4.1.21 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/d8dea263-5676-4e3c-9ea4-36904e1ac4d3/" ], "timeline": [ { "at": "2026-09-05T07:17:14.033", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84898" } ] }, { "id": "CVE-2026-84896", "vendor": "Unknown", "product": "King Addons for Elementor", "title": "King Addons for Elementor vulnerability", "summary": "The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.", "updated_at": "2026-09-05T07:17:13.940", "published_at": "2026-09-05T07:17:13.940", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 51.1.77 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/fe9ac024-53dc-48a3-99c8-1ec97c84c959/" ], "timeline": [ { "at": "2026-09-05T07:17:13.940", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84896" } ] }, { "id": "CVE-2026-84745", "vendor": "Unknown", "product": "The Events Calendar", "title": "The Events Calendar vulnerability", "summary": "The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.", "updated_at": "2026-09-05T07:17:13.850", "published_at": "2026-09-05T07:17:13.850", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 6.17.3.1 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/cf23ee00-322c-4443-a50d-a91f90d179aa/" ], "timeline": [ { "at": "2026-09-05T07:17:13.850", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84745" } ] }, { "id": "CVE-2026-84225", "vendor": "Unknown", "product": "Kirki", "title": "Kirki vulnerability", "summary": "The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.", "updated_at": "2026-09-05T07:17:13.760", "published_at": "2026-09-05T07:17:13.760", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "6.0.0 through before 6.3.0 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/9f83f0a2-7d77-49a2-a23a-03f787e2e356/" ], "timeline": [ { "at": "2026-09-05T07:17:13.760", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84225" } ] }, { "id": "CVE-2026-84221", "vendor": "Unknown", "product": "Kirki", "title": "Kirki vulnerability", "summary": "The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.", "updated_at": "2026-09-05T07:17:13.667", "published_at": "2026-09-05T07:17:13.667", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "6.0.0 through before 6.3.0 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/6c34da62-46fb-4dd4-a433-bd3df4d9fcfd/" ], "timeline": [ { "at": "2026-09-05T07:17:13.667", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84221" } ] }, { "id": "CVE-2026-84022", "vendor": "Unknown", "product": "Bold Page Builder", "title": "Bold Page Builder vulnerability", "summary": "The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.", "updated_at": "2026-09-05T07:17:13.573", "published_at": "2026-09-05T07:17:13.573", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 5.9.8 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/53bbe80c-caea-4893-82a6-03e5173390de/" ], "timeline": [ { "at": "2026-09-05T07:17:13.573", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84022" } ] }, { "id": "CVE-2026-84021", "vendor": "Unknown", "product": "Bold Page Builder", "title": "Bold Page Builder vulnerability", "summary": "The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.", "updated_at": "2026-09-05T07:17:13.470", "published_at": "2026-09-05T07:17:13.470", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 5.9.8 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/ca226eab-59a2-42d5-96f6-84dacf7c6c5a/" ], "timeline": [ { "at": "2026-09-05T07:17:13.470", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84021" } ] }, { "id": "CVE-2026-83711", "vendor": "Microsoft", "product": "Entra", "title": "Entra vulnerability", "summary": "Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.", "updated_at": "2026-09-05T04:18:05.063", "published_at": "2026-09-03T23:17:20.500", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "-", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-639", "what_happened": "Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83711" ], "timeline": [ { "at": "2026-09-03T23:17:20.500", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83711" } ] }, { "id": "CVE-2026-83628", "vendor": "jfarthing84", "product": "Theme My Login", "title": "Theme My Login vulnerability", "summary": "The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failing to enforce the network's `active_signup` registration policy, checking only `is_user_logged_in()` while sibling branches such as `validate-blog-signup` apply the full policy gate. This makes it possible for authenticated attackers, with Subscriber-level access and above, to directly POST `stage=gimmeanotherblog` to Theme My Login's signup route, bypassing the configured registration policy entirely — even when it is set to `none` or `user` — which causes `wpmu_create_blog()` to execute with the attacker's user ID, after which WordPress core assigns the Administrator role on the newly created subsite via `add_user_to_blog()`. The privilege gain is scoped to the newly created subsite only; the attacker's account retains Subscriber-level access on the main site and does not obtain Super Admin or network-level capabilities such as `manage_network` or `manage_sites`.", "updated_at": "2026-09-05T06:17:10.230", "published_at": "2026-09-05T06:17:10.230", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 7.1.15 (semver)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failing to enforce the network's `active_signup` registration policy, checking only `is_user_logged_in()` while sibling branches such as `validate-blog-signup` apply the full policy gate. This makes it possible for authenticated attackers, with Subscriber-level access and above, to directly POST `stage=gimmeanotherblog` to Theme My Login's signup route, bypassing the configured registration policy entirely — even when it is set to `none` or `user` — which causes `wpmu_create_blog()` to execute with the attacker's user ID, after which WordPress core assigns the Administrator role on the newly created subsite via `add_user_to_blog()`. The privilege gain is scoped to the newly created subsite only; the attacker's account retains Subscriber-level access on the main site and does not obtain Super Admin or network-level capabilities such as `manage_network` or `manage_sites`.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/theme-my-login/tags/7.1.15/includes/ms-functions.php#L580", "https://plugins.trac.wordpress.org/browser/theme-my-login/tags/7.1.15/includes/ms-functions.php#L661", "https://plugins.trac.wordpress.org/browser/theme-my-login/tags/7.1.15/includes/ms-functions.php#L708", "https://plugins.trac.wordpress.org/changeset/3669721/theme-my-login/trunk/includes/ms-functions.php", "https://plugins.trac.wordpress.org/changeset?old_path=%2Ftheme-my-login/tags/7.1.15&new_path=%2Ftheme-my-login/tags/7.2.0", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3669722%40theme-my-login%2Ftags%2F7.2.0&old=3643898%40theme-my-login%2Ftags%2F7.1.15", "https://www.wordfence.com/threat-intel/vulnerabilities/id/72585c12-baa9-4c63-8584-906a1d3b332f?source=cve" ], "timeline": [ { "at": "2026-09-05T06:17:10.230", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83628" } ] }, { "id": "CVE-2026-83627", "vendor": "wpmudev", "product": "Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN", "title": "Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN vulnerability", "summary": "The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\\Core\\Filesystem; when the log is created during a front-end request the header is therefore omitted entirely. get_cookies() then writes the raw name of any cookie matching the wphb_cache_ prefix into that file without sanitization. This makes it possible for unauthenticated attackers to write arbitrary PHP into the log file with a single anonymous request and execute it by requesting the file directly, resulting in full remote code execution. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option (non-default), and the log file to be created during a front-end request — a state reached by the plugin's own 'Clear logs' action, any cache flush, or unattended via the plugin's daily log-rotation cron, which can strip the protective header from an existing log file.", "updated_at": "2026-09-05T06:17:10.080", "published_at": "2026-09-05T06:17:10.080", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.21.0 (semver)", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-94", "what_happened": "The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\\Core\\Filesystem; when the log is created during a front-end request the header is therefore omitted entirely. get_cookies() then writes the raw name of any cookie matching the wphb_cache_ prefix into that file without sanitization. This makes it possible for unauthenticated attackers to write arbitrary PHP into the log file with a single anonymous request and execute it by requesting the file directly, resulting in full remote code execution. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option (non-default), and the log file to be created during a front-end request — a state reached by the plugin's own 'Clear logs' action, any cache flush, or unattended via the plugin's daily log-rotation cron, which can strip the protective header from an existing log file.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/hummingbird-performance/trunk/core/modules/class-page-cache.php#L1973", "https://plugins.trac.wordpress.org/browser/hummingbird-performance/trunk/core/modules/class-page-cache.php#L1982", "https://plugins.trac.wordpress.org/browser/hummingbird-performance/trunk/core/modules/class-page-cache.php#L749", "https://plugins.trac.wordpress.org/browser/hummingbird-performance/trunk/core/modules/class-page-cache.php#L752", "https://plugins.trac.wordpress.org/changeset/3675836/hummingbird-performance/trunk/core/modules/class-page-cache.php", "https://plugins.trac.wordpress.org/changeset?old_path=%2Fhummingbird-performance/tags/3.20.0&new_path=%2Fhummingbird-performance/tags/3.21.2", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3675836%40hummingbird-performance%2Ftags%2F3.21.2&old=3614991%40hummingbird-performance%2Ftags%2F3.20.0", "https://www.wordfence.com/threat-intel/vulnerabilities/id/65c3ca36-79e6-47f8-9524-27e7631f4caf?source=cve" ], "timeline": [ { "at": "2026-09-05T06:17:10.080", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83627" } ] }, { "id": "CVE-2026-83625", "vendor": "supsysticcom", "product": "Contact Form by Supsystic", "title": "Contact Form by Supsystic vulnerability", "summary": "The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can first call the 'updateNonce' action — which is accessible without authentication due to its absence from the plugin's permission list — to obtain a valid nonce, then submit a contact form with a malicious payload in a spoofed IP header such as X-Forwarded-For.", "updated_at": "2026-09-05T08:16:40.857", "published_at": "2026-09-05T08:16:40.857", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.10.2 (semver)", "fixed": "See vendor advisory", "source_count": 12, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can first call the 'updateNonce' action — which is accessible without authentication due to its absence from the plugin's permission list — to obtain a valid nonce, then submit a contact form with a malicious payload in a spoofed IP header such as X-Forwarded-For.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.10.2/classes/utils.php#L77", "https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.10.2/modules/forms/controller.php#L390", "https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.10.2/modules/forms/controller.php#L411", "https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.10.2/modules/forms/js/admin.forms.contacts.list.js#L204", "https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.10.2/modules/forms/models/forms.php#L103", "https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.8.1/classes/utils.php#L77", "https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.8.1/modules/forms/controller.php#L390", "https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.8.1/modules/forms/controller.php#L411", "https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.8.1/modules/forms/js/admin.forms.contacts.list.js#L204", "https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.8.1/modules/forms/models/forms.php#L103", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3679442%40contact-form-by-supsystic&new=3679442%40contact-form-by-supsystic", "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa65bced-a449-4ba5-accf-40a824ee464d?source=cve" ], "timeline": [ { "at": "2026-09-05T08:16:40.857", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83625" } ] }, { "id": "CVE-2026-83549", "vendor": "SonicWall", "product": "SMA1000 Appliances", "title": "SonicWall SMA1000 Appliances OS Command Injection Vulnerability", "summary": "SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 9, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-83548", "vendor": "SonicWall", "product": "SMA1000 Appliances", "title": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability", "summary": "SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 9, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-83544", "vendor": "Unknown", "product": "Greenshift", "title": "Greenshift vulnerability", "summary": "The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.", "updated_at": "2026-09-05T07:17:13.373", "published_at": "2026-09-05T07:17:13.373", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 13.2.0 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/f2bd202b-43fc-4ca7-9bab-649ed87e7cbd/" ], "timeline": [ { "at": "2026-09-05T07:17:13.373", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83544" } ] }, { "id": "CVE-2026-83543", "vendor": "Unknown", "product": "Greenshift", "title": "Greenshift vulnerability", "summary": "The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.", "updated_at": "2026-09-05T07:17:13.280", "published_at": "2026-09-05T07:17:13.280", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 13.2.0 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/902e46ad-e577-4a3e-be19-a3bcc75ece77/" ], "timeline": [ { "at": "2026-09-05T07:17:13.280", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83543" } ] }, { "id": "CVE-2026-82846", "vendor": "Unknown", "product": "Masteriyo LMS", "title": "Masteriyo LMS vulnerability", "summary": "The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.", "updated_at": "2026-09-05T07:17:13.187", "published_at": "2026-09-05T07:17:13.187", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "1.18.0 through before 3.4.0 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/0ee2052c-90a8-4b98-947a-adc55feb1de7/" ], "timeline": [ { "at": "2026-09-05T07:17:13.187", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82846" } ] }, { "id": "CVE-2026-82329", "vendor": "JFrog", "product": "Artifactory", "title": "JFrog Artifactory Improper Authentication Vulnerability", "summary": "JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 9, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-82304", "vendor": "Unknown", "product": "Music Store", "title": "Music Store vulnerability", "summary": "The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.", "updated_at": "2026-09-05T07:17:13.090", "published_at": "2026-09-05T07:17:13.090", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "1.0.245 through before 1.4.5 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/0a4d2ffc-a437-430e-a760-d8d7fb388f0c/" ], "timeline": [ { "at": "2026-09-05T07:17:13.090", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82304" } ] }, { "id": "CVE-2026-82078", "vendor": "PaperCut", "product": "NG/MF", "title": "PaperCut NG/MF Unsafe Reflection Vulnerability", "summary": "PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.", "updated_at": "2026-08-30T22:00:00Z", "published_at": "2026-08-30T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-30T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-81578", "vendor": "PaperCut", "product": "NG/MF", "title": "PaperCut NG/MF Missing Authentication for Critical Function Vulnerability", "summary": "PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.", "updated_at": "2026-08-30T22:00:00Z", "published_at": "2026-08-30T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-30T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-31", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-81543", "vendor": "Tyche Softwares", "product": "Abandoned Cart Pro for WooCommerce", "title": "Abandoned Cart Pro for WooCommerce vulnerability", "summary": "The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.", "updated_at": "2026-09-05T08:16:40.730", "published_at": "2026-09-05T08:16:40.730", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 10.7.1 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-269", "what_happened": "The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://woocommerce.com/products/abandoned-cart-pro/", "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d8aa73-2e68-4353-a603-6fb61ab3406b?source=cve" ], "timeline": [ { "at": "2026-09-05T08:16:40.730", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81543" } ] }, { "id": "CVE-2026-81424", "vendor": "Unknown", "product": "Accept Stripe Payments", "title": "Accept Stripe Payments vulnerability", "summary": "The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing unauthenticated attackers who complete a genuine payment to obtain fulfilment for a different, equal- or lower-priced product than the one they paid for.", "updated_at": "2026-09-05T07:17:12.997", "published_at": "2026-09-05T07:17:12.997", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 2.1.4 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing unauthenticated attackers who complete a genuine payment to obtain fulfilment for a different, equal- or lower-priced product than the one they paid for.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/64c20ce4-d94d-4f09-8d95-9ba232066f62/" ], "timeline": [ { "at": "2026-09-05T07:17:12.997", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81424" } ] }, { "id": "CVE-2026-81423", "vendor": "Unknown", "product": "Accept Stripe Payments", "title": "Accept Stripe Payments vulnerability", "summary": "The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.", "updated_at": "2026-09-05T07:17:12.900", "published_at": "2026-09-05T07:17:12.900", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 2.1.4 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/0e4bbbde-b93e-4b58-8baf-301073e9a0c5/" ], "timeline": [ { "at": "2026-09-05T07:17:12.900", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81423" } ] }, { "id": "CVE-2026-81404", "vendor": "Unknown", "product": "IPGP Visitors Origin", "title": "IPGP Visitors Origin vulnerability", "summary": "The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request.", "updated_at": "2026-09-05T07:17:12.810", "published_at": "2026-09-05T07:17:12.810", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "1.3 through before 1.6 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/8fbfb296-78d8-4f3b-ab21-7a5a4e0ea421/" ], "timeline": [ { "at": "2026-09-05T07:17:12.810", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81404" } ] }, { "id": "CVE-2026-81348", "vendor": "Unknown", "product": "My Private Site", "title": "My Private Site vulnerability", "summary": "The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login.", "updated_at": "2026-09-05T07:17:12.710", "published_at": "2026-09-05T07:17:12.710", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 4.2.3 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/54228ea4-eec6-4752-a16e-85209d4445b0/" ], "timeline": [ { "at": "2026-09-05T07:17:12.710", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81348" } ] }, { "id": "CVE-2026-80098", "vendor": "Microsoft", "product": "Microsoft Copilot Studio", "title": "Microsoft Copilot Studio vulnerability", "summary": "Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.", "updated_at": "2026-09-05T04:18:04.943", "published_at": "2026-09-03T23:17:20.350", "cvss": 9.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "-", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-347", "what_happened": "Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80098" ], "timeline": [ { "at": "2026-09-03T23:17:20.350", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80098" } ] }, { "id": "CVE-2026-78438", "vendor": "boldgrid", "product": "W3 Total Cache", "title": "W3 Total Cache vulnerability", "summary": "The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the \"Lazy Load Images\" feature with \"Process background images\" to be enabled, and the malicious comment to be approved by a moderator before execution is triggered.", "updated_at": "2026-09-05T07:17:12.580", "published_at": "2026-09-05T07:17:12.580", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.10.5 (semver)", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the \"Lazy Load Images\" feature with \"Process background images\" to be enabled, and the malicious comment to be approved by a moderator before execution is triggered.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.5/UserExperience_LazyLoad_Mutator.php#L255", "https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.5/UserExperience_LazyLoad_Mutator.php#L293", "https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.5/UserExperience_LazyLoad_Mutator.php#L91", "https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.5/UserExperience_LazyLoad_Plugin.php#L87", "https://plugins.trac.wordpress.org/changeset/3680101/w3-total-cache/tags/2.10.6/UserExperience_LazyLoad_Mutator.php", "https://plugins.trac.wordpress.org/changeset?old_path=%2Fw3-total-cache/tags/2.10.5&new_path=%2Fw3-total-cache/tags/2.10.6", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3680101%40w3-total-cache%2Ftags%2F2.10.6&old=3653442%40w3-total-cache%2Ftags%2F2.10.5", "https://www.wordfence.com/threat-intel/vulnerabilities/id/5580ad05-af50-4899-9cbf-39ad8000eb6a?source=cve" ], "timeline": [ { "at": "2026-09-05T07:17:12.580", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78438" } ] }, { "id": "CVE-2026-78408", "vendor": "Red Hat", "product": "Red Hat Hardened Images", "title": "Red Hat Hardened Images vulnerability", "summary": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "updated_at": "2026-09-05T14:17:23.727", "published_at": "2026-09-02T16:17:23.687", "cvss": 7.9, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-775", "what_happened": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "http://www.openwall.com/lists/oss-security/2026/09/05/2" ], "timeline": [ { "at": "2026-09-02T16:17:23.687", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78408" } ] }, { "id": "CVE-2026-78362", "vendor": "Unknown", "product": "SEO Flow by LupsOnline", "title": "SEO Flow by LupsOnline vulnerability", "summary": "The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.", "updated_at": "2026-09-05T07:17:12.487", "published_at": "2026-09-05T07:17:12.487", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "3.0.0 through before 3.0.3 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/0833424b-1231-4a48-be90-13fe4edc60c9/" ], "timeline": [ { "at": "2026-09-05T07:17:12.487", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78362" } ] }, { "id": "CVE-2026-78150", "vendor": "Unknown", "product": "Smart Post", "title": "Smart Post vulnerability", "summary": "The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata.", "updated_at": "2026-09-05T07:17:12.393", "published_at": "2026-09-05T07:17:12.393", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "4.0.0 through before 4.0.8 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/e6c8a115-88a2-4fdf-9b97-8ae8a8c7f0aa/" ], "timeline": [ { "at": "2026-09-05T07:17:12.393", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78150" } ] }, { "id": "CVE-2026-78149", "vendor": "Unknown", "product": "Smart Post", "title": "Smart Post vulnerability", "summary": "The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it.", "updated_at": "2026-09-05T07:17:12.300", "published_at": "2026-09-05T07:17:12.300", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "4.0.0 through before 4.0.8 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/8140528f-27d4-485c-ad63-4dcaa3932af2/" ], "timeline": [ { "at": "2026-09-05T07:17:12.300", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78149" } ] }, { "id": "CVE-2026-77830", "vendor": "cleantalk", "product": "Spam protection, Honeypot, Anti-Spam by CleanTalk", "title": "Spam protection, Honeypot, Anti-Spam by CleanTalk vulnerability", "summary": "The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is deliverable via unauthenticated comment submission and executes exclusively for non-logged-in visitors; if comment moderation is enabled, an approving moderator must first publish the comment before the script reaches other users.", "updated_at": "2026-09-05T07:17:12.163", "published_at": "2026-09-05T07:17:12.163", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.86 (semver)", "fixed": "See vendor advisory", "source_count": 12, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is deliverable via unauthenticated comment submission and executes exclusively for non-logged-in visitors; if comment moderation is enabled, an approving moderator must first publish the comment before the script reaches other users.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.84/cleantalk.php#L234", "https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.84/lib/Cleantalk/ApbctWP/ContactsEncoder/ContactsEncoder.php#L114", "https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.84/lib/Cleantalk/Common/ContactsEncoder/ContactsEncoder.php#L914", "https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.84/lib/Cleantalk/Common/ContactsEncoder/ContactsEncoder.php#L933", "https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.85/cleantalk.php#L234", "https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.85/lib/Cleantalk/ApbctWP/ContactsEncoder/ContactsEncoder.php#L114", "https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.85/lib/Cleantalk/Common/ContactsEncoder/ContactsEncoder.php#L914", "https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.85/lib/Cleantalk/Common/ContactsEncoder/ContactsEncoder.php#L933", "https://plugins.trac.wordpress.org/changeset/3677388/cleantalk-spam-protect/trunk/lib/Cleantalk/Common/ContactsEncoder/ContactsEncoder.php", "https://plugins.trac.wordpress.org/changeset?old_path=%2Fcleantalk-spam-protect/tags/6.86&new_path=%2Fcleantalk-spam-protect/tags/6.87", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3677388%40cleantalk-spam-protect%2Ftags%2F6.87&old=3654120%40cleantalk-spam-protect%2Ftags%2F6.86", "https://www.wordfence.com/threat-intel/vulnerabilities/id/10e7000b-597a-4165-8604-cb6b29714abb?source=cve" ], "timeline": [ { "at": "2026-09-05T07:17:12.163", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77830" } ] }, { "id": "CVE-2026-77826", "vendor": "Unknown", "product": "RegistrationMagic", "title": "RegistrationMagic vulnerability", "summary": "The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.", "updated_at": "2026-09-05T07:17:12.063", "published_at": "2026-09-05T07:17:12.063", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "5.0.1.8 through before 6.0.9.9 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/b79a83e8-d7b0-4aa8-b2ba-37a7eecd437b/" ], "timeline": [ { "at": "2026-09-05T07:17:12.063", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77826" } ] }, { "id": "CVE-2026-77263", "vendor": "iubenda", "product": "iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more", "title": "iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more vulnerability", "summary": "The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit works by embedding KSES-allowed markup such as abbr title attributes and HTML comments in a submitted comment so that the global strtr() substitution strips substrings from an inert tag, mutating it into an executable element such as an img onerror handler that runs in the WordPress origin for any visitor, including logged-in administrators.", "updated_at": "2026-09-05T06:17:09.950", "published_at": "2026-09-05T06:17:09.950", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.13.4 (semver)", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit works by embedding KSES-allowed markup such as abbr title attributes and HTML comments in a submitted comment so that the global strtr() substitution strips substrings from an inert tag, mutating it into an executable element such as an img onerror handler that runs in the WordPress origin for any visitor, including logged-in administrators.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/iubenda-cookie-law-solution/trunk/iubenda-cookie-class/iubenda.class.php#L381", "https://plugins.trac.wordpress.org/browser/iubenda-cookie-law-solution/trunk/iubenda-cookie-class/iubenda.class.php#L941", "https://plugins.trac.wordpress.org/browser/iubenda-cookie-law-solution/trunk/iubenda_cookie_solution.php#L834", "https://plugins.trac.wordpress.org/browser/iubenda-cookie-law-solution/trunk/iubenda_cookie_solution.php#L857", "https://plugins.trac.wordpress.org/changeset/3675630/iubenda-cookie-law-solution/trunk/iubenda-cookie-class/iubenda.class.php", "https://plugins.trac.wordpress.org/changeset?old_path=%2Fiubenda-cookie-law-solution/tags/3.13.4&new_path=%2Fiubenda-cookie-law-solution/tags/3.13.5", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3675630%40iubenda-cookie-law-solution%2Ftags%2F3.13.5&old=3663183%40iubenda-cookie-law-solution%2Ftags%2F3.13.4", "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8d18aaa-c8f4-4688-841d-2a77b71b60b0?source=cve" ], "timeline": [ { "at": "2026-09-05T06:17:09.950", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77263" } ] }, { "id": "CVE-2026-77233", "vendor": "iubenda", "product": "iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more", "title": "iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more vulnerability", "summary": "The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only manifests when the 'Secondary' parser engine is active (parser_engine=default); it does not exist under the default 'new' DOM-based parser engine.", "updated_at": "2026-09-05T06:17:09.780", "published_at": "2026-09-05T06:17:09.780", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.13.4 (semver)", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only manifests when the 'Secondary' parser engine is active (parser_engine=default); it does not exist under the default 'new' DOM-based parser engine.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/iubenda-cookie-law-solution/tags/3.13.2/iubenda-cookie-class/iubenda.class.php#L557", "https://plugins.trac.wordpress.org/browser/iubenda-cookie-law-solution/tags/3.13.2/iubenda-cookie-class/iubenda.class.php#L570", "https://plugins.trac.wordpress.org/browser/iubenda-cookie-law-solution/tags/3.13.2/iubenda_cookie_solution.php#L986", "https://plugins.trac.wordpress.org/browser/iubenda-cookie-law-solution/tags/3.13.3/iubenda-cookie-class/iubenda.class.php#L557", "https://plugins.trac.wordpress.org/browser/iubenda-cookie-law-solution/tags/3.13.3/iubenda-cookie-class/iubenda.class.php#L570", "https://plugins.trac.wordpress.org/browser/iubenda-cookie-law-solution/tags/3.13.3/iubenda_cookie_solution.php#L986", "https://plugins.trac.wordpress.org/changeset/3675630/iubenda-cookie-law-solution/trunk/iubenda-cookie-class/iubenda.class.php", "https://plugins.trac.wordpress.org/changeset?old_path=%2Fiubenda-cookie-law-solution/tags/3.13.4&new_path=%2Fiubenda-cookie-law-solution/tags/3.13.5", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3675630%40iubenda-cookie-law-solution%2Ftags%2F3.13.5&old=3663183%40iubenda-cookie-law-solution%2Ftags%2F3.13.4", "https://www.wordfence.com/threat-intel/vulnerabilities/id/af459f28-a058-42d3-8818-43603c6a14eb?source=cve" ], "timeline": [ { "at": "2026-09-05T06:17:09.780", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77233" } ] }, { "id": "CVE-2026-76904", "vendor": "Unknown vendor", "product": "Unknown product", "title": "PostGIS SQL Injection GeoTools", "summary": "PostGIS SQL Injection GeoTools", "updated_at": "2026-08-26T10:47:23Z", "published_at": "2026-08-26T10:47:23Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 27, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · bickZero93/CVE-2026-76904", "author": "bickZero93", "first_seen": "2026-08-26", "last_seen": "2026-08-26T10:47:23Z", "pushed_at": "2026-08-26T10:47:14Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Injection", "language": "Python", "stars": 0, "forks": 0, "topics": [], "title": "PostGIS SQL Injection GeoTools", "repository_description": "PostGIS SQL Injection GeoTools", "summary": "PostGIS SQL Injection GeoTools", "source": "CVE-Intel", "url": "https://github.com/bickZero93/CVE-2026-76904" }, { "repository": "CVE-Intel · YonLiud/CVE-2026-76904", "author": "YonLiud", "first_seen": "2026-08-16", "last_seen": "2026-08-26T08:47:17Z", "pushed_at": "2026-08-22T20:10:52Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 3, "forks": 1, "topics": [ "exploit", "geoserver", "poc", "rce", "zero-day" ], "title": "One-Day POC | GeoServer Unauthenticated SQL injection to complete RCE", "repository_description": "One-Day POC | GeoServer Unauthenticated SQL injection to complete RCE", "summary": "One-Day POC | GeoServer Unauthenticated SQL injection to complete RCE", "source": "CVE-Intel", "url": "https://github.com/YonLiud/CVE-2026-76904" } ], "references": [ "https://github.com/bickZero93/CVE-2026-76904", "https://github.com/YonLiud/CVE-2026-76904" ], "timeline": [ { "at": "2026-08-26T10:47:23Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/bickZero93/CVE-2026-76904" } ] }, { "id": "CVE-2026-76573", "vendor": "sc0ttkclark", "product": "Pods – Custom Content Types and Fields", "title": "Pods – Custom Content Types and Fields vulnerability", "summary": "The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_found' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "updated_at": "2026-09-05T09:16:50.010", "published_at": "2026-09-05T09:16:50.010", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.3.9.1 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_found' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/pods/tags/3.3.9.1/classes/PodsInit.php#L514", "https://plugins.trac.wordpress.org/browser/pods/tags/3.3.9.1/includes/general.php#L1399", "https://plugins.trac.wordpress.org/browser/pods/tags/3.3.9.1/includes/general.php#L2535", "https://plugins.trac.wordpress.org/browser/pods/tags/3.3.9.1/includes/general.php#L2539", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3674726%40pods&new=3674726%40pods", "https://www.wordfence.com/threat-intel/vulnerabilities/id/82ca2dfc-a820-49d7-bb73-38dbb8406841?source=cve" ], "timeline": [ { "at": "2026-09-05T09:16:50.010", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76573" } ] }, { "id": "CVE-2026-76139", "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "title": "Red Hat Advanced Cluster Management for Kubernetes 2.11 vulnerability", "summary": "A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.", "updated_at": "2026-09-05T15:17:31.240", "published_at": "2026-08-19T21:17:38.070", "cvss": 8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "High", "cwe": "CWE-829", "what_happened": "A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:60399", "https://access.redhat.com/errata/RHSA-2026:60400", "https://access.redhat.com/errata/RHSA-2026:60401", "https://access.redhat.com/errata/RHSA-2026:60402", "https://access.redhat.com/errata/RHSA-2026:60403", "https://access.redhat.com/errata/RHSA-2026:60404", "https://access.redhat.com/security/cve/CVE-2026-76139", "https://bugzilla.redhat.com/show_bug.cgi?id=2519852" ], "timeline": [ { "at": "2026-08-19T21:17:38.070", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76139" } ] }, { "id": "CVE-2026-75604", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-75604 Next.js Windows RCE poc", "summary": "CVE-2026-75604 Next.js Windows RCE poc", "updated_at": "2026-08-26T12:23:33Z", "published_at": "2026-08-26T12:23:33Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 27, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · rafabd1/CVE-2026-75604-poc", "author": "rafabd1", "first_seen": "2026-08-25", "last_seen": "2026-08-26T12:23:33Z", "pushed_at": "2026-08-26T02:23:42Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 13, "forks": 13, "topics": [], "title": "CVE-2026-75604 Next.js Windows RCE poc", "repository_description": "CVE-2026-75604 Next.js Windows RCE poc", "summary": "CVE-2026-75604 Next.js Windows RCE poc", "source": "CVE-Intel", "url": "https://github.com/rafabd1/CVE-2026-75604-poc" }, { "repository": "CVE-Intel · HackSpeak/CVE-2026-75604", "author": "HackSpeak", "first_seen": "2026-08-26", "last_seen": "2026-08-26T11:54:40Z", "pushed_at": "2026-08-26T11:54:05Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 1, "forks": 0, "topics": [], "title": "CVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing", "repository_description": "CVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing", "summary": "CVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing", "source": "CVE-Intel", "url": "https://github.com/HackSpeak/CVE-2026-75604" } ], "references": [ "https://github.com/rafabd1/CVE-2026-75604-poc", "https://github.com/HackSpeak/CVE-2026-75604" ], "timeline": [ { "at": "2026-08-26T12:23:33Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/rafabd1/CVE-2026-75604-poc" } ] }, { "id": "CVE-2026-75586", "vendor": "unitecms", "product": "Unlimited Elements For Elementor", "title": "Unlimited Elements For Elementor vulnerability", "summary": "The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping; when the response is served as text/html rather than application/json, the browser parses the injected markup.", "updated_at": "2026-09-05T08:16:40.600", "published_at": "2026-09-05T08:16:40.600", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.0.17 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping; when the response is served as text/html rather than application/json, the browser parses the injected markup.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/framework/helper_base.class.php#L44", "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_filters_process.class.php#L4083", "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L1159", "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L179", "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/core/unlimited_elements/helper_provider_core.class.php#L746", "https://www.wordfence.com/threat-intel/vulnerabilities/id/522bdd65-8077-4cd4-800a-e6ef9a982d33?source=cve" ], "timeline": [ { "at": "2026-09-05T08:16:40.600", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75586" } ] }, { "id": "CVE-2026-75018", "vendor": "outlawgt", "product": "Custom Contact Forms", "title": "Custom Contact Forms vulnerability", "summary": "The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.", "updated_at": "2026-09-05T08:16:40.397", "published_at": "2026-09-05T08:16:40.397", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 7.16 (semver)", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.0/classes/class-ccf-api-form-controller.php#L1026", "https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.0/classes/class-ccf-api-form-controller.php#L291", "https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.0/classes/class-ccf-api-form-controller.php#L336", "https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.0/classes/class-ccf-api-form-controller.php#L360", "https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.0/classes/class-ccf-api-form-controller.php#L977", "https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.0/classes/class-ccf-api-form-controller.php#L993", "https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.2/classes/class-ccf-api-form-controller.php#L1026", "https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.2/classes/class-ccf-api-form-controller.php#L291", "https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.2/classes/class-ccf-api-form-controller.php#L336", "https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.2/classes/class-ccf-api-form-controller.php#L360", "https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.2/classes/class-ccf-api-form-controller.php#L977", "https://plugins.trac.wordpress.org/browser/custom-contact-forms/tags/7.15.2/classes/class-ccf-api-form-controller.php#L993", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3669565%40custom-contact-forms&new=3669565%40custom-contact-forms", "https://www.wordfence.com/threat-intel/vulnerabilities/id/9a34ec54-7629-4c14-b5e0-d47f5d3a72ce?source=cve" ], "timeline": [ { "at": "2026-09-05T08:16:40.397", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75018" } ] }, { "id": "CVE-2026-73683", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Laravel Socialite < 5.29.0 - Facebook OIDC Nonce Replay Authentication Bypass", "summary": "Laravel Socialite < 5.29.0 - Facebook OIDC Nonce Replay Authentication Bypass", "updated_at": "2026-08-20T22:00:00Z", "published_at": "2026-08-20T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 12, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Laravel Socialite < 5.29.0 - Facebook OIDC Nonce Replay Authentication Bypass", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CXSecurity WLB-2026080013", "author": "Mohammed Idrees Banyamer", "first_seen": "2026-08-21", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "Laravel Socialite < 5.29.0 - Facebook OIDC Nonce Replay Authentication Bypass", "summary": "Laravel Socialite < 5.29.0 - Facebook OIDC Nonce Replay Authentication Bypass", "what_happened": "Laravel Socialite < 5.29.0 - Facebook OIDC Nonce Replay Authentication Bypass", "cvss": 0, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "url": "https://cxsecurity.com/issue/WLB-2026080013", "cwe": "Unknown" } ], "references": [ "https://cxsecurity.com/issue/WLB-2026080013" ], "timeline": [ { "at": "2026-08-20T22:00:00Z", "label": "Discovered through CXSecurity", "url": "https://cxsecurity.com/issue/WLB-2026080013" } ] }, { "id": "CVE-2026-73570", "vendor": "Synacor", "product": "Zimbra Collaboration Suite (ZCS)", "title": "Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability", "summary": "Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.", "updated_at": "2026-08-26T09:01:39Z", "published_at": "2026-08-26T09:01:39Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 51, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · gabrielunknown/CVE-2026-73570", "author": "gabrielunknown", "first_seen": "2026-08-26", "last_seen": "2026-08-26T09:01:39Z", "pushed_at": "2026-08-26T04:14:30Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Perl", "stars": 1, "forks": 0, "topics": [], "title": "Zimbra SNMP Notification OS Command Injection — Unauthenticated RCE via SMTP exploit (Poc)", "repository_description": "Zimbra SNMP Notification OS Command Injection — Unauthenticated RCE via SMTP exploit (Poc)", "summary": "Zimbra SNMP Notification OS Command Injection — Unauthenticated RCE via SMTP exploit (Poc)", "source": "CVE-Intel", "url": "https://github.com/gabrielunknown/CVE-2026-73570" }, { "repository": "CVE-Intel · BiuTrap/CVE-2026-73570", "author": "BiuTrap", "first_seen": "2026-08-24", "last_seen": "2026-08-25T23:48:31Z", "pushed_at": "2026-08-25T23:48:28Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "PoC", "language": "", "stars": 0, "forks": 0, "topics": [], "title": "CVE-2026-73570 PoC", "repository_description": "CVE-2026-73570 PoC", "summary": "CVE-2026-73570 PoC", "source": "CVE-Intel", "url": "https://github.com/BiuTrap/CVE-2026-73570" }, { "repository": "CVE-Intel · HORKimhab/CVE-2026-73570", "author": "HORKimhab", "first_seen": "2026-08-21", "last_seen": "2026-08-25T19:43:29Z", "pushed_at": "2026-08-25T19:39:33Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 5, "forks": 1, "topics": [], "title": "CVE-2026-73570", "repository_description": "CVE-2026-73570", "summary": "CVE-2026-73570", "source": "CVE-Intel", "url": "https://github.com/HORKimhab/CVE-2026-73570" }, { "repository": "CVE-Intel · jishino567/CVE-2026-73570", "author": "jishino567", "first_seen": "2026-08-25", "last_seen": "2026-08-25T16:04:11Z", "pushed_at": "2026-08-25T10:36:17Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Injection", "language": "Python", "stars": 1, "forks": 0, "topics": [ "cve-2026-73570", "exploit", "zimbra", "zimbra-exploit" ], "title": "PoC for CVE-2026-73570 (Zimbra SMTP Command Injection)", "repository_description": "PoC for CVE-2026-73570 (Zimbra SMTP Command Injection)", "summary": "PoC for CVE-2026-73570 (Zimbra SMTP Command Injection)", "source": "CVE-Intel", "url": "https://github.com/jishino567/CVE-2026-73570" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://github.com/gabrielunknown/CVE-2026-73570", "https://github.com/BiuTrap/CVE-2026-73570", "https://github.com/HORKimhab/CVE-2026-73570", "https://github.com/jishino567/CVE-2026-73570" ], "timeline": [ { "at": "2026-08-26T09:01:39Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-73269", "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "title": "multicluster engine for Kubernetes 2.1 vulnerability", "summary": "A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.", "updated_at": "2026-09-05T15:17:31.100", "published_at": "2026-08-12T20:17:53.793", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-269", "what_happened": "A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/security/cve/CVE-2026-73269", "https://bugzilla.redhat.com/show_bug.cgi?id=2514220" ], "timeline": [ { "at": "2026-08-12T20:17:53.793", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73269" } ] }, { "id": "CVE-2026-73268", "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "title": "multicluster engine for Kubernetes 2.1 vulnerability", "summary": "A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.", "updated_at": "2026-09-05T15:17:30.963", "published_at": "2026-08-12T20:17:53.650", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-94", "what_happened": "A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/security/cve/CVE-2026-73268", "https://bugzilla.redhat.com/show_bug.cgi?id=2514219" ], "timeline": [ { "at": "2026-08-12T20:17:53.650", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73268" } ] }, { "id": "CVE-2026-73267", "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "title": "multicluster engine for Kubernetes 2.1 vulnerability", "summary": "A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.", "updated_at": "2026-09-05T15:17:30.820", "published_at": "2026-08-21T03:16:39.080", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-602", "what_happened": "A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/security/cve/CVE-2026-73267", "https://bugzilla.redhat.com/show_bug.cgi?id=2514218" ], "timeline": [ { "at": "2026-08-21T03:16:39.080", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73267" } ] }, { "id": "CVE-2026-73266", "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "title": "multicluster engine for Kubernetes 2.1 vulnerability", "summary": "A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.", "updated_at": "2026-09-05T15:17:30.677", "published_at": "2026-08-13T17:17:35.713", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-441", "what_happened": "A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/security/cve/CVE-2026-73266", "https://bugzilla.redhat.com/show_bug.cgi?id=2514217" ], "timeline": [ { "at": "2026-08-13T17:17:35.713", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73266" } ] }, { "id": "CVE-2026-72898", "vendor": "Metabase", "product": "Metabase", "title": "Metabase SQL Injection Vulnerability", "summary": "Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.", "updated_at": "2026-08-10T22:00:00Z", "published_at": "2026-08-10T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 6, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-10T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-72530", "vendor": "TrueConf", "product": "Server", "title": "TrueConf Server Code Injection Vulnerability", "summary": "TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.", "updated_at": "2026-08-19T22:00:00Z", "published_at": "2026-08-19T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-19T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-72529", "vendor": "TrueConf", "product": "Server", "title": "TrueConf Server Missing Authentication for Critical Function Vulnerability", "summary": "TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.", "updated_at": "2026-08-19T22:00:00Z", "published_at": "2026-08-19T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-19T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-70352", "vendor": "Microsoft", "product": "Azure AI Language Authoring", "title": "Azure AI Language Authoring vulnerability", "summary": "Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.", "updated_at": "2026-09-05T04:18:04.830", "published_at": "2026-09-03T23:17:20.213", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "-", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "what_happened": "Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70352" ], "timeline": [ { "at": "2026-09-03T23:17:20.213", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70352" } ] }, { "id": "CVE-2026-70178", "vendor": "Microsoft", "product": "Microsoft Fabric", "title": "Microsoft Fabric vulnerability", "summary": "Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.", "updated_at": "2026-09-05T04:18:04.710", "published_at": "2026-09-03T23:17:20.083", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "-", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-862", "what_happened": "Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70178" ], "timeline": [ { "at": "2026-09-03T23:17:20.083", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70178" } ] }, { "id": "CVE-2026-68820", "vendor": "Microsoft", "product": "Windows Ancillary Function Driver for WinSock", "title": "Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability", "summary": "Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-08-10T22:00:00Z", "published_at": "2026-08-10T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 6, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-10T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-68138", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-68138 Linux qdisc rate-table race local privilege escalation PoC", "summary": "CVE-2026-68138 Linux qdisc rate-table race local privilege escalation PoC", "updated_at": "2026-08-26T13:14:48Z", "published_at": "2026-08-26T13:14:48Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 40, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · aramosf/CVE-2026-68138", "author": "aramosf", "first_seen": "2026-08-11", "last_seen": "2026-08-26T13:14:48Z", "pushed_at": "2026-08-12T15:31:34Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "LPE", "language": "C", "stars": 32, "forks": 6, "topics": [], "title": "CVE-2026-68138 Linux qdisc rate-table race local privilege escalation PoC", "repository_description": "CVE-2026-68138 Linux qdisc rate-table race local privilege escalation PoC", "summary": "CVE-2026-68138 Linux qdisc rate-table race local privilege escalation PoC", "source": "CVE-Intel", "url": "https://github.com/aramosf/CVE-2026-68138" }, { "repository": "CVE-Intel · suominen/CVE-2026-68138", "author": "suominen", "first_seen": "2026-08-17", "last_seen": "2026-08-26T05:55:14Z", "pushed_at": "2026-08-26T05:54:22Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Shell", "stars": 0, "forks": 0, "topics": [ "cve", "linux", "security" ], "title": "Tracking CVE-2026-68138, the Linux kernel net/sched qdisc rate-table use-after-free", "repository_description": "Tracking CVE-2026-68138, the Linux kernel net/sched qdisc rate-table use-after-free", "summary": "Tracking CVE-2026-68138, the Linux kernel net/sched qdisc rate-table use-after-free", "source": "CVE-Intel", "url": "https://github.com/suominen/CVE-2026-68138" }, { "repository": "CVE-Intel · jangkrikkbozz/CVE-2026-68138", "author": "jangkrikkbozz", "first_seen": "2026-08-17", "last_seen": "2026-08-17T08:24:13Z", "pushed_at": "2026-08-17T08:23:09Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "LPE", "language": "", "stars": 0, "forks": 0, "topics": [], "title": "CVE-2026-68138 Linux Local Privilege Escalation Exploit", "repository_description": "CVE-2026-68138 Linux Local Privilege Escalation Exploit", "summary": "CVE-2026-68138 Linux Local Privilege Escalation Exploit", "source": "CVE-Intel", "url": "https://github.com/jangkrikkbozz/CVE-2026-68138" } ], "references": [ "https://github.com/aramosf/CVE-2026-68138", "https://github.com/suominen/CVE-2026-68138", "https://github.com/jangkrikkbozz/CVE-2026-68138" ], "timeline": [ { "at": "2026-08-26T13:14:48Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/aramosf/CVE-2026-68138" } ] }, { "id": "CVE-2026-67206", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Wolf CMS 0.8.3.1 - RCE v", "summary": "Wolf CMS 0.8.3.1 - RCE v", "updated_at": "2026-08-31T22:00:00Z", "published_at": "2026-08-31T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52672", "author": "Balachandar Gowrisankar", "first_seen": "2026-09-01", "confidence": "High", "title": "Wolf CMS 0.8.3.1 - RCE v", "summary": "Wolf CMS 0.8.3.1 - RCE v", "url": "https://www.exploit-db.com/exploits/52672", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52672" ], "timeline": [ { "at": "2026-08-31T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52672" } ] }, { "id": "CVE-2026-66795", "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "title": "multicluster engine for Kubernetes 2.1 vulnerability", "summary": "A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.", "updated_at": "2026-09-05T15:17:29.423", "published_at": "2026-08-17T21:16:47.163", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-295", "what_happened": "A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/security/cve/CVE-2026-66795", "https://bugzilla.redhat.com/show_bug.cgi?id=2507540" ], "timeline": [ { "at": "2026-08-17T21:16:47.163", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66795" } ] }, { "id": "CVE-2026-66794", "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "title": "multicluster engine for Kubernetes 2.1 vulnerability", "summary": "A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.", "updated_at": "2026-09-05T15:17:29.240", "published_at": "2026-08-19T18:17:16.547", "cvss": 9.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-918", "what_happened": "A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/security/cve/CVE-2026-66794", "https://bugzilla.redhat.com/show_bug.cgi?id=2507539" ], "timeline": [ { "at": "2026-08-19T18:17:16.547", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66794" } ] }, { "id": "CVE-2026-66384", "vendor": "JFrog", "product": "Artifactory", "title": "JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability", "summary": "JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.", "updated_at": "2026-08-26T22:00:00Z", "published_at": "2026-08-26T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-26T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-65818", "vendor": "Microsoft", "product": "Microsoft Power Platform", "title": "Microsoft Power Platform vulnerability", "summary": "Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.", "updated_at": "2026-09-05T04:18:04.580", "published_at": "2026-09-03T23:17:19.817", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "-", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-918", "what_happened": "Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65818" ], "timeline": [ { "at": "2026-09-03T23:17:19.817", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65818" } ] }, { "id": "CVE-2026-65400", "vendor": "Apple", "product": "macOS", "title": "Apple macOS Improper Authentication Vulnerability", "summary": "Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.", "updated_at": "2026-08-26T09:28:45Z", "published_at": "2026-08-26T09:28:45Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 40, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · HORKimhab/CVE-2026-65400", "author": "HORKimhab", "first_seen": "2026-08-18", "last_seen": "2026-08-26T09:28:45Z", "pushed_at": "2026-08-18T01:51:36Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 3, "forks": 1, "topics": [], "title": "CVE-2026-65400", "repository_description": "CVE-2026-65400", "summary": "CVE-2026-65400", "source": "CVE-Intel", "url": "https://github.com/HORKimhab/CVE-2026-65400" }, { "repository": "CVE-Intel · panchocosil/CVE-2026-65400-poc", "author": "panchocosil", "first_seen": "2026-08-21", "last_seen": "2026-08-25T03:42:35Z", "pushed_at": "2026-08-22T17:57:51Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Bypass", "language": "Python", "stars": 3, "forks": 0, "topics": [ "apple", "cve-2026-65400", "exploit", "macos", "poc", "screen-sharing", "security-research", "vulnerability-research" ], "title": "Read-only PoC for CVE-2026-65400 — macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file read. Patched in macOS 26.6.1 / 15.7.9 / 14.8.9.", "repository_description": "Read-only PoC for CVE-2026-65400 — macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file read. Patched in macOS 26.6.1 / 15.7.9 / 14.8.9.", "summary": "Read-only PoC for CVE-2026-65400 — macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file read. Patched in macOS 26.6.1 / 15.7.9 / 14.8.9.", "source": "CVE-Intel", "url": "https://github.com/panchocosil/CVE-2026-65400-poc" }, { "repository": "CVE-Intel · acheong08/CVE-2026-65400", "author": "acheong08", "first_seen": "2026-08-22", "last_seen": "2026-08-22T15:30:42Z", "pushed_at": "2026-08-22T09:27:55Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 2, "forks": 1, "topics": [], "title": "Apple MacOS Screen Sharing Arbitrary File read/write -> RCE", "repository_description": "Apple MacOS Screen Sharing Arbitrary File read/write -> RCE", "summary": "Apple MacOS Screen Sharing Arbitrary File read/write -> RCE", "source": "CVE-Intel", "url": "https://github.com/acheong08/CVE-2026-65400" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://github.com/HORKimhab/CVE-2026-65400", "https://github.com/panchocosil/CVE-2026-65400-poc", "https://github.com/acheong08/CVE-2026-65400" ], "timeline": [ { "at": "2026-08-26T09:28:45Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-65008", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Grav CMS 2.0.7 - RCE", "summary": "Grav CMS 2.0.7 - RCE", "updated_at": "2026-08-31T22:00:00Z", "published_at": "2026-08-31T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 24, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52669", "author": "zer0dayf", "first_seen": "2026-09-01", "confidence": "High", "title": "Grav CMS 2.0.7 - RCE", "summary": "Grav CMS 2.0.7 - RCE", "url": "https://www.exploit-db.com/exploits/52669", "verification": "verified", "verified": true }, { "repository": "zer0dayf/CVE-2026-65008", "author": "zer0dayf", "first_seen": "2026-07-27", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": " CVE-2026-65008", "summary": " CVE-2026-65008", "url": "https://github.com/zer0dayf/CVE-2026-65008" } ], "references": [ "https://www.exploit-db.com/exploits/52669", "https://github.com/zer0dayf/CVE-2026-65008" ], "timeline": [ { "at": "2026-08-31T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52669" } ] }, { "id": "CVE-2026-64849", "vendor": "MLflow", "product": "MLflow", "title": "MLflow Server-Side Request Forgery Vulnerability", "summary": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.", "updated_at": "2026-08-18T22:00:00Z", "published_at": "2026-08-18T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-18T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-19", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-19", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-19", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-19", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-19", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-19", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-63505", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Probo 0.222.2 - IDOR", "summary": "Probo 0.222.2 - IDOR", "updated_at": "2026-08-16T22:00:00Z", "published_at": "2026-08-16T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52650", "author": "Jorge González Milla", "first_seen": "2026-08-17", "confidence": "High", "title": "Probo 0.222.2 - IDOR", "summary": "Probo 0.222.2 - IDOR", "url": "https://www.exploit-db.com/exploits/52650", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52650" ], "timeline": [ { "at": "2026-08-16T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52650" } ] }, { "id": "CVE-2026-63376", "vendor": "BinaryMuse", "product": "toml-node", "title": "toml-node vulnerability", "summary": "toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.", "updated_at": "2026-09-05T03:17:16.343", "published_at": "2026-09-03T21:17:21.513", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "< 4.1.2", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-1321", "what_happened": "toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/BinaryMuse/toml-node/commit/def6ab5ea99038c0dd482cd6af1745a6af8b4c44", "https://github.com/BinaryMuse/toml-node/commit/dfaff662276adc38a2e03df3139f7119b0185463", "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j" ], "timeline": [ { "at": "2026-09-03T21:17:21.513", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63376" } ] }, { "id": "CVE-2026-63077", "vendor": "JetBrains", "product": "TeamCity", "title": "JetBrains TeamCity Deserialization of Untrusted Data Vulnerability", "summary": "JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.", "updated_at": "2026-08-04T22:00:00Z", "published_at": "2026-08-04T22:00:00Z", "cvss": 0, "confidence": 65, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-04T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-05", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-63072", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-63072", "summary": "CVE-2026-63072", "updated_at": "2026-08-26T11:01:36Z", "published_at": "2026-08-26T11:01:36Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · 0xBlackash/CVE-2026-63072", "author": "0xBlackash", "first_seen": "2026-08-26", "last_seen": "2026-08-26T11:01:36Z", "pushed_at": "2026-08-26T10:57:52Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Shell", "stars": 0, "forks": 0, "topics": [], "title": "CVE-2026-63072", "repository_description": "CVE-2026-63072", "summary": "CVE-2026-63072", "source": "CVE-Intel", "url": "https://github.com/0xBlackash/CVE-2026-63072" } ], "references": [ "https://github.com/0xBlackash/CVE-2026-63072" ], "timeline": [ { "at": "2026-08-26T11:01:36Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/0xBlackash/CVE-2026-63072" } ] }, { "id": "CVE-2026-63030", "vendor": "WordPress", "product": "Core", "title": "WordPress Core Interpretation Conflict Vulnerability", "summary": "WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.", "updated_at": "2026-08-26T12:50:28Z", "published_at": "2026-08-26T12:50:28Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 112, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · Icex0/wp2shell-poc", "author": "Icex0", "first_seen": "2026-07-17", "last_seen": "2026-08-26T12:50:28Z", "pushed_at": "2026-08-11T13:41:27Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 757, "forks": 172, "topics": [ "cve-2026-63030", "wp2shell", "wp2shell-poc" ], "title": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain", "repository_description": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain", "summary": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain", "source": "CVE-Intel", "url": "https://github.com/Icex0/wp2shell-poc" }, { "repository": "CVE-Intel · attackercan/wp2shell-poc2", "author": "attackercan", "first_seen": "2026-07-17", "last_seen": "2026-08-25T20:05:25Z", "pushed_at": "2026-07-17T22:50:06Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "Exploit", "language": "", "stars": 7, "forks": 4, "topics": [], "title": "CVE-2026-63030", "repository_description": "CVE-2026-63030", "summary": "CVE-2026-63030", "source": "CVE-Intel", "url": "https://github.com/attackercan/wp2shell-poc2" }, { "repository": "CVE-Intel · 4minx/CVE-2026-63030", "author": "4minx", "first_seen": "2026-07-18", "last_seen": "2026-08-25T14:16:07Z", "pushed_at": "2026-07-18T13:40:45Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "Python", "stars": 10, "forks": 2, "topics": [], "title": "CVE-2026-63030 (wp2shell) POC.", "repository_description": "CVE-2026-63030 (wp2shell) POC.", "summary": "CVE-2026-63030 (wp2shell) POC.", "source": "CVE-Intel", "url": "https://github.com/4minx/CVE-2026-63030" }, { "repository": "CVE-Intel · sowarma/wp2shell-PoC", "author": "sowarma", "first_seen": "2026-08-05", "last_seen": "2026-08-25T10:09:59Z", "pushed_at": "2026-08-20T10:15:52Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 914, "forks": 215, "topics": [ "cve", "cve-2026-60137", "cve-2026-63030", "data-analysis", "wp2shell", "wp2shell-poc" ], "title": "CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept", "repository_description": "CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept", "summary": "CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept", "source": "CVE-Intel", "url": "https://github.com/sowarma/wp2shell-PoC" }, { "repository": "CVE-Intel · dinosn/wp2shell-lab", "author": "dinosn", "first_seen": "2026-07-18", "last_seen": "2026-08-25T02:44:44Z", "pushed_at": "2026-07-22T11:36:51Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Injection", "language": "Python", "stars": 59, "forks": 21, "topics": [ "cve-2026-60137", "cve-2026-63030", "security", "sql-injection", "vulnerability-lab", "wordpress", "wp2shell" ], "title": "Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1", "repository_description": "Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1", "summary": "Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1", "source": "CVE-Intel", "url": "https://github.com/dinosn/wp2shell-lab" }, { "repository": "CVE-Intel · Lutfifakee-Project/wp2shell", "author": "Lutfifakee-Project", "first_seen": "2026-07-18", "last_seen": "2026-08-24T21:57:15Z", "pushed_at": "2026-07-18T06:44:40Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 7, "forks": 3, "topics": [ "cve-2026-63030", "exploit", "python", "rce", "security-tools", "sql-injection", "unauthenticated", "unauthenticated-rce" ], "title": "wp2shell - WordPress CVE-2026-63030 Exploit & Scanner", "repository_description": "wp2shell - WordPress CVE-2026-63030 Exploit & Scanner", "summary": "wp2shell - WordPress CVE-2026-63030 Exploit & Scanner", "source": "CVE-Intel", "url": "https://github.com/Lutfifakee-Project/wp2shell" }, { "repository": "CVE-Intel · ZephrFish/wp2shell-scanner", "author": "ZephrFish", "first_seen": "2026-07-17", "last_seen": "2026-08-23T13:14:52Z", "pushed_at": "2026-07-18T22:07:34Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 55, "forks": 11, "topics": [], "title": "CVE-2026-63030, CVE-2026-60137, wp2shell scanner", "repository_description": "CVE-2026-63030, CVE-2026-60137, wp2shell scanner", "summary": "CVE-2026-63030, CVE-2026-60137, wp2shell scanner", "source": "CVE-Intel", "url": "https://github.com/ZephrFish/wp2shell-scanner" }, { "repository": "CVE-Intel · InstaWP/wp2shell-scan", "author": "InstaWP", "first_seen": "2026-07-19", "last_seen": "2026-08-22T11:56:04Z", "pushed_at": "2026-07-21T08:22:34Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Shell", "stars": 5, "forks": 0, "topics": [], "title": "Detect & clean up wp2shell (CVE-2026-63030) WordPress compromise — bulk-runnable, read-only by default", "repository_description": "Detect & clean up wp2shell (CVE-2026-63030) WordPress compromise — bulk-runnable, read-only by default", "summary": "Detect & clean up wp2shell (CVE-2026-63030) WordPress compromise — bulk-runnable, read-only by default", "source": "CVE-Intel", "url": "https://github.com/InstaWP/wp2shell-scan" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://github.com/Icex0/wp2shell-poc", "https://github.com/attackercan/wp2shell-poc2", "https://github.com/4minx/CVE-2026-63030", "https://github.com/sowarma/wp2shell-PoC", "https://github.com/dinosn/wp2shell-lab", "https://github.com/Lutfifakee-Project/wp2shell", "https://github.com/ZephrFish/wp2shell-scanner", "https://github.com/InstaWP/wp2shell-scan" ], "timeline": [ { "at": "2026-08-26T12:50:28Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-62916", "vendor": "Microsoft", "product": "Microsoft Entra", "title": "Microsoft Entra vulnerability", "summary": "Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.", "updated_at": "2026-09-05T04:18:04.033", "published_at": "2026-09-03T23:17:19.693", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "-", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-288", "what_happened": "Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62916" ], "timeline": [ { "at": "2026-09-03T23:17:19.693", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62916" } ] }, { "id": "CVE-2026-62911", "vendor": "Unknown vendor", "product": "Unknown product", "title": "POC pre-auth RCE on Exchange", "summary": "POC pre-auth RCE on Exchange", "updated_at": "2026-08-26T12:03:50Z", "published_at": "2026-08-26T12:03:50Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · hypnguyen1209/CVE-2026-62911", "author": "hypnguyen1209", "first_seen": "2026-08-22", "last_seen": "2026-08-26T12:03:50Z", "pushed_at": "2026-08-22T04:49:54Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 24, "forks": 3, "topics": [ "cve-2026-62911" ], "title": "POC pre-auth RCE on Exchange", "repository_description": "POC pre-auth RCE on Exchange", "summary": "POC pre-auth RCE on Exchange", "source": "CVE-Intel", "url": "https://github.com/hypnguyen1209/CVE-2026-62911" } ], "references": [ "https://github.com/hypnguyen1209/CVE-2026-62911" ], "timeline": [ { "at": "2026-08-26T12:03:50Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/hypnguyen1209/CVE-2026-62911" } ] }, { "id": "CVE-2026-62196", "vendor": "OpenClaw", "product": "OpenClaw", "title": "OpenClaw vulnerability", "summary": "OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected feature.", "updated_at": "2026-09-05T04:17:56.397", "published_at": "2026-07-13T22:16:51.243", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2026.3.22 through before 2026.6.6 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-863", "what_happened": "OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected feature.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/openclaw/openclaw/security/advisories/GHSA-fh38-965w-f6c3", "https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-whatsapp-group-ids" ], "timeline": [ { "at": "2026-07-13T22:16:51.243", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62196" } ] }, { "id": "CVE-2026-61876", "vendor": "Unknown vendor", "product": "Unknown product", "title": "LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting", "summary": "LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting", "updated_at": "2026-08-11T22:00:00Z", "published_at": "2026-08-11T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 19, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52637", "author": "banyamer", "first_seen": "2026-08-11", "confidence": "High", "title": "LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting", "summary": "LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting", "url": "https://www.exploit-db.com/exploits/52637", "verification": "verified", "verified": true }, { "repository": "CXSecurity WLB-2026080008", "author": "Mohammed Idrees Banyamer", "first_seen": "2026-08-12", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting", "summary": "LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting", "what_happened": "LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting", "cvss": 0, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "url": "https://cxsecurity.com/issue/WLB-2026080008", "cwe": "Unknown" } ], "references": [ "https://www.exploit-db.com/exploits/52637", "https://cxsecurity.com/issue/WLB-2026080008" ], "timeline": [ { "at": "2026-08-11T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52637" } ] }, { "id": "CVE-2026-61459", "vendor": "Unknown vendor", "product": "Unknown product", "title": "mcp-server-kubernetes 3.8.x - Argument Injection", "summary": "mcp-server-kubernetes 3.8.x - Argument Injection", "updated_at": "2026-08-10T22:00:00Z", "published_at": "2026-08-10T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52638", "author": "banyamer", "first_seen": "2026-08-11", "confidence": "High", "title": "mcp-server-kubernetes 3.8.x - Argument Injection", "summary": "mcp-server-kubernetes 3.8.x - Argument Injection", "url": "https://www.exploit-db.com/exploits/52638", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52638" ], "timeline": [ { "at": "2026-08-10T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52638" } ] }, { "id": "CVE-2026-61447", "vendor": "Unknown vendor", "product": "Unknown product", "title": "PraisonAI praisonaiagents 1.6.77 - Remote Code Execution", "summary": "PraisonAI praisonaiagents 1.6.77 - Remote Code Execution", "updated_at": "2026-08-10T22:00:00Z", "published_at": "2026-08-10T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52639", "author": "banyamer", "first_seen": "2026-08-11", "confidence": "High", "title": "PraisonAI praisonaiagents 1.6.77 - Remote Code Execution", "summary": "PraisonAI praisonaiagents 1.6.77 - Remote Code Execution", "url": "https://www.exploit-db.com/exploits/52639", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52639" ], "timeline": [ { "at": "2026-08-10T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52639" } ] }, { "id": "CVE-2026-60137", "vendor": "WordPress", "product": "Core", "title": "WordPress Core SQL Injection Vulnerability", "summary": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.", "updated_at": "2026-08-26T12:50:28Z", "published_at": "2026-08-26T12:50:28Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 112, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · Icex0/wp2shell-poc", "author": "Icex0", "first_seen": "2026-07-17", "last_seen": "2026-08-26T12:50:28Z", "pushed_at": "2026-08-11T13:41:27Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 757, "forks": 172, "topics": [ "cve-2026-63030", "wp2shell", "wp2shell-poc" ], "title": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain", "repository_description": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain", "summary": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain", "source": "CVE-Intel", "url": "https://github.com/Icex0/wp2shell-poc" }, { "repository": "CVE-Intel · sowarma/wp2shell-PoC", "author": "sowarma", "first_seen": "2026-08-05", "last_seen": "2026-08-25T10:09:59Z", "pushed_at": "2026-08-20T10:15:52Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 914, "forks": 215, "topics": [ "cve", "cve-2026-60137", "cve-2026-63030", "data-analysis", "wp2shell", "wp2shell-poc" ], "title": "CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept", "repository_description": "CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept", "summary": "CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept", "source": "CVE-Intel", "url": "https://github.com/sowarma/wp2shell-PoC" }, { "repository": "CVE-Intel · dinosn/wp2shell-lab", "author": "dinosn", "first_seen": "2026-07-18", "last_seen": "2026-08-25T02:44:44Z", "pushed_at": "2026-07-22T11:36:51Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Injection", "language": "Python", "stars": 59, "forks": 21, "topics": [ "cve-2026-60137", "cve-2026-63030", "security", "sql-injection", "vulnerability-lab", "wordpress", "wp2shell" ], "title": "Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1", "repository_description": "Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1", "summary": "Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1", "source": "CVE-Intel", "url": "https://github.com/dinosn/wp2shell-lab" }, { "repository": "CVE-Intel · ZephrFish/wp2shell-scanner", "author": "ZephrFish", "first_seen": "2026-07-17", "last_seen": "2026-08-23T13:14:52Z", "pushed_at": "2026-07-18T22:07:34Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 55, "forks": 11, "topics": [], "title": "CVE-2026-63030, CVE-2026-60137, wp2shell scanner", "repository_description": "CVE-2026-63030, CVE-2026-60137, wp2shell scanner", "summary": "CVE-2026-63030, CVE-2026-60137, wp2shell scanner", "source": "CVE-Intel", "url": "https://github.com/ZephrFish/wp2shell-scanner" }, { "repository": "CVE-Intel · DeadExpl0it/wp2shell-poc", "author": "DeadExpl0it", "first_seen": "2026-08-21", "last_seen": "2026-08-21T04:42:00Z", "pushed_at": "2026-08-21T04:38:42Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 0, "forks": 0, "topics": [], "title": "wp2shell — WordPress Core Pre-Auth RCE Chain poc for CVE-2026-63030 and CVE-2026-60137", "repository_description": "wp2shell — WordPress Core Pre-Auth RCE Chain poc for CVE-2026-63030 and CVE-2026-60137", "summary": "wp2shell — WordPress Core Pre-Auth RCE Chain poc for CVE-2026-63030 and CVE-2026-60137", "source": "CVE-Intel", "url": "https://github.com/DeadExpl0it/wp2shell-poc" }, { "repository": "CVE-Intel · mhassani97/cve-2026-63030-lab", "author": "mhassani97", "first_seen": "2026-08-20", "last_seen": "2026-08-20T12:27:20Z", "pushed_at": "2026-08-20T12:26:35Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Dockerfile", "stars": 0, "forks": 1, "topics": [], "title": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain", "repository_description": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain", "summary": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain", "source": "CVE-Intel", "url": "https://github.com/mhassani97/cve-2026-63030-lab" }, { "repository": "CVE-Intel · TranDongA3/POC-CVE-2026-63030-CVE-2026-60137-", "author": "TranDongA3", "first_seen": "2026-08-19", "last_seen": "2026-08-19T08:42:32Z", "pushed_at": "2026-08-19T08:41:57Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "PoC", "language": "", "stars": 0, "forks": 0, "topics": [], "title": "POC-CVE-2026-63030-CVE-2026-60137-", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/TranDongA3/POC-CVE-2026-63030-CVE-2026-60137-" }, { "repository": "CVE-Intel · 0xsha/wp2shell", "author": "0xsha", "first_seen": "2026-07-18", "last_seen": "2026-08-18T19:12:56Z", "pushed_at": "2026-07-18T19:05:43Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 102, "forks": 29, "topics": [], "title": "CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core", "repository_description": "CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core", "summary": "CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core", "source": "CVE-Intel", "url": "https://github.com/0xsha/wp2shell" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://github.com/Icex0/wp2shell-poc", "https://github.com/sowarma/wp2shell-PoC", "https://github.com/dinosn/wp2shell-lab", "https://github.com/ZephrFish/wp2shell-scanner", "https://github.com/DeadExpl0it/wp2shell-poc", "https://github.com/mhassani97/cve-2026-63030-lab", "https://github.com/TranDongA3/POC-CVE-2026-63030-CVE-2026-60137-", "https://github.com/0xsha/wp2shell" ], "timeline": [ { "at": "2026-08-26T12:50:28Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-21", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-60004", "vendor": "Gitea", "product": "Gitea", "title": "Gitea Code Injection Vulnerability", "summary": "Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.", "updated_at": "2026-08-26T12:17:30Z", "published_at": "2026-08-26T12:17:30Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 112, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · EQSTLab/CVE-2026-60004", "author": "EQSTLab", "first_seen": "2026-07-30", "last_seen": "2026-08-26T12:17:30Z", "pushed_at": "2026-08-19T07:07:11Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 1, "forks": 0, "topics": [], "title": "Gitea diffpatch RCE", "repository_description": "Gitea diffpatch RCE", "summary": "Gitea diffpatch RCE", "source": "CVE-Intel", "url": "https://github.com/EQSTLab/CVE-2026-60004" }, { "repository": "CVE-Intel · fevar54/cve-2026-60004", "author": "fevar54", "first_seen": "2026-08-25", "last_seen": "2026-08-25T22:18:31Z", "pushed_at": "2026-08-25T18:15:36Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 0, "forks": 0, "topics": [ "cve-pocs" ], "title": "CVE-2026-60004 es una vulnerabilidad crítica (CVSS 9.8) en Gitea que permite ejecución remota de código sin autenticación mediante el endpoint `/api/v1/repos/{owner}/{repo}/diffpatch`.", "repository_description": "CVE-2026-60004 es una vulnerabilidad crítica (CVSS 9.8) en Gitea que permite ejecución remota de código sin autenticación mediante el endpoint `/api/v1/repos/{owner}/{repo}/diffpatch`.", "summary": "CVE-2026-60004 es una vulnerabilidad crítica (CVSS 9.8) en Gitea que permite ejecución remota de código sin autenticación mediante el endpoint `/api/v1/repos/{owner}/{repo}/diffpatch`.", "source": "CVE-Intel", "url": "https://github.com/fevar54/cve-2026-60004" }, { "repository": "CVE-Intel · imbas007/CVE-2026-60004-POC", "author": "imbas007", "first_seen": "2026-08-03", "last_seen": "2026-08-21T10:55:39Z", "pushed_at": "2026-08-03T08:31:38Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 15, "forks": 6, "topics": [ "1day", "cve", "cve-2026-60004", "exploit", "gitea", "nuclei", "nuclei-template", "poc" ], "title": "CVE-2026-60004 Pre-Auth RCE Exploit — Gitea <= 1.27.0 diffpatch git hook injection (CVSS 9.8)", "repository_description": "CVE-2026-60004 Pre-Auth RCE Exploit — Gitea <= 1.27.0 diffpatch git hook injection (CVSS 9.8)", "summary": "CVE-2026-60004 Pre-Auth RCE Exploit — Gitea <= 1.27.0 diffpatch git hook injection (CVSS 9.8)", "source": "CVE-Intel", "url": "https://github.com/imbas007/CVE-2026-60004-POC" }, { "repository": "CVE-Intel · gagaltotal/CVE-2026-60004-poc-gitea", "author": "gagaltotal", "first_seen": "2026-08-08", "last_seen": "2026-08-11T14:33:28Z", "pushed_at": "2026-08-08T16:41:43Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Go", "stars": 2, "forks": 0, "topics": [ "auth", "gitea", "gitea-api", "go", "golang", "golang-cli", "rce", "rce-exploit" ], "title": "CVE-2026-60004 — Gitea Pre-Auth RCE via diffpatch hook injection", "repository_description": "CVE-2026-60004 — Gitea Pre-Auth RCE via diffpatch hook injection", "summary": "CVE-2026-60004 — Gitea Pre-Auth RCE via diffpatch hook injection", "source": "CVE-Intel", "url": "https://github.com/gagaltotal/CVE-2026-60004-poc-gitea" }, { "repository": "CVE-Intel · Sachinart/CVE-2026-60004-gitea-0day", "author": "Sachinart", "first_seen": "2026-08-04", "last_seen": "2026-08-04T22:54:53Z", "pushed_at": "2026-08-04T22:54:40Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 0, "forks": 0, "topics": [], "title": "CVE-2026-60004 — Gitea <= 1.27.0 Pre-Auth RCE", "repository_description": "CVE-2026-60004 — Gitea <= 1.27.0 Pre-Auth RCE", "summary": "CVE-2026-60004 — Gitea <= 1.27.0 Pre-Auth RCE", "source": "CVE-Intel", "url": "https://github.com/Sachinart/CVE-2026-60004-gitea-0day" }, { "repository": "CVE-Intel · HackSpeak/CVE-2026-60004", "author": "HackSpeak", "first_seen": "2026-08-04", "last_seen": "2026-08-04T12:32:10Z", "pushed_at": "2026-08-04T12:31:49Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 1, "forks": 0, "topics": [], "title": "Gitea diffpatch RCE (CVE-2026-60004) PoC - repo-write to RCE as Gitea service account", "repository_description": "Gitea diffpatch RCE (CVE-2026-60004) PoC - repo-write to RCE as Gitea service account", "summary": "Gitea diffpatch RCE (CVE-2026-60004) PoC - repo-write to RCE as Gitea service account", "source": "CVE-Intel", "url": "https://github.com/HackSpeak/CVE-2026-60004" }, { "repository": "CVE-Intel · shinthink/CVE-2026-60004", "author": "shinthink", "first_seen": "2026-08-03", "last_seen": "2026-08-03T12:49:46Z", "pushed_at": "2026-08-03T12:47:22Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 0, "forks": 0, "topics": [ "code-injection", "cve", "cve-2026-60004", "exploit", "forgejo", "git", "gitea", "hook" ], "title": "CVE-2026-60004 — Gitea/Forgejo Diffpatch Git Hook RCE. Bare clone → post-index-change hook injection. CVSS 9.8 | CWE-94 | Gitea < 1.27.1", "repository_description": "CVE-2026-60004 — Gitea/Forgejo Diffpatch Git Hook RCE. Bare clone → post-index-change hook injection. CVSS 9.8 | CWE-94 | Gitea < 1.27.1", "summary": "CVE-2026-60004 — Gitea/Forgejo Diffpatch Git Hook RCE. Bare clone → post-index-change hook injection. CVSS 9.8 | CWE-94 | Gitea < 1.27.1", "source": "CVE-Intel", "url": "https://github.com/shinthink/CVE-2026-60004" }, { "repository": "CVE-Intel · HORKimhab/CVE-2026-60004", "author": "HORKimhab", "first_seen": "2026-07-29", "last_seen": "2026-07-31T17:19:06Z", "pushed_at": "2026-07-29T08:45:51Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 4, "forks": 0, "topics": [], "title": "CVE-2026-60004", "repository_description": "CVE-2026-60004", "summary": "CVE-2026-60004", "source": "CVE-Intel", "url": "https://github.com/HORKimhab/CVE-2026-60004" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://github.com/EQSTLab/CVE-2026-60004", "https://github.com/fevar54/cve-2026-60004", "https://github.com/imbas007/CVE-2026-60004-POC", "https://github.com/gagaltotal/CVE-2026-60004-poc-gitea", "https://github.com/Sachinart/CVE-2026-60004-gitea-0day", "https://github.com/HackSpeak/CVE-2026-60004", "https://github.com/shinthink/CVE-2026-60004", "https://github.com/HORKimhab/CVE-2026-60004" ], "timeline": [ { "at": "2026-08-26T12:17:30Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-59827", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Metabase 0.61.0 - Authenticated Remote Code Execution", "summary": "Metabase 0.61.0 - Authenticated Remote Code Execution", "updated_at": "2026-09-02T22:00:00Z", "published_at": "2026-09-02T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 16, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52680", "author": "Gutierre0x80", "first_seen": "2026-09-03", "confidence": "High", "title": "Metabase 0.61.0 - Authenticated Remote Code Execution", "summary": "Metabase 0.61.0 - Authenticated Remote Code Execution", "url": "https://www.exploit-db.com/exploits/52680", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52680" ], "timeline": [ { "at": "2026-09-02T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52680" } ] }, { "id": "CVE-2026-59822", "vendor": "BerriAI", "product": "LiteLLM", "title": "BerriAI LiteLLM Improper Authentication Vulnerability", "summary": "BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 9, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-59310", "vendor": "Broadcom", "product": "VMware vCenter", "title": "Broadcom VMware vCenter Path Traversal Vulnerability", "summary": "Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.", "updated_at": "2026-08-17T22:00:00Z", "published_at": "2026-08-17T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-17T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-58480", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Blocksy Companion 2.1.46 - RCE", "summary": "Blocksy Companion 2.1.46 - RCE", "updated_at": "2026-08-10T22:00:00Z", "published_at": "2026-08-10T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52640", "author": "banyamer", "first_seen": "2026-08-11", "confidence": "High", "title": "Blocksy Companion 2.1.46 - RCE", "summary": "Blocksy Companion 2.1.46 - RCE", "url": "https://www.exploit-db.com/exploits/52640", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52640" ], "timeline": [ { "at": "2026-08-10T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52640" } ] }, { "id": "CVE-2026-58289", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Microsoft Edge 150.0.4078.48 - RCE", "summary": "Microsoft Edge 150.0.4078.48 - RCE", "updated_at": "2026-08-09T22:00:00Z", "published_at": "2026-08-09T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52632", "author": "banyamer", "first_seen": "2026-08-10", "confidence": "High", "title": "Microsoft Edge 150.0.4078.48 - RCE", "summary": "Microsoft Edge 150.0.4078.48 - RCE", "url": "https://www.exploit-db.com/exploits/52632", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52632" ], "timeline": [ { "at": "2026-08-09T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52632" } ] }, { "id": "CVE-2026-58138", "vendor": "Unknown vendor", "product": "Unknown product", "title": "OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution", "summary": "OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution", "updated_at": "2026-08-11T22:00:00Z", "published_at": "2026-08-11T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 19, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "OrkesConductor 3.30.2 Unauthenticated Remote Code Execution", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52633", "author": "banyamer", "first_seen": "2026-08-10", "confidence": "High", "title": "OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution", "summary": "OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution", "url": "https://www.exploit-db.com/exploits/52633", "verification": "verified", "verified": true }, { "repository": "CXSecurity WLB-2026080006", "author": "Mohammed Idrees Banyamer", "first_seen": "2026-08-12", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "OrkesConductor 3.30.2 Unauthenticated Remote Code Execution", "summary": "OrkesConductor 3.30.2 Unauthenticated Remote Code Execution", "what_happened": "OrkesConductor 3.30.2 Unauthenticated Remote Code Execution", "cvss": 0, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "url": "https://cxsecurity.com/issue/WLB-2026080006", "cwe": "Unknown" } ], "references": [ "https://www.exploit-db.com/exploits/52633", "https://cxsecurity.com/issue/WLB-2026080006" ], "timeline": [ { "at": "2026-08-11T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52633" } ] }, { "id": "CVE-2026-58058", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Nmap 7.99 - Extension Header Integer Underflow", "summary": "Nmap 7.99 - Extension Header Integer Underflow", "updated_at": "2026-08-16T22:00:00Z", "published_at": "2026-08-16T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52647", "author": "banyamer", "first_seen": "2026-08-17", "confidence": "High", "title": "Nmap 7.99 - Extension Header Integer Underflow", "summary": "Nmap 7.99 - Extension Header Integer Underflow", "url": "https://www.exploit-db.com/exploits/52647", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52647" ], "timeline": [ { "at": "2026-08-16T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52647" } ] }, { "id": "CVE-2026-55780", "vendor": "Unknown vendor", "product": "Unknown product", "title": "NanaZip 6.5 - DoS", "summary": "NanaZip 6.5 - DoS", "updated_at": "2026-08-16T22:00:00Z", "published_at": "2026-08-16T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52652", "author": "Jorge González Milla", "first_seen": "2026-08-17", "confidence": "High", "title": "NanaZip 6.5 - DoS", "summary": "NanaZip 6.5 - DoS", "url": "https://www.exploit-db.com/exploits/52652", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52652" ], "timeline": [ { "at": "2026-08-16T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52652" } ] }, { "id": "CVE-2026-55584", "vendor": "Unknown vendor", "product": "Unknown product", "title": "phpSysInfo 3.4.5 - IP Allowlist Bypass", "summary": "phpSysInfo 3.4.5 - IP Allowlist Bypass", "updated_at": "2026-08-16T22:00:00Z", "published_at": "2026-08-16T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52648", "author": "Muhammed Mirac Kayikci", "first_seen": "2026-08-17", "confidence": "High", "title": "phpSysInfo 3.4.5 - IP Allowlist Bypass", "summary": "phpSysInfo 3.4.5 - IP Allowlist Bypass", "url": "https://www.exploit-db.com/exploits/52648", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52648" ], "timeline": [ { "at": "2026-08-16T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52648" } ] }, { "id": "CVE-2026-55040", "vendor": "Microsoft", "product": "SharePoint", "title": "Microsoft SharePoint Weak Authentication Vulnerability", "summary": "Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.", "updated_at": "2026-08-26T08:15:13Z", "published_at": "2026-08-26T08:15:13Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 40, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · zenzue/CVE-2026-55040", "author": "zenzue", "first_seen": "2026-08-26", "last_seen": "2026-08-26T08:15:13Z", "pushed_at": "2026-08-26T08:09:52Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 0, "forks": 0, "topics": [], "title": "CVE-2026-55040", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/zenzue/CVE-2026-55040" }, { "repository": "CVE-Intel · sfewer-r7/CVE-2026-55040", "author": "sfewer-r7", "first_seen": "2026-08-06", "last_seen": "2026-08-22T12:02:56Z", "pushed_at": "2026-08-10T15:35:23Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Bypass", "language": "Python", "stars": 56, "forks": 13, "topics": [], "title": "Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040)", "repository_description": "Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040)", "summary": "Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040)", "source": "CVE-Intel", "url": "https://github.com/sfewer-r7/CVE-2026-55040" }, { "repository": "CVE-Intel · l0ggg/CVE-2026-55040", "author": "l0ggg", "first_seen": "2026-07-28", "last_seen": "2026-08-20T14:49:00Z", "pushed_at": "2026-07-28T09:04:14Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 3, "forks": 1, "topics": [], "title": "Exploit code for CVE-2026-55040, it can create auth header for any validate account.", "repository_description": "Exploit code for CVE-2026-55040, it can create auth header for any validate account.", "summary": "Exploit code for CVE-2026-55040, it can create auth header for any validate account.", "source": "CVE-Intel", "url": "https://github.com/l0ggg/CVE-2026-55040" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://github.com/zenzue/CVE-2026-55040", "https://github.com/sfewer-r7/CVE-2026-55040", "https://github.com/l0ggg/CVE-2026-55040" ], "timeline": [ { "at": "2026-08-26T08:15:13Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-54647", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CubeCart 6.7.4 - SQL injection", "summary": "CubeCart 6.7.4 - SQL injection", "updated_at": "2026-08-30T22:00:00Z", "published_at": "2026-08-30T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52664", "author": "Mikail KOCADAĞ", "first_seen": "2026-08-31", "confidence": "High", "title": "CubeCart 6.7.4 - SQL injection", "summary": "CubeCart 6.7.4 - SQL injection", "url": "https://www.exploit-db.com/exploits/52664", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52664" ], "timeline": [ { "at": "2026-08-30T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52664" } ] }, { "id": "CVE-2026-54646", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CubeCart 6.7.4 - SQL", "summary": "CubeCart 6.7.4 - SQL", "updated_at": "2026-08-30T22:00:00Z", "published_at": "2026-08-30T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52663", "author": "Mikail KOCADAĞ", "first_seen": "2026-08-31", "confidence": "High", "title": "CubeCart 6.7.4 - SQL", "summary": "CubeCart 6.7.4 - SQL", "url": "https://www.exploit-db.com/exploits/52663", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52663" ], "timeline": [ { "at": "2026-08-30T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52663" } ] }, { "id": "CVE-2026-54645", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CubeCart 6.7.4 - Stored XSS", "summary": "CubeCart 6.7.4 - Stored XSS", "updated_at": "2026-08-30T22:00:00Z", "published_at": "2026-08-30T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52662", "author": "Mikail KOCADAĞ", "first_seen": "2026-08-31", "confidence": "High", "title": "CubeCart 6.7.4 - Stored XSS", "summary": "CubeCart 6.7.4 - Stored XSS", "url": "https://www.exploit-db.com/exploits/52662", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52662" ], "timeline": [ { "at": "2026-08-30T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52662" } ] }, { "id": "CVE-2026-54644", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CubeCart 6.7.4 - Cross-Site Scripting", "summary": "CubeCart 6.7.4 - Cross-Site Scripting", "updated_at": "2026-08-30T22:00:00Z", "published_at": "2026-08-30T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52661", "author": "Mikail KOCADAĞ", "first_seen": "2026-08-31", "confidence": "High", "title": "CubeCart 6.7.4 - Cross-Site Scripting", "summary": "CubeCart 6.7.4 - Cross-Site Scripting", "url": "https://www.exploit-db.com/exploits/52661", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52661" ], "timeline": [ { "at": "2026-08-30T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52661" } ] }, { "id": "CVE-2026-53613", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-53613-poc", "summary": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "updated_at": "2026-08-26T09:53:41Z", "published_at": "2026-08-26T09:53:41Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · mohamedjawady/CVE-2026-53613-poc", "author": "mohamedjawady", "first_seen": "2026-08-26", "last_seen": "2026-08-26T09:53:41Z", "pushed_at": "2026-08-26T09:48:46Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "Shell", "stars": 0, "forks": 0, "topics": [], "title": "CVE-2026-53613-poc", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/mohamedjawady/CVE-2026-53613-poc" } ], "references": [ "https://github.com/mohamedjawady/CVE-2026-53613-poc" ], "timeline": [ { "at": "2026-08-26T09:53:41Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/mohamedjawady/CVE-2026-53613-poc" } ] }, { "id": "CVE-2026-53362", "vendor": "Linux", "product": "Kernel", "title": "Linux Kernel Unspecified Vulnerability", "summary": "Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.", "updated_at": "2026-08-26T22:00:00Z", "published_at": "2026-08-26T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 13, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "suominen/ipv6_frag_escape", "author": "suominen", "first_seen": "2026-07-03", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "Tracking IPV6_FRAG_ESCAPE (CVE-2026-53362, CVE-2026-53366), the IPv6 fragmentation container escape", "summary": "Tracking IPV6_FRAG_ESCAPE (CVE-2026-53362, CVE-2026-53366), the IPv6 fragmentation container escape", "url": "https://github.com/suominen/ipv6_frag_escape" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://github.com/suominen/ipv6_frag_escape" ], "timeline": [ { "at": "2026-08-26T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-51407", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Fullhan FH8626V100 - Multiple Vulnerabilities", "summary": "Fullhan FH8626V100 - Multiple Vulnerabilities", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 16, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52674", "author": "Amir Aliu", "first_seen": "2026-09-02", "confidence": "High", "title": "Fullhan FH8626V100 - Multiple Vulnerabilities", "summary": "Fullhan FH8626V100 - Multiple Vulnerabilities", "url": "https://www.exploit-db.com/exploits/52674", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52674" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52674" } ] }, { "id": "CVE-2026-51406", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Fullhan FH8626V100 - Multiple Vulnerabilities", "summary": "Fullhan FH8626V100 - Multiple Vulnerabilities", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 16, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52674", "author": "Amir Aliu", "first_seen": "2026-09-02", "confidence": "High", "title": "Fullhan FH8626V100 - Multiple Vulnerabilities", "summary": "Fullhan FH8626V100 - Multiple Vulnerabilities", "url": "https://www.exploit-db.com/exploits/52674", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52674" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52674" } ] }, { "id": "CVE-2026-51405", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Fullhan FH8626V100 - Multiple Vulnerabilities", "summary": "Fullhan FH8626V100 - Multiple Vulnerabilities", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 16, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52674", "author": "Amir Aliu", "first_seen": "2026-09-02", "confidence": "High", "title": "Fullhan FH8626V100 - Multiple Vulnerabilities", "summary": "Fullhan FH8626V100 - Multiple Vulnerabilities", "url": "https://www.exploit-db.com/exploits/52674", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52674" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52674" } ] }, { "id": "CVE-2026-51404", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Fullhan FH8626V100 - Multiple Vulnerabilities", "summary": "Fullhan FH8626V100 - Multiple Vulnerabilities", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 16, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52674", "author": "Amir Aliu", "first_seen": "2026-09-02", "confidence": "High", "title": "Fullhan FH8626V100 - Multiple Vulnerabilities", "summary": "Fullhan FH8626V100 - Multiple Vulnerabilities", "url": "https://www.exploit-db.com/exploits/52674", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52674" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52674" } ] }, { "id": "CVE-2026-51403", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Fullhan FH8626V100 - Multiple Vulnerabilities", "summary": "Fullhan FH8626V100 - Multiple Vulnerabilities", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 16, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52674", "author": "Amir Aliu", "first_seen": "2026-09-02", "confidence": "High", "title": "Fullhan FH8626V100 - Multiple Vulnerabilities", "summary": "Fullhan FH8626V100 - Multiple Vulnerabilities", "url": "https://www.exploit-db.com/exploits/52674", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52674" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52674" } ] }, { "id": "CVE-2026-51402", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Fullhan FH8626V100 - Multiple Vulnerabilities", "summary": "Fullhan FH8626V100 - Multiple Vulnerabilities", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 16, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52674", "author": "Amir Aliu", "first_seen": "2026-09-02", "confidence": "High", "title": "Fullhan FH8626V100 - Multiple Vulnerabilities", "summary": "Fullhan FH8626V100 - Multiple Vulnerabilities", "url": "https://www.exploit-db.com/exploits/52674", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52674" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52674" } ] }, { "id": "CVE-2026-51134", "vendor": "Unknown vendor", "product": "Unknown product", "title": "C-MOR 6.0104 - Directory Traversal", "summary": "C-MOR 6.0104 - Directory Traversal", "updated_at": "2026-08-30T22:00:00Z", "published_at": "2026-08-30T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52666", "author": "Samir Shamdin", "first_seen": "2026-08-31", "confidence": "High", "title": "C-MOR 6.0104 - Directory Traversal", "summary": "C-MOR 6.0104 - Directory Traversal", "url": "https://www.exploit-db.com/exploits/52666", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52666" ], "timeline": [ { "at": "2026-08-30T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52666" } ] }, { "id": "CVE-2026-51133", "vendor": "Unknown vendor", "product": "Unknown product", "title": "C-MOR 6.0104 - Cross-Site Scripting (XSS)", "summary": "C-MOR 6.0104 - Cross-Site Scripting (XSS)", "updated_at": "2026-08-30T22:00:00Z", "published_at": "2026-08-30T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52665", "author": "Samir Shamdin", "first_seen": "2026-08-31", "confidence": "High", "title": "C-MOR 6.0104 - Cross-Site Scripting (XSS)", "summary": "C-MOR 6.0104 - Cross-Site Scripting (XSS)", "url": "https://www.exploit-db.com/exploits/52665", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52665" ], "timeline": [ { "at": "2026-08-30T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52665" } ] }, { "id": "CVE-2026-50237", "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.12", "title": "Red Hat OpenShift Container Platform 4.12 vulnerability", "summary": "A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.", "updated_at": "2026-09-05T13:18:13.053", "published_at": "2026-08-11T12:17:38.347", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 13, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-918", "what_happened": "A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:54188", "https://access.redhat.com/errata/RHSA-2026:54206", "https://access.redhat.com/errata/RHSA-2026:54545", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54770", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/security/cve/CVE-2026-50237", "https://bugzilla.redhat.com/show_bug.cgi?id=2484746" ], "timeline": [ { "at": "2026-08-11T12:17:38.347", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50237" } ] }, { "id": "CVE-2026-50236", "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "title": "Red Hat OpenShift Container Platform 4.14 vulnerability", "summary": "An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.", "updated_at": "2026-09-05T13:18:12.560", "published_at": "2026-08-11T12:17:38.183", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 11, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-918", "what_happened": "An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:54545", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54770", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/security/cve/CVE-2026-50236", "https://bugzilla.redhat.com/show_bug.cgi?id=2484745" ], "timeline": [ { "at": "2026-08-11T12:17:38.183", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50236" } ] }, { "id": "CVE-2026-49876", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Apache Gravitino 1.2.1 SSRF", "summary": "Apache Gravitino 1.2.1 SSRF", "updated_at": "2026-08-11T22:00:00Z", "published_at": "2026-08-11T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Apache Gravitino 1.2.1 SSRF", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CXSecurity WLB-2026080004", "author": "Anonymous", "first_seen": "2026-08-12", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "Apache Gravitino 1.2.1 SSRF", "summary": "Apache Gravitino 1.2.1 SSRF", "what_happened": "Apache Gravitino 1.2.1 SSRF", "cvss": 0, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "url": "https://cxsecurity.com/issue/WLB-2026080004", "cwe": "Unknown" } ], "references": [ "https://cxsecurity.com/issue/WLB-2026080004" ], "timeline": [ { "at": "2026-08-11T22:00:00Z", "label": "Discovered through CXSecurity", "url": "https://cxsecurity.com/issue/WLB-2026080004" } ] }, { "id": "CVE-2026-49869", "vendor": "Kestra", "product": "Kestra OSS", "title": "Kestra OSS OS Command Injection Vulnerability", "summary": "Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 11, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Ap0dexMe0/CVE-2026-49869", "author": "Ap0dexMe0", "first_seen": "2026-06-30", "confidence": "High", "verification": "verified", "verified": true, "stars": 2, "title": "Kestra Auth-Bypass Vulnerability Checker", "summary": "Kestra Auth-Bypass Vulnerability Checker", "url": "https://github.com/Ap0dexMe0/CVE-2026-49869" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://github.com/Ap0dexMe0/CVE-2026-49869" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-49332", "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.12", "title": "Red Hat OpenShift Container Platform 4.12 vulnerability", "summary": "A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.", "updated_at": "2026-09-05T12:16:48.540", "published_at": "2026-07-28T13:18:46.067", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 13, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-436", "what_happened": "A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:50681", "https://access.redhat.com/errata/RHSA-2026:50758", "https://access.redhat.com/errata/RHSA-2026:51007", "https://access.redhat.com/errata/RHSA-2026:51013", "https://access.redhat.com/errata/RHSA-2026:51022", "https://access.redhat.com/errata/RHSA-2026:51025", "https://access.redhat.com/errata/RHSA-2026:51038", "https://access.redhat.com/errata/RHSA-2026:54188", "https://access.redhat.com/errata/RHSA-2026:54206", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/security/cve/CVE-2026-49332", "https://bugzilla.redhat.com/show_bug.cgi?id=2483253" ], "timeline": [ { "at": "2026-07-28T13:18:46.067", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49332" } ] }, { "id": "CVE-2026-49069", "vendor": "Unknown vendor", "product": "Unknown product", "title": "WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)", "summary": "WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)", "updated_at": "2026-08-20T22:00:00Z", "published_at": "2026-08-20T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 23, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "WordPress Plugin WPZOOM Portfolio 1.4.21 Reflected Cross-Site Scripting (XSS)", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52611", "author": "Kent Apostol", "first_seen": "2026-07-06", "confidence": "High", "title": "WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)", "summary": "WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)", "url": "https://www.exploit-db.com/exploits/52611", "verification": "verified", "verified": true }, { "repository": "CXSecurity WLB-2026080012", "author": "Kent Apostol", "first_seen": "2026-08-21", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "WordPress Plugin WPZOOM Portfolio 1.4.21 Reflected Cross-Site Scripting (XSS)", "summary": "WordPress Plugin WPZOOM Portfolio 1.4.21 Reflected Cross-Site Scripting (XSS)", "what_happened": "WordPress Plugin WPZOOM Portfolio 1.4.21 Reflected Cross-Site Scripting (XSS)", "cvss": 0, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "url": "https://cxsecurity.com/issue/WLB-2026080012", "cwe": "Unknown" } ], "references": [ "https://www.exploit-db.com/exploits/52611", "https://cxsecurity.com/issue/WLB-2026080012" ], "timeline": [ { "at": "2026-08-20T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52611" } ] }, { "id": "CVE-2026-48909", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Joomla Extension 4.1.4 - PHP Object injection", "summary": "Joomla Extension 4.1.4 - PHP Object injection", "updated_at": "2026-08-11T22:00:00Z", "published_at": "2026-08-11T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 25, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Joomla Extension 4.1.4 PHP Object injection", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52617", "author": "Amin İsayev", "first_seen": "2026-07-06", "confidence": "High", "title": "Joomla Extension 4.1.4 - PHP Object injection", "summary": "Joomla Extension 4.1.4 - PHP Object injection", "url": "https://www.exploit-db.com/exploits/52617", "verification": "verified", "verified": true }, { "repository": "CXSecurity WLB-2026080009", "author": "Amin İsayev", "first_seen": "2026-08-12", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "Joomla Extension 4.1.4 PHP Object injection", "summary": "Joomla Extension 4.1.4 PHP Object injection", "what_happened": "Joomla Extension 4.1.4 PHP Object injection", "cvss": 0, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "url": "https://cxsecurity.com/issue/WLB-2026080009", "cwe": "Unknown" }, { "repository": "CerberusMrXi/CVE-2026-48909-Joomla-SP-Exploit", "author": "CerberusMrXi", "first_seen": "2026-07-15", "confidence": "High", "verification": "verified", "verified": true, "stars": 2, "title": "CVE-2026-48909 - Unauthenticated PHP Object Injection to RCE exploit for Joomla SP LMS extension versions <= 4.1.3. Exploits lmsOrders cookie deserialization to write webshell via Joomla FormattedtextLogger gadget chain. Includes interactive shell, path discovery, and cleanup. For authorized security testing only.", "summary": "CVE-2026-48909 - Unauthenticated PHP Object Injection to RCE exploit for Joomla SP LMS extension versions <= 4.1.3. Exploits lmsOrders cookie deserialization to write webshell via Joomla FormattedtextLogger gadget chain. Includes interactive shell, path discovery, and cleanup. For authorized security testing only.", "url": "https://github.com/CerberusMrXi/CVE-2026-48909-Joomla-SP-Exploit" }, { "repository": "Is4yev/CVE-2026-48909", "author": "Is4yev", "first_seen": "2026-06-21", "confidence": "High", "verification": "verified", "verified": true, "stars": 23, "title": "CVE-2026-48909 PoC", "summary": "CVE-2026-48909 PoC", "url": "https://github.com/Is4yev/CVE-2026-48909" } ], "references": [ "https://www.exploit-db.com/exploits/52617", "https://cxsecurity.com/issue/WLB-2026080009", "https://github.com/CerberusMrXi/CVE-2026-48909-Joomla-SP-Exploit", "https://github.com/Is4yev/CVE-2026-48909" ], "timeline": [ { "at": "2026-08-11T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52617" } ] }, { "id": "CVE-2026-48907", "vendor": "Widget Factory", "product": "Joomla Content Editor", "title": "Widget Factory Joomla Content Editor Improper Access Control Vulnerability", "summary": "Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.", "updated_at": "2026-08-26T12:34:07Z", "published_at": "2026-08-26T12:34:07Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 162, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-284", "what_happened": "Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52630", "author": "Jared Brits", "first_seen": "2026-08-10", "confidence": "High", "title": "Joomla 2.9.99.4 - Unauthenticated Remote Code Execution", "summary": "Joomla 2.9.99.4 - Unauthenticated Remote Code Execution", "url": "https://www.exploit-db.com/exploits/52630", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 52645", "author": "Jared Brits", "first_seen": "2026-08-17", "confidence": "High", "title": "Joomla JCE_2.9.15 - Remote Code Execution", "summary": "Joomla JCE_2.9.15 - Remote Code Execution", "url": "https://www.exploit-db.com/exploits/52645", "verification": "verified", "verified": true }, { "repository": "K3ysTr0K3R/CVE-2026-48907", "author": "K3ysTr0K3R", "first_seen": "2026-06-29", "confidence": "High", "verification": "verified", "verified": true, "stars": 4, "title": "CVE-2026-48907 – Joomla JCE Unauthenticated Remote Code Execution (RCE)", "summary": "CVE-2026-48907 – Joomla JCE Unauthenticated Remote Code Execution (RCE)", "url": "https://github.com/K3ysTr0K3R/CVE-2026-48907" }, { "repository": "CVE-Intel · gh1mau/masta-cve-2026-48907", "author": "gh1mau", "first_seen": "2026-06-27", "last_seen": "2026-08-26T12:30:58Z", "pushed_at": "2026-06-27T05:25:46Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 58, "forks": 11, "topics": [], "title": "cve-2026-48907 scanner", "repository_description": "cve-2026-48907 scanner", "summary": "cve-2026-48907 scanner", "source": "CVE-Intel", "url": "https://github.com/gh1mau/masta-cve-2026-48907", "cvss": 0, "severity": "", "cve_description": "A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.", "cvss_vector": "", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-284", "kev": false, "epss": 0.781, "metadata_source": "", "cve_published_at": "2026-06-05", "cve_status": "Awaiting Analysis" }, { "repository": "ksotaria1337/-CVE-2026-48907-", "author": "ksotaria1337", "first_seen": "2026-08-26", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-48907 repository", "summary": "", "url": "https://github.com/ksotaria1337/-CVE-2026-48907-" }, { "repository": "CerberusMrXi/JCEzploit-CVE-2026-48907", "author": "CerberusMrXi", "first_seen": "2026-08-21", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "JCEzploit is a powerful, fully-automated RCE exploit for Joomla JCE (CVE-2026-48907) featuring interactive shell, batch command execution, file download capability, and proxy support. Built with Python & Rich for penetration testers. Ethical use only. By Sudeepa Wanigarathna.", "summary": "JCEzploit is a powerful, fully-automated RCE exploit for Joomla JCE (CVE-2026-48907) featuring interactive shell, batch command execution, file download capability, and proxy support. Built with Python & Rich for penetration testers. Ethical use only. By Sudeepa Wanigarathna.", "url": "https://github.com/CerberusMrXi/JCEzploit-CVE-2026-48907" }, { "repository": "CVE-Intel · 0xgh057r3c0n/CVE-2026-48907", "author": "0xgh057r3c0n", "first_seen": "2026-06-22", "last_seen": "2026-08-21T07:50:04Z", "pushed_at": "2026-06-27T22:38:03Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 3, "forks": 2, "topics": [], "title": "CVE-2025-48907 - Unauthenticated RCE exploit for Joomla JCE < 2.9.99.5", "repository_description": "CVE-2025-48907 - Unauthenticated RCE exploit for Joomla JCE < 2.9.99.5", "summary": "CVE-2025-48907 - Unauthenticated RCE exploit for Joomla JCE < 2.9.99.5", "source": "CVE-Intel", "url": "https://github.com/0xgh057r3c0n/CVE-2026-48907", "cvss": 0, "severity": "", "cve_description": "A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.", "cvss_vector": "", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-284", "kev": false, "epss": 0.781, "metadata_source": "", "cve_published_at": "2026-06-05", "cve_status": "Awaiting Analysis" }, { "repository": "sec0x/CVE-2026-48907", "author": "sec0x", "first_seen": "2026-06-22", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "CVE-2026-48907 repository", "summary": "", "url": "https://github.com/sec0x/CVE-2026-48907" }, { "repository": "pssec-io/CVE-2026-48907", "author": "pssec-io", "first_seen": "2026-06-30", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "POC for CVE-2026-48907", "summary": "POC for CVE-2026-48907", "url": "https://github.com/pssec-io/CVE-2026-48907" }, { "repository": "ChiefYoru/CVE-2026-48907_PoC", "author": "ChiefYoru", "first_seen": "2026-07-19", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "Unauthenticated Remote Code Execution (RCE) vulnerability in the JCE (Joomla Content Editor) extension for Joomla", "summary": "Unauthenticated Remote Code Execution (RCE) vulnerability in the JCE (Joomla Content Editor) extension for Joomla", "url": "https://github.com/ChiefYoru/CVE-2026-48907_PoC" }, { "repository": "bayu06802/CVE-2026-48907", "author": "bayu06802", "first_seen": "2026-07-04", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Python & template nuclei", "summary": "Python & template nuclei", "url": "https://github.com/bayu06802/CVE-2026-48907" }, { "repository": "NoXiVaR/CVE-2026-48907", "author": "NoXiVaR", "first_seen": "2026-07-01", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-48907 PoC", "summary": "CVE-2026-48907 PoC", "url": "https://github.com/NoXiVaR/CVE-2026-48907" }, { "repository": "Almavj/Joomla_CVE_2026_48907", "author": "Almavj", "first_seen": "2026-06-29", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "cve-2026-48907 scanner", "summary": "cve-2026-48907 scanner", "url": "https://github.com/Almavj/Joomla_CVE_2026_48907" }, { "repository": "xitexploiter96-dot/CVE-2026-48907-", "author": "xitexploiter96-dot", "first_seen": "2026-06-29", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-48907 repository", "summary": "", "url": "https://github.com/xitexploiter96-dot/CVE-2026-48907-" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/52630", "https://www.exploit-db.com/exploits/52645", "https://github.com/K3ysTr0K3R/CVE-2026-48907", "https://github.com/gh1mau/masta-cve-2026-48907", "https://github.com/ksotaria1337/-CVE-2026-48907-", "https://github.com/CerberusMrXi/JCEzploit-CVE-2026-48907", "https://github.com/0xgh057r3c0n/CVE-2026-48907", "https://github.com/sec0x/CVE-2026-48907", "https://github.com/pssec-io/CVE-2026-48907", "https://github.com/ChiefYoru/CVE-2026-48907_PoC", "https://github.com/bayu06802/CVE-2026-48907", "https://github.com/NoXiVaR/CVE-2026-48907", "https://github.com/Almavj/Joomla_CVE_2026_48907", "https://github.com/xitexploiter96-dot/CVE-2026-48907-" ], "timeline": [ { "at": "2026-08-26T12:34:07Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-06-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-06-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-06-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-06-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-06-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-06-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-06-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "epss": 0.781, "cve_status": "Awaiting Analysis", "cve_published_at": "2026-06-05" }, { "id": "CVE-2026-48710", "vendor": "Kludex", "product": "Starlette", "title": "Kludex Starlette HTTP Request/Response Smuggling Vulnerability", "summary": "Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 24, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CuteeCat/CVE-2026-48710", "author": "CuteeCat", "first_seen": "2026-08-11", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-48710漏洞验证代码", "summary": "CVE-2026-48710漏洞验证代码", "url": "https://github.com/CuteeCat/CVE-2026-48710" }, { "repository": "sb-ox/repro-OXDEV-77637-uv-workspace", "author": "sb-ox", "first_seen": "2026-08-03", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "OXDEV-77637 repro fixture: uv workspace whose transitive CVE (starlette 0.25.0 / CVE-2026-48710) is dropped when the lean clone omits workspace-member pyproject.toml. Tag: repro-OXDEV-77637", "summary": "OXDEV-77637 repro fixture: uv workspace whose transitive CVE (starlette 0.25.0 / CVE-2026-48710) is dropped when the lean clone omits workspace-member pyproject.toml. Tag: repro-OXDEV-77637", "url": "https://github.com/sb-ox/repro-OXDEV-77637-uv-workspace" }, { "repository": "eris-ths/supply-chain-guard", "author": "eris-ths", "first_seen": "2026-04-01", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 3, "title": "Detect, assess, and respond to supply chain attacks across npm/yarn and Python (pip/poetry/uv). Claude Code skill + standalone scripts. Built during axios RAT (2026-03-31) and Starlette BadHost CVE-2026-48710 (2026-05-22).", "summary": "Detect, assess, and respond to supply chain attacks across npm/yarn and Python (pip/poetry/uv). Claude Code skill + standalone scripts. Built during axios RAT (2026-03-31) and Starlette BadHost CVE-2026-48710 (2026-05-22).", "url": "https://github.com/eris-ths/supply-chain-guard" }, { "repository": "Bhanunamikaze/BadHost-CVE-2026-48710-Exploit", "author": "Bhanunamikaze", "first_seen": "2026-05-28", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "Detection scanner for CVE-2026-48710 - Host-header auth bypass in Starlette/FastAPI", "summary": "Detection scanner for CVE-2026-48710 - Host-header auth bypass in Starlette/FastAPI", "url": "https://github.com/Bhanunamikaze/BadHost-CVE-2026-48710-Exploit" }, { "repository": "xtremebeing/starlette-host-header-lab", "author": "xtremebeing", "first_seen": "2026-05-27", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 1, "title": "Starlette Host-Header URL Confusion Lab (X41-2026-002) - CVE-2026-48710", "summary": "Starlette Host-Header URL Confusion Lab (X41-2026-002) - CVE-2026-48710", "url": "https://github.com/xtremebeing/starlette-host-header-lab" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://github.com/CuteeCat/CVE-2026-48710", "https://github.com/sb-ox/repro-OXDEV-77637-uv-workspace", "https://github.com/eris-ths/supply-chain-guard", "https://github.com/Bhanunamikaze/BadHost-CVE-2026-48710-Exploit", "https://github.com/xtremebeing/starlette-host-header-lab" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-46579", "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.12", "title": "Red Hat OpenShift Container Platform 4.12 vulnerability", "summary": "A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.", "updated_at": "2026-09-05T12:16:47.823", "published_at": "2026-05-29T11:16:17.050", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 27, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-287", "what_happened": "A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:27009", "https://access.redhat.com/errata/RHSA-2026:27044", "https://access.redhat.com/errata/RHSA-2026:27063", "https://access.redhat.com/errata/RHSA-2026:37580", "https://access.redhat.com/errata/RHSA-2026:40022", "https://access.redhat.com/errata/RHSA-2026:40828", "https://access.redhat.com/errata/RHSA-2026:43227", "https://access.redhat.com/errata/RHSA-2026:43253", "https://access.redhat.com/errata/RHSA-2026:43331", "https://access.redhat.com/errata/RHSA-2026:47703", "https://access.redhat.com/errata/RHSA-2026:47728", "https://access.redhat.com/security/cve/CVE-2026-46579", "https://bugzilla.redhat.com/show_bug.cgi?id=2483181", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46579.json" ], "timeline": [ { "at": "2026-05-29T11:16:17.050", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46579" } ] }, { "id": "CVE-2026-46331", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-46331", "summary": "CVE-2026-46331", "updated_at": "2026-08-26T08:01:58Z", "published_at": "2026-08-26T08:01:58Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 114, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW'd.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · 0xBlackash/CVE-2026-46331", "author": "0xBlackash", "first_seen": "2026-06-26", "last_seen": "2026-08-26T08:01:58Z", "pushed_at": "2026-06-26T19:09:41Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "C", "stars": 30, "forks": 5, "topics": [], "title": "CVE-2026-46331", "repository_description": "CVE-2026-46331", "summary": "CVE-2026-46331", "source": "CVE-Intel", "url": "https://github.com/0xBlackash/CVE-2026-46331", "cvss": 0, "severity": "", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW'd.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined.", "cvss_vector": "", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "kev": false, "epss": 0.00525, "metadata_source": "", "cve_published_at": "2026-06-16", "cve_status": "Received" }, { "repository": "CVE-Intel · douglasmun/pagecache-lpe-containment-kit", "author": "douglasmun", "first_seen": "2026-06-27", "last_seen": "2026-08-25T07:08:22Z", "pushed_at": "2026-06-27T15:25:16Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "LPE", "language": "Shell", "stars": 3, "forks": 1, "topics": [ "blue-team", "bpftrace", "container-security", "cve", "defensive-security", "ebpf", "hardening", "kernel-security" ], "title": "Educational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only — no exploit code. TLP:CLEAR.", "repository_description": "Educational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only — no exploit code. TLP:CLEAR.", "summary": "Educational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only — no exploit code. TLP:CLEAR.", "source": "CVE-Intel", "url": "https://github.com/douglasmun/pagecache-lpe-containment-kit", "cvss": 0, "severity": "", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW'd.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined.", "cvss_vector": "", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "kev": false, "epss": 0.00525, "metadata_source": "", "cve_published_at": "2026-06-16", "cve_status": "Received" }, { "repository": "CVE-Intel · sgkdev/packet_edit_meme", "author": "sgkdev", "first_seen": "2026-06-17", "last_seen": "2026-08-20T18:02:33Z", "pushed_at": "2026-06-17T04:55:06Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "C", "stars": 142, "forks": 45, "topics": [], "title": "PACKET_EDIT_MEME.c (aka CVE-2026-46331): yet another page cache poisoning nightmare", "repository_description": "PACKET_EDIT_MEME.c (aka CVE-2026-46331): yet another page cache poisoning nightmare", "summary": "PACKET_EDIT_MEME.c (aka CVE-2026-46331): yet another page cache poisoning nightmare", "source": "CVE-Intel", "url": "https://github.com/sgkdev/packet_edit_meme", "cvss": 0, "severity": "", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW'd.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined.", "cvss_vector": "", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "kev": false, "epss": 0.00525, "metadata_source": "", "cve_published_at": "2026-06-16", "cve_status": "Received" }, { "repository": "vulnquest58/dirtyclone-exploit", "author": "vulnquest58", "first_seen": "2026-06-28", "confidence": "High", "verification": "verified", "verified": true, "stars": 6, "title": "CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9", "summary": "CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9", "url": "https://github.com/vulnquest58/dirtyclone-exploit" }, { "repository": "rjt-gupta/page-cache-corruption-lpes", "author": "rjt-gupta", "first_seen": "2026-07-22", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 12, "title": "CVE-2026-46331 and CVE-2026-43503", "summary": "CVE-2026-46331 and CVE-2026-43503", "url": "https://github.com/rjt-gupta/page-cache-corruption-lpes" }, { "repository": "nawalacheker1/CVE-2026-46331", "author": "nawalacheker1", "first_seen": "2026-07-30", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-46331 repository", "summary": "", "url": "https://github.com/nawalacheker1/CVE-2026-46331" }, { "repository": "cherrycherrymay/PoC-CVE-2026-46331", "author": "cherrycherrymay", "first_seen": "2026-07-24", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Pedit COW – Linux Kernel Local Privilege Escalation (CVE-2026-46331)", "summary": "Pedit COW – Linux Kernel Local Privilege Escalation (CVE-2026-46331)", "url": "https://github.com/cherrycherrymay/PoC-CVE-2026-46331" }, { "repository": "V0IDNETWORK/CVE-2026-46331", "author": "V0IDNETWORK", "first_seen": "2026-07-01", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "pedit COW", "summary": "pedit COW", "url": "https://github.com/V0IDNETWORK/CVE-2026-46331" }, { "repository": "MarwahHadi/CVE-2026-46331-pedit-cow", "author": "MarwahHadi", "first_seen": "2026-07-12", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Write-up and exploitation steps for the pedit COW vulnerability (CVE-2026-46331)", "summary": "Write-up and exploitation steps for the pedit COW vulnerability (CVE-2026-46331)", "url": "https://github.com/MarwahHadi/CVE-2026-46331-pedit-cow" }, { "repository": "yanxinwu946/CVE-2026-46331", "author": "yanxinwu946", "first_seen": "2026-07-11", "confidence": "High", "verification": "verified", "verified": true, "stars": 4, "title": "CVE-2026-46331 act_pedit page-cache corruption exploit, with Alpine PIE fix", "summary": "CVE-2026-46331 act_pedit page-cache corruption exploit, with Alpine PIE fix", "url": "https://github.com/yanxinwu946/CVE-2026-46331" }, { "repository": "g0thamRabb1t/CVE-2026-46331-pedit-COW-detection", "author": "g0thamRabb1t", "first_seen": "2026-06-30", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Defensive validation of CVE-2026-46331 / pedit COW with auditd, AppArmor, mitigation comparison and detection logic.", "summary": "Defensive validation of CVE-2026-46331 / pedit COW with auditd, AppArmor, mitigation comparison and detection logic.", "url": "https://github.com/g0thamRabb1t/CVE-2026-46331-pedit-COW-detection" }, { "repository": "seguridadentrerios/CVE-2026-46331", "author": "seguridadentrerios", "first_seen": "2026-06-30", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Chequeo y Fix de la vulnerabilidad \"pedit COW\"", "summary": "Chequeo y Fix de la vulnerabilidad \"pedit COW\"", "url": "https://github.com/seguridadentrerios/CVE-2026-46331" }, { "repository": "Quaerendir/cve-2026-46331-audit", "author": "Quaerendir", "first_seen": "2026-06-29", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "cve-2026-46331-audit script", "summary": "cve-2026-46331-audit script", "url": "https://github.com/Quaerendir/cve-2026-46331-audit" } ], "references": [ "https://github.com/0xBlackash/CVE-2026-46331", "https://github.com/douglasmun/pagecache-lpe-containment-kit", "https://github.com/sgkdev/packet_edit_meme", "https://github.com/vulnquest58/dirtyclone-exploit", "https://github.com/rjt-gupta/page-cache-corruption-lpes", "https://github.com/nawalacheker1/CVE-2026-46331", "https://github.com/cherrycherrymay/PoC-CVE-2026-46331", "https://github.com/V0IDNETWORK/CVE-2026-46331", "https://github.com/MarwahHadi/CVE-2026-46331-pedit-cow", "https://github.com/yanxinwu946/CVE-2026-46331", "https://github.com/g0thamRabb1t/CVE-2026-46331-pedit-COW-detection", "https://github.com/seguridadentrerios/CVE-2026-46331", "https://github.com/Quaerendir/cve-2026-46331-audit" ], "timeline": [ { "at": "2026-08-26T08:01:58Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/0xBlackash/CVE-2026-46331" } ], "epss": 0.00525, "cve_status": "Received", "cve_published_at": "2026-06-16" }, { "id": "CVE-2026-46215", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Linux Kernel 7.0-7.0.8 & 7.0-rc-7.0-rc7 - Use After Free Exploit", "summary": "Linux Kernel 7.0-7.0.8 & 7.0-rc-7.0-rc7 - Use After Free Exploit", "updated_at": "2026-08-01T22:00:00Z", "published_at": "2026-08-01T22:00:00Z", "cvss": 0, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Linux Kernel 7.0-7.0.8 & 7.0-rc-7.0-rc7 - Use After Free Exploit", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CXSecurity WLB-2026080002", "author": "antonius", "first_seen": "2026-08-02", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "Linux Kernel 7.0-7.0.8 & 7.0-rc-7.0-rc7 - Use After Free Exploit", "summary": "Linux Kernel 7.0-7.0.8 & 7.0-rc-7.0-rc7 - Use After Free Exploit", "what_happened": "Linux Kernel 7.0-7.0.8 & 7.0-rc-7.0-rc7 - Use After Free Exploit", "cvss": 0, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "url": "https://cxsecurity.com/issue/WLB-2026080002", "cwe": "Unknown" } ], "references": [ "https://cxsecurity.com/issue/WLB-2026080002" ], "timeline": [ { "at": "2026-08-01T22:00:00Z", "label": "Discovered through CXSecurity", "url": "https://cxsecurity.com/issue/WLB-2026080002" } ] }, { "id": "CVE-2026-43499", "vendor": "Unknown vendor", "product": "Unknown product", "title": "KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499", "summary": "KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499", "updated_at": "2026-08-26T13:14:51Z", "published_at": "2026-08-26T13:14:51Z", "cvss": 7.8, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 131, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n 1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n 2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n dangling pointer primed for UAF around.\n\n 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n \tchangelog ]", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "BuSung-dev/Root-My-Galaxy", "author": "BuSung-dev", "first_seen": "2026-07-17", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 1104, "title": "KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499", "summary": "KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499", "url": "https://github.com/BuSung-dev/Root-My-Galaxy" }, { "repository": "rsyzee/ghostlock-infinix-hot70", "author": "rsyzee", "first_seen": "2026-08-26", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "PoC kernel exploit for GhostLock Privilege Escalation (CVE-2026-43499) on the Infinix Hot 70.", "summary": "PoC kernel exploit for GhostLock Privilege Escalation (CVE-2026-43499) on the Infinix Hot 70.", "url": "https://github.com/rsyzee/ghostlock-infinix-hot70" }, { "repository": "JoinChang/ghostlock-oneplus", "author": "JoinChang", "first_seen": "2026-07-12", "confidence": "High", "verification": "verified", "verified": true, "stars": 326, "title": "GhostLock (CVE-2026-43499) kernel exploit for Android devices with locked bootloader", "summary": "GhostLock (CVE-2026-43499) kernel exploit for Android devices with locked bootloader", "url": "https://github.com/JoinChang/ghostlock-oneplus" }, { "repository": "alex193a/Root-My-Pixel", "author": "alex193a", "first_seen": "2026-08-02", "confidence": "High", "verification": "verified", "verified": true, "stars": 316, "title": "Jailbreak supported Google Pixel phones with CVE-2026-43499", "summary": "Jailbreak supported Google Pixel phones with CVE-2026-43499", "url": "https://github.com/alex193a/Root-My-Pixel" }, { "repository": "CVE-Intel · yakidango-official/GhostLock-H80GT", "author": "yakidango-official", "first_seen": "2026-08-23", "last_seen": "2026-08-26T09:36:40Z", "pushed_at": "2026-08-26T09:35:33Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "LPE", "language": "C", "stars": 3, "forks": 3, "topics": [], "title": "Honor 80 GT privilege escalation PoC: GhostLock (CVE-2026-43499) + custom KernelSU module loading", "repository_description": "Honor 80 GT privilege escalation PoC: GhostLock (CVE-2026-43499) + custom KernelSU module loading", "summary": "Honor 80 GT privilege escalation PoC: GhostLock (CVE-2026-43499) + custom KernelSU module loading", "source": "CVE-Intel", "url": "https://github.com/yakidango-official/GhostLock-H80GT", "cvss": 7.8, "severity": "HIGH", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n 1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n 2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n dangling pointer primed for UAF around.\n\n 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n \tchangelog ]", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "kev": false, "epss": 0.00768, "metadata_source": "CNA", "cve_published_at": "2026-05-21", "cve_status": "Awaiting Analysis" }, { "repository": "CVE-Intel · Linuxoid-cn/CVE-2026-43499-Poc-Analysis", "author": "Linuxoid-cn", "first_seen": "2026-07-14", "last_seen": "2026-08-26T09:35:54Z", "pushed_at": "2026-07-30T11:28:07Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "C", "stars": 77, "forks": 24, "topics": [], "title": "Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only.", "repository_description": "Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only.", "summary": "Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only.", "source": "CVE-Intel", "url": "https://github.com/Linuxoid-cn/CVE-2026-43499-Poc-Analysis", "cvss": 7.8, "severity": "HIGH", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n 1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n 2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n dangling pointer primed for UAF around.\n\n 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n \tchangelog ]", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "kev": false, "epss": 0.00768, "metadata_source": "CNA", "cve_published_at": "2026-05-21", "cve_status": "Awaiting Analysis" }, { "repository": "CVE-Intel · CakesTwix/Android-CVE-2026-43499", "author": "CakesTwix", "first_seen": "2026-07-13", "last_seen": "2026-08-26T09:35:03Z", "pushed_at": "2026-07-20T07:22:42Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Kotlin", "stars": 59, "forks": 8, "topics": [], "title": "Android version CVE-2026-43499 tester", "repository_description": "Android version CVE-2026-43499 tester", "summary": "Android version CVE-2026-43499 tester", "source": "CVE-Intel", "url": "https://github.com/CakesTwix/Android-CVE-2026-43499", "cvss": 7.8, "severity": "HIGH", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n 1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n 2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n dangling pointer primed for UAF around.\n\n 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n \tchangelog ]", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "kev": false, "epss": 0.00768, "metadata_source": "CNA", "cve_published_at": "2026-05-21", "cve_status": "Awaiting Analysis" }, { "repository": "CVE-Intel · JingMatrix/pixel-ksu-root", "author": "JingMatrix", "first_seen": "2026-08-25", "last_seen": "2026-08-26T05:30:50Z", "pushed_at": "2026-08-25T12:38:48Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "C", "stars": 8, "forks": 2, "topics": [], "title": "adb-driven KernelSU loader for stock Google Pixel: temporary kernel R/W via CVE-2026-43499 (GhostLock), then late-loads a signature-matched kernelsu.ko for the running KMI. Manager-agnostic.", "repository_description": "adb-driven KernelSU loader for stock Google Pixel: temporary kernel R/W via CVE-2026-43499 (GhostLock), then late-loads a signature-matched kernelsu.ko for the running KMI. Manager-agnostic.", "summary": "adb-driven KernelSU loader for stock Google Pixel: temporary kernel R/W via CVE-2026-43499 (GhostLock), then late-loads a signature-matched kernelsu.ko for the running KMI. Manager-agnostic.", "source": "CVE-Intel", "url": "https://github.com/JingMatrix/pixel-ksu-root", "cvss": 7.8, "severity": "HIGH", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n 1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n 2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n dangling pointer primed for UAF around.\n\n 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n \tchangelog ]", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "kev": false, "epss": 0.00768, "metadata_source": "CNA", "cve_published_at": "2026-05-21", "cve_status": "Awaiting Analysis" }, { "repository": "NanoTurtle1145/root-my-s24", "author": "NanoTurtle1145", "first_seen": "2026-08-16", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 36, "title": "Using CVE-2026-43499 to root your Galaxy S24 Series(SM-S92X0 ,(China / Hong Kong SAR / Taiwan))", "summary": "Using CVE-2026-43499 to root your Galaxy S24 Series(SM-S92X0 ,(China / Hong Kong SAR / Taiwan))", "url": "https://github.com/NanoTurtle1145/root-my-s24" }, { "repository": "YuKongA/ghostlock-app", "author": "YuKongA", "first_seen": "2026-07-29", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 728, "title": "GhostLock One-Tap Execution App (CVE-2026-43499)", "summary": "GhostLock One-Tap Execution App (CVE-2026-43499)", "url": "https://github.com/YuKongA/ghostlock-app" }, { "repository": "sarabpal-dev/IonStack-S22U", "author": "sarabpal-dev", "first_seen": "2026-08-08", "confidence": "High", "verification": "verified", "verified": true, "stars": 65, "title": "CVE-2026-43499 full exploit chain for Samsung Galaxy S22 Ultra (Android 5.10 kernel)", "summary": "CVE-2026-43499 full exploit chain for Samsung Galaxy S22 Ultra (Android 5.10 kernel)", "url": "https://github.com/sarabpal-dev/IonStack-S22U" }, { "repository": "Cxyofficial/K50G-POCOF4GT-CVE-2026-43499-PoC", "author": "Cxyofficial", "first_seen": "2026-09-01", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-43499 repository", "summary": "", "url": "https://github.com/Cxyofficial/K50G-POCOF4GT-CVE-2026-43499-PoC" }, { "repository": "lkeld/CVE-2026-43499-poc", "author": "lkeld", "first_seen": "2026-09-01", "confidence": "High", "verification": "verified", "verified": true, "stars": 2, "title": "CVE-2026-43499 repository", "summary": "", "url": "https://github.com/lkeld/CVE-2026-43499-poc" }, { "repository": "ankitrawatgit/iQOO-Z9_5G-vivo-T3_5G-Root-GhostLock", "author": "ankitrawatgit", "first_seen": "2026-08-22", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 8, "title": "An iQOO Z9 5G and vivo T3 5G jailbreak/root CVE-2026-43499 Android application and payloads. Both devices use the MediaTek Dimensity 7200 (MT6886) platform. Kernel version 5.15.178.", "summary": "An iQOO Z9 5G and vivo T3 5G jailbreak/root CVE-2026-43499 Android application and payloads. Both devices use the MediaTek Dimensity 7200 (MT6886) platform. Kernel version 5.15.178.", "url": "https://github.com/ankitrawatgit/iQOO-Z9_5G-vivo-T3_5G-Root-GhostLock" }, { "repository": "zzzxxxxxxxxxx/GhostLock-GOT-W29", "author": "zzzxxxxxxxxxx", "first_seen": "2026-08-10", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 4, "title": "CVE-2026-43499 (GhostLock) research on HUAWEI MatePad Pro 11 GOT-W29", "summary": "CVE-2026-43499 (GhostLock) research on HUAWEI MatePad Pro 11 GOT-W29", "url": "https://github.com/zzzxxxxxxxxxx/GhostLock-GOT-W29" } ], "references": [ "https://github.com/BuSung-dev/Root-My-Galaxy", "https://github.com/rsyzee/ghostlock-infinix-hot70", "https://github.com/JoinChang/ghostlock-oneplus", "https://github.com/alex193a/Root-My-Pixel", "https://github.com/yakidango-official/GhostLock-H80GT", "https://github.com/Linuxoid-cn/CVE-2026-43499-Poc-Analysis", "https://github.com/CakesTwix/Android-CVE-2026-43499", "https://github.com/JingMatrix/pixel-ksu-root", "https://github.com/NanoTurtle1145/root-my-s24", "https://github.com/YuKongA/ghostlock-app", "https://github.com/sarabpal-dev/IonStack-S22U", "https://github.com/Cxyofficial/K50G-POCOF4GT-CVE-2026-43499-PoC", "https://github.com/lkeld/CVE-2026-43499-poc", "https://github.com/ankitrawatgit/iQOO-Z9_5G-vivo-T3_5G-Root-GhostLock", "https://github.com/zzzxxxxxxxxxx/GhostLock-GOT-W29" ], "timeline": [ { "at": "2026-08-26T13:14:51Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/BuSung-dev/Root-My-Galaxy" } ], "epss": 0.00768, "severity": "HIGH", "metadata_source": "CNA", "cve_status": "Awaiting Analysis", "cve_published_at": "2026-05-21", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2026-42965", "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "title": "Red Hat OpenShift Container Platform 4.19 vulnerability", "summary": "A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud metadata endpoint, leading to the disclosure of instance credentials and other sensitive metadata. This bypasses previous security measures for validating IP addresses.", "updated_at": "2026-09-05T13:18:11.780", "published_at": "2026-05-29T11:16:16.923", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 13, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-918", "what_happened": "A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud metadata endpoint, leading to the disclosure of instance credentials and other sensitive metadata. This bypasses previous security measures for validating IP addresses.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54770", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/security/cve/CVE-2026-42965", "https://bugzilla.redhat.com/show_bug.cgi?id=2483184", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42965.json" ], "timeline": [ { "at": "2026-05-29T11:16:16.923", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42965" } ] }, { "id": "CVE-2026-42533", "vendor": "Unknown vendor", "product": "Unknown product", "title": "nginx heap buffer overflow PoC — CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed on Ubuntu 24.04.", "summary": "nginx heap buffer overflow PoC — CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed on Ubuntu 24.04.", "updated_at": "2026-08-26T13:19:17Z", "published_at": "2026-08-26T13:19:17Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 128, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "imbas007/CVE-2026-42533", "author": "imbas007", "first_seen": "2026-07-27", "confidence": "High", "verification": "verified", "verified": true, "stars": 35, "title": "nginx heap buffer overflow PoC — CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed on Ubuntu 24.04.", "summary": "nginx heap buffer overflow PoC — CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed on Ubuntu 24.04.", "url": "https://github.com/imbas007/CVE-2026-42533" }, { "repository": "suominen/CVE-2026-42533", "author": "suominen", "first_seen": "2026-07-21", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Tracking the nginx CVE-2026-42533 map/regex capture-clobbering heap overflow", "summary": "Tracking the nginx CVE-2026-42533 map/regex capture-clobbering heap overflow", "url": "https://github.com/suominen/CVE-2026-42533" }, { "repository": "Leeyoonjoo/CVE-2026-42533", "author": "Leeyoonjoo", "first_seen": "2026-08-12", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-42533 repository", "summary": "", "url": "https://github.com/Leeyoonjoo/CVE-2026-42533" }, { "repository": "0xCyberstan/CVE-2026-42533-POC", "author": "0xCyberstan", "first_seen": "2026-08-05", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "CVE-2026-42533: pre-auth nginx heap overflow and info leak from PCRE capture clobbering in the map/script engine, chained to RCE.", "summary": "CVE-2026-42533: pre-auth nginx heap overflow and info leak from PCRE capture clobbering in the map/script engine, chained to RCE.", "url": "https://github.com/0xCyberstan/CVE-2026-42533-POC" }, { "repository": "0xCyberstan/CVE-2026-42533-Config-Scanner", "author": "0xCyberstan", "first_seen": "2026-07-04", "confidence": "High", "verification": "verified", "verified": true, "stars": 30, "title": "Static config scanner that flags nginx configs vulnerable to the complex_value two-pass capture-clobbering bug (regex map + regex capture → heap overflow / info leak).", "summary": "Static config scanner that flags nginx configs vulnerable to the complex_value two-pass capture-clobbering bug (regex map + regex capture → heap overflow / info leak).", "url": "https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner" }, { "repository": "CVE-Intel · Daniyal48/ghostlock-vagrant-box", "author": "Daniyal48", "first_seen": "2026-07-20", "last_seen": "2026-08-05T12:47:31Z", "pushed_at": "2026-07-20T08:10:14Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "LPE", "language": "", "stars": 1, "forks": 0, "topics": [], "title": "An isolated Vagrant testbed designed to simulate a complete attack chain: Initial access via the Nginx heap buffer overflow (CVE-2026-42533) followed by root privilege escalation using the Ghostlock kernel vulnerability (CVE-2026-43449).", "repository_description": "An isolated Vagrant testbed designed to simulate a complete attack chain: Initial access via the Nginx heap buffer overflow (CVE-2026-42533) followed by root privilege escalation using the Ghostlock kernel vulnerability (CVE-2026-43449).", "summary": "An isolated Vagrant testbed designed to simulate a complete attack chain: Initial access via the Nginx heap buffer overflow (CVE-2026-42533) followed by root privilege escalation using the Ghostlock kernel vulnerability (CVE-2026-43449).", "source": "CVE-Intel", "url": "https://github.com/Daniyal48/ghostlock-vagrant-box" }, { "repository": "jelasin/CVE-2026-42533", "author": "jelasin", "first_seen": "2026-07-27", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-42533 repository", "summary": "", "url": "https://github.com/jelasin/CVE-2026-42533" }, { "repository": "ChPratik/NGINX_2026_CVE_Bundle_CTI_Report", "author": "ChPratik", "first_seen": "2026-07-28", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "Covered CVEs: CVE-2026-28755, CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, CVE-2026-42533", "summary": "Covered CVEs: CVE-2026-28755, CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, CVE-2026-42533", "url": "https://github.com/ChPratik/NGINX_2026_CVE_Bundle_CTI_Report" }, { "repository": "FranklinF25/cve-2026-42533", "author": "FranklinF25", "first_seen": "2026-08-29", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-42533 repository", "summary": "", "url": "https://github.com/FranklinF25/cve-2026-42533" }, { "repository": "gagaltotal/CVE-2026-42533-nginx", "author": "gagaltotal", "first_seen": "2026-07-23", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-42533 Nginx", "summary": "CVE-2026-42533 Nginx", "url": "https://github.com/gagaltotal/CVE-2026-42533-nginx" }, { "repository": "seguridadentrerios/CVE-2026-42533", "author": "seguridadentrerios", "first_seen": "2026-07-22", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "Vulnerabilidad en NGINX", "summary": "Vulnerabilidad en NGINX", "url": "https://github.com/seguridadentrerios/CVE-2026-42533" } ], "references": [ "https://github.com/imbas007/CVE-2026-42533", "https://github.com/suominen/CVE-2026-42533", "https://github.com/Leeyoonjoo/CVE-2026-42533", "https://github.com/0xCyberstan/CVE-2026-42533-POC", "https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner", "https://github.com/Daniyal48/ghostlock-vagrant-box", "https://github.com/jelasin/CVE-2026-42533", "https://github.com/ChPratik/NGINX_2026_CVE_Bundle_CTI_Report", "https://github.com/FranklinF25/cve-2026-42533", "https://github.com/gagaltotal/CVE-2026-42533-nginx", "https://github.com/seguridadentrerios/CVE-2026-42533" ], "timeline": [ { "at": "2026-08-26T13:19:17Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/imbas007/CVE-2026-42533" } ] }, { "id": "CVE-2026-42167", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE", "summary": "CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE", "updated_at": "2026-08-24T22:00:00Z", "published_at": "2026-08-24T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 30, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52658", "author": "youcef-!", "first_seen": "2026-08-25", "confidence": "High", "title": "CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE", "summary": "CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE", "url": "https://www.exploit-db.com/exploits/52658", "verification": "verified", "verified": true }, { "repository": "kaleth4/CVE-2026-42167", "author": "kaleth4", "first_seen": "2026-05-04", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-42167 repository", "summary": "", "url": "https://github.com/kaleth4/CVE-2026-42167" }, { "repository": "jimmexploit/CVE-2026-42167-PoC", "author": "jimmexploit", "first_seen": "2026-05-02", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "ProFTPD SQL injection PoC", "summary": "ProFTPD SQL injection PoC", "url": "https://github.com/jimmexploit/CVE-2026-42167-PoC" }, { "repository": "efeanilarslan/CVE-2026-42167-Exploit", "author": "efeanilarslan", "first_seen": "2026-05-02", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Python exploit for CVE-2026-42167 (ProFTPD mod_sql). Features automated file scanning and timing-based blind data exfiltration.", "summary": "Python exploit for CVE-2026-42167 (ProFTPD mod_sql). Features automated file scanning and timing-based blind data exfiltration.", "url": "https://github.com/efeanilarslan/CVE-2026-42167-Exploit" }, { "repository": "Sl4cK0TH/CVE-2026-42167-PoC", "author": "Sl4cK0TH", "first_seen": "2026-05-01", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Pre-Auth RCE in ProFTPD via mod_sql is_escaped_text() bypass (CVE-2026-42167)", "summary": "Pre-Auth RCE in ProFTPD via mod_sql is_escaped_text() bypass (CVE-2026-42167)", "url": "https://github.com/Sl4cK0TH/CVE-2026-42167-PoC" }, { "repository": "ZeroPathAI/proftpd-CVE-2026-42167-poc", "author": "ZeroPathAI", "first_seen": "2026-04-28", "confidence": "High", "verification": "verified", "verified": true, "stars": 24, "title": "POCs to demonstrate CVE-2026-42167 in ProFTPD", "summary": "POCs to demonstrate CVE-2026-42167 in ProFTPD", "url": "https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc" }, { "repository": "dinosn/proftpd-CVE-2026-42167-analysis", "author": "dinosn", "first_seen": "2026-04-29", "confidence": "High", "verification": "verified", "verified": true, "stars": 3, "title": "Independent reproduction, code-level root-cause analysis, and realistic-exposure write-up for CVE-2026-42167 (ProFTPD mod_sql is_escaped_text() bypass).", "summary": "Independent reproduction, code-level root-cause analysis, and realistic-exposure write-up for CVE-2026-42167 (ProFTPD mod_sql is_escaped_text() bypass).", "url": "https://github.com/dinosn/proftpd-CVE-2026-42167-analysis" } ], "references": [ "https://www.exploit-db.com/exploits/52658", "https://github.com/kaleth4/CVE-2026-42167", "https://github.com/jimmexploit/CVE-2026-42167-PoC", "https://github.com/efeanilarslan/CVE-2026-42167-Exploit", "https://github.com/Sl4cK0TH/CVE-2026-42167-PoC", "https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc", "https://github.com/dinosn/proftpd-CVE-2026-42167-analysis" ], "timeline": [ { "at": "2026-08-24T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52658" } ] }, { "id": "CVE-2026-41940", "vendor": "WebPros", "product": "cPanel & WHM and WP2 (WordPress Squared)", "title": "WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability", "summary": "WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.", "updated_at": "2026-08-26T10:03:34Z", "published_at": "2026-08-26T10:03:34Z", "cvss": 9.8, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 134, "kev": true, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "what_happened": "WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52574", "author": "nu11secur1ty", "first_seen": "2026-05-26", "confidence": "High", "title": "cPanel - CRLF Injection", "summary": "cPanel - CRLF Injection", "url": "https://www.exploit-db.com/exploits/52574", "verification": "verified", "verified": true }, { "repository": "CVE-Intel · Kagantua/cPanelWHM-AuthBypass", "author": "Kagantua", "first_seen": "2026-04-30", "last_seen": "2026-08-26T10:03:34Z", "pushed_at": "2026-04-30T07:05:29Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "Bypass", "language": "", "stars": 11, "forks": 7, "topics": [], "title": "CVE-2026-41940", "repository_description": "CVE-2026-41940", "summary": "CVE-2026-41940", "source": "CVE-Intel", "url": "https://github.com/Kagantua/cPanelWHM-AuthBypass", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "kev": true, "epss": 0.98527, "metadata_source": "CNA", "cve_published_at": "2026-04-29", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · ynsmroztas/cPanelSniper", "author": "ynsmroztas", "first_seen": "2026-05-01", "last_seen": "2026-08-25T23:35:54Z", "pushed_at": "2026-05-01T12:10:32Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Injection", "language": "Python", "stars": 494, "forks": 137, "topics": [], "title": "CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection", "repository_description": "CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection", "summary": "CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection", "source": "CVE-Intel", "url": "https://github.com/ynsmroztas/cPanelSniper", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "kev": true, "epss": 0.98527, "metadata_source": "CNA", "cve_published_at": "2026-04-29", "cve_status": "Analyzed" }, { "repository": "lanicer/cve-2026-41940-PoC", "author": "lanicer", "first_seen": "2026-08-19", "confidence": "High", "verification": "verified", "verified": true, "stars": 532, "title": "A cPanel and WHM authentication bypassing tool", "summary": "A cPanel and WHM authentication bypassing tool", "url": "https://github.com/lanicer/cve-2026-41940-PoC" }, { "repository": "CVE-Intel · Defacto-ridgepole254/CVE-2026-41940-Exploit-PoC", "author": "Defacto-ridgepole254", "first_seen": "2026-05-06", "last_seen": "2026-08-25T04:00:53Z", "pushed_at": "2026-08-25T04:00:07Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "Bypass", "language": "", "stars": 1, "forks": 2, "topics": [ "authentication-bypass", "cpanel", "cpanel-exploit", "cve", "cve-2026-41940", "cve-exploit", "exploit", "poc" ], "title": "Test authentication bypass vulnerabilities in cPanel and WHM using this proof of concept exploit tool written in Go.", "repository_description": "Test authentication bypass vulnerabilities in cPanel and WHM using this proof of concept exploit tool written in Go.", "summary": "Test authentication bypass vulnerabilities in cPanel and WHM using this proof of concept exploit tool written in Go.", "source": "CVE-Intel", "url": "https://github.com/Defacto-ridgepole254/CVE-2026-41940-Exploit-PoC", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "kev": true, "epss": 0.98527, "metadata_source": "CNA", "cve_published_at": "2026-04-29", "cve_status": "Analyzed" }, { "repository": "t4xo/CVE-2026-41940", "author": "t4xo", "first_seen": "2026-08-22", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "ts zeroday exp made by nullsec white team", "summary": "ts zeroday exp made by nullsec white team", "url": "https://github.com/t4xo/CVE-2026-41940" }, { "repository": "CVE-Intel · XsanFlip/poc-cpanel-cve-2026-41940", "author": "XsanFlip", "first_seen": "2026-05-01", "last_seen": "2026-08-20T10:42:34Z", "pushed_at": "2026-05-01T16:35:37Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "Python", "stars": 64, "forks": 11, "topics": [], "title": "poc-cpanel-cve-2026-41940", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/XsanFlip/poc-cpanel-cve-2026-41940", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "kev": true, "epss": 0.98527, "metadata_source": "CNA", "cve_published_at": "2026-04-29", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · ilmndwntr/CVE-2026-41940-MASS-EXPLOIT", "author": "ilmndwntr", "first_seen": "2026-04-30", "last_seen": "2026-08-19T23:06:41Z", "pushed_at": "2026-04-30T12:11:51Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 14, "forks": 9, "topics": [], "title": "CVE-2026-41940 SUPPORT SINGLE & MASS SCAN EXPLOIT", "repository_description": "CVE-2026-41940 SUPPORT SINGLE & MASS SCAN EXPLOIT", "summary": "CVE-2026-41940 SUPPORT SINGLE & MASS SCAN EXPLOIT", "source": "CVE-Intel", "url": "https://github.com/ilmndwntr/CVE-2026-41940-MASS-EXPLOIT", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "kev": true, "epss": 0.98527, "metadata_source": "CNA", "cve_published_at": "2026-04-29", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · murrez/CVE-2026-41940", "author": "murrez", "first_seen": "2026-05-06", "last_seen": "2026-08-18T14:03:34Z", "pushed_at": "2026-05-12T06:28:19Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Bypass", "language": "Python", "stars": 5, "forks": 1, "topics": [], "title": "PoC for CVE-2026-41940: WHM/cPanel authentication bypass chain (Python 2.7). For authorized security research and testing only.", "repository_description": "PoC for CVE-2026-41940: WHM/cPanel authentication bypass chain (Python 2.7). For authorized security research and testing only.", "summary": "PoC for CVE-2026-41940: WHM/cPanel authentication bypass chain (Python 2.7). For authorized security research and testing only.", "source": "CVE-Intel", "url": "https://github.com/murrez/CVE-2026-41940", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "kev": true, "epss": 0.98527, "metadata_source": "CNA", "cve_published_at": "2026-04-29", "cve_status": "Analyzed" }, { "repository": "keithbennedict/CVE-2026-41940-Linux", "author": "keithbennedict", "first_seen": "2026-08-11", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-41940 repository", "summary": "", "url": "https://github.com/keithbennedict/CVE-2026-41940-Linux" }, { "repository": "ZildanZ/CVE-2026-41940", "author": "ZildanZ", "first_seen": "2026-05-05", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-41940 repository", "summary": "", "url": "https://github.com/ZildanZ/CVE-2026-41940" }, { "repository": "CerberusMrXi/cPanel-WHM-CVE-2026-41940-auth-bypass-exploit", "author": "CerberusMrXi", "first_seen": "2026-07-26", "confidence": "High", "verification": "verified", "verified": true, "stars": 3, "title": "Critical authentication bypass exploit for cPanel/WHM CVE-2026-41940. Leverages CRLF injection in cpsrvd daemon to gain root WHM access without credentials. Includes version detection, verbose logging, proxy support, JSON reporting, and post-exploitation account enumeration. For authorized security testing only.", "summary": "Critical authentication bypass exploit for cPanel/WHM CVE-2026-41940. Leverages CRLF injection in cpsrvd daemon to gain root WHM access without credentials. Includes version detection, verbose logging, proxy support, JSON reporting, and post-exploitation account enumeration. For authorized security testing only.", "url": "https://github.com/CerberusMrXi/cPanel-WHM-CVE-2026-41940-auth-bypass-exploit" }, { "repository": "AnotherSec/CVE-2026-41940", "author": "AnotherSec", "first_seen": "2026-07-24", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "CVE-2026-41940", "summary": "CVE-2026-41940", "url": "https://github.com/AnotherSec/CVE-2026-41940" }, { "repository": "razureink/cve-2026-41940-cpanel_authbypass_reproduction", "author": "razureink", "first_seen": "2026-07-23", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "CVE Reproduction: cve-2026-41940-cpanel_authbypass_reproduction", "summary": "CVE Reproduction: cve-2026-41940-cpanel_authbypass_reproduction", "url": "https://github.com/razureink/cve-2026-41940-cpanel_authbypass_reproduction" }, { "repository": "oguz-kagan-akar/CVE-2026-41940-analysis", "author": "oguz-kagan-akar", "first_seen": "2026-07-18", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Technical analysis of the cPanel/WHM auth bypass", "summary": "Technical analysis of the cPanel/WHM auth bypass", "url": "https://github.com/oguz-kagan-akar/CVE-2026-41940-analysis" }, { "repository": "tc4dy/CVE-2026-41940-PoC-Exploit", "author": "tc4dy", "first_seen": "2026-05-12", "confidence": "High", "verification": "verified", "verified": true, "stars": 10, "title": "🚀 CVE-2026-41940 cPanel/WHM Auth Bypass Exploit - Best Flow 💥 CRLF injection leads to auth bypass, session hijacking & account leak. ✅ Proxy, custom UA, keep-alive, retries, SSL verify, colored output, file save support. ⚡ Advanced PoC for pentesters. ", "summary": "🚀 CVE-2026-41940 cPanel/WHM Auth Bypass Exploit - Best Flow 💥 CRLF injection leads to auth bypass, session hijacking & account leak. ✅ Proxy, custom UA, keep-alive, retries, SSL verify, colored output, file save support. ⚡ Advanced PoC for pentesters. ", "url": "https://github.com/tc4dy/CVE-2026-41940-PoC-Exploit" }, { "repository": "george1-adel/CVE-2026-41940_exploit", "author": "george1-adel", "first_seen": "2026-05-01", "confidence": "High", "verification": "verified", "verified": true, "stars": 2, "title": "CVE-2026-41940 repository", "summary": "", "url": "https://github.com/george1-adel/CVE-2026-41940_exploit" }, { "repository": "0xgh057r3c0n/CVE-2026-41940", "author": "0xgh057r3c0n", "first_seen": "2026-09-05", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "cPanel & WHM - Authentication Bypass via Session-File CRLF Injection", "summary": "cPanel & WHM - Authentication Bypass via Session-File CRLF Injection", "url": "https://github.com/0xgh057r3c0n/CVE-2026-41940" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/52574", "https://github.com/Kagantua/cPanelWHM-AuthBypass", "https://github.com/ynsmroztas/cPanelSniper", "https://github.com/lanicer/cve-2026-41940-PoC", "https://github.com/Defacto-ridgepole254/CVE-2026-41940-Exploit-PoC", "https://github.com/t4xo/CVE-2026-41940", "https://github.com/XsanFlip/poc-cpanel-cve-2026-41940", "https://github.com/ilmndwntr/CVE-2026-41940-MASS-EXPLOIT", "https://github.com/murrez/CVE-2026-41940", "https://github.com/keithbennedict/CVE-2026-41940-Linux", "https://github.com/ZildanZ/CVE-2026-41940", "https://github.com/CerberusMrXi/cPanel-WHM-CVE-2026-41940-auth-bypass-exploit", "https://github.com/AnotherSec/CVE-2026-41940", "https://github.com/razureink/cve-2026-41940-cpanel_authbypass_reproduction", "https://github.com/oguz-kagan-akar/CVE-2026-41940-analysis", "https://github.com/tc4dy/CVE-2026-41940-PoC-Exploit", "https://github.com/george1-adel/CVE-2026-41940_exploit", "https://github.com/0xgh057r3c0n/CVE-2026-41940" ], "timeline": [ { "at": "2026-08-26T10:03:34Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-30", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-30", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-30", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-30", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-30", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-30", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "epss": 0.98527, "severity": "CRITICAL", "metadata_source": "CNA", "cve_status": "Analyzed", "cve_published_at": "2026-04-29", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2026-41456", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Bludit CMS 3.20.0 - Reflected Cross-Site Scripting", "summary": "Bludit CMS 3.20.0 - Reflected Cross-Site Scripting", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 16, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52678", "author": "Ranjit Kumar Singh", "first_seen": "2026-09-02", "confidence": "High", "title": "Bludit CMS 3.20.0 - Reflected Cross-Site Scripting", "summary": "Bludit CMS 3.20.0 - Reflected Cross-Site Scripting", "url": "https://www.exploit-db.com/exploits/52678", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52678" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52678" } ] }, { "id": "CVE-2026-41089", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Scan Windows Domain Controllers for CVE-2026-41089 to detect unauthenticated remote code execution vulnerabilities in the Netlogon service.", "summary": "Scan Windows Domain Controllers for CVE-2026-41089 to detect unauthenticated remote code execution vulnerabilities in the Netlogon service.", "updated_at": "2026-08-26T10:49:49Z", "published_at": "2026-08-26T10:49:49Z", "cvss": 9.8, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 113, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-121", "what_happened": "Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "opensource-arrozconpollo191/CVE-2026-41089-Netlogon-RCE", "author": "opensource-arrozconpollo191", "first_seen": "2026-07-22", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "Scan Windows Domain Controllers for CVE-2026-41089 to detect unauthenticated remote code execution vulnerabilities in the Netlogon service.", "summary": "Scan Windows Domain Controllers for CVE-2026-41089 to detect unauthenticated remote code execution vulnerabilities in the Netlogon service.", "url": "https://github.com/opensource-arrozconpollo191/CVE-2026-41089-Netlogon-RCE" }, { "repository": "HydraSoft/CVE-2026-41089-Netlogon-RCE", "author": "HydraSoft", "first_seen": "2026-07-21", "confidence": "High", "verification": "verified", "verified": true, "stars": 16, "title": "Technical analysis and Proof-of-Concept (PoC) for CVE-2026-41089, a critical unauthenticated Remote Code Execution (RCE) vulnerability in the Windows Netlogon service affecting Domain Controllers.", "summary": "Technical analysis and Proof-of-Concept (PoC) for CVE-2026-41089, a critical unauthenticated Remote Code Execution (RCE) vulnerability in the Windows Netlogon service affecting Domain Controllers.", "url": "https://github.com/HydraSoft/CVE-2026-41089-Netlogon-RCE" }, { "repository": "0xABCD01/CVE-2026-41089", "author": "0xABCD01", "first_seen": "2026-06-01", "confidence": "High", "verification": "verified", "verified": true, "stars": 212, "title": "CVE-2026-41089 PoC — Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL)", "summary": "CVE-2026-41089 PoC — Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL)", "url": "https://github.com/0xABCD01/CVE-2026-41089" }, { "repository": "ADScanPro/CVE-2026-41089-LongLogon", "author": "ADScanPro", "first_seen": "2026-06-03", "confidence": "High", "verification": "verified", "verified": true, "stars": 14, "title": "CVE-2026-41089 checker: unauthenticated, non-destructive detection for the Netlogon CLDAP stack buffer overflow (CVSS 9.8). Reports whether a domain controller's domain is long enough to crash, without sending the overflow. The binary-verified analysis the public PoCs got wrong.", "summary": "CVE-2026-41089 checker: unauthenticated, non-destructive detection for the Netlogon CLDAP stack buffer overflow (CVSS 9.8). Reports whether a domain controller's domain is long enough to crash, without sending the overflow. The binary-verified analysis the public PoCs got wrong.", "url": "https://github.com/ADScanPro/CVE-2026-41089-LongLogon" }, { "repository": "jelasin/CVE-2026-41089", "author": "jelasin", "first_seen": "2026-06-01", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-41089 PoC — Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL)", "summary": "CVE-2026-41089 PoC — Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL)", "url": "https://github.com/jelasin/CVE-2026-41089" }, { "repository": "0xBlackash/CVE-2026-41089", "author": "0xBlackash", "first_seen": "2026-06-02", "confidence": "High", "verification": "verified", "verified": true, "stars": 11, "title": "CVE-2026-41089", "summary": "CVE-2026-41089", "url": "https://github.com/0xBlackash/CVE-2026-41089" }, { "repository": "hnytgl/CVE-2026-41089", "author": "hnytgl", "first_seen": "2026-06-03", "confidence": "High", "verification": "verified", "verified": true, "stars": 14, "title": "CVE-2026-41089 是 Windows Netlogon 服务中一个关键的远程代码执行漏洞，单包即可崩溃 lsass.exe，导致域控制器在约 30-60 秒内重启。此期间该 DC 的所有域认证将失败。", "summary": "CVE-2026-41089 是 Windows Netlogon 服务中一个关键的远程代码执行漏洞，单包即可崩溃 lsass.exe，导致域控制器在约 30-60 秒内重启。此期间该 DC 的所有域认证将失败。", "url": "https://github.com/hnytgl/CVE-2026-41089" }, { "repository": "hnytgl/CVE-2026-41089-Detector", "author": "hnytgl", "first_seen": "2026-06-03", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "这是一个用于防御巡检的 CVE-2026-41089 检测脚本。该漏洞是 Microsoft 在 2026 年 5 月安全更新中披露的 Windows Netlogon 远程代码执行漏洞。", "summary": "这是一个用于防御巡检的 CVE-2026-41089 检测脚本。该漏洞是 Microsoft 在 2026 年 5 月安全更新中披露的 Windows Netlogon 远程代码执行漏洞。", "url": "https://github.com/hnytgl/CVE-2026-41089-Detector" } ], "references": [ "https://github.com/opensource-arrozconpollo191/CVE-2026-41089-Netlogon-RCE", "https://github.com/HydraSoft/CVE-2026-41089-Netlogon-RCE", "https://github.com/0xABCD01/CVE-2026-41089", "https://github.com/ADScanPro/CVE-2026-41089-LongLogon", "https://github.com/jelasin/CVE-2026-41089", "https://github.com/0xBlackash/CVE-2026-41089", "https://github.com/hnytgl/CVE-2026-41089", "https://github.com/hnytgl/CVE-2026-41089-Detector" ], "timeline": [ { "at": "2026-08-26T10:49:49Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/opensource-arrozconpollo191/CVE-2026-41089-Netlogon-RCE" } ], "epss": 0.79622, "severity": "CRITICAL", "metadata_source": "NIST", "cve_status": "Analyzed", "cve_published_at": "2026-05-12", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2026-39987", "vendor": "Marimo", "product": "Marimo", "title": "Marimo Remote Code Execution Vulnerability", "summary": "Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 34, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52673", "author": "Jason Bernier", "first_seen": "2026-09-02", "confidence": "High", "title": "Marimo 0.20.4 - RCE", "summary": "Marimo 0.20.4 - RCE", "url": "https://www.exploit-db.com/exploits/52673", "verification": "verified", "verified": true }, { "repository": "Ghxstsec/CVE-2026-39987", "author": "Ghxstsec", "first_seen": "2026-09-01", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "CVE-2026-39987 repository", "summary": "", "url": "https://github.com/Ghxstsec/CVE-2026-39987" }, { "repository": "Clara-M-Grossl/Exploit-Marimo", "author": "Clara-M-Grossl", "first_seen": "2026-08-27", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": " Marimo Pre-Auth RCE (CVE-2026–39987)", "summary": " Marimo Pre-Auth RCE (CVE-2026–39987)", "url": "https://github.com/Clara-M-Grossl/Exploit-Marimo" }, { "repository": "dodeepsink/CVE-2026-39987.py", "author": "dodeepsink", "first_seen": "2026-08-20", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "This python script exploit the vulnerable marimo /terminal/ws endpoint and returns a interactive shell.", "summary": "This python script exploit the vulnerable marimo /terminal/ws endpoint and returns a interactive shell.", "url": "https://github.com/dodeepsink/CVE-2026-39987.py" }, { "repository": "K3ysTr0K3R/CVE-2026-39987", "author": "K3ysTr0K3R", "first_seen": "2026-08-19", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "CVE-2026-39987 — Marimo Pre-Authentication RCE", "summary": "CVE-2026-39987 — Marimo Pre-Authentication RCE", "url": "https://github.com/K3ysTr0K3R/CVE-2026-39987" }, { "repository": "matesz44/cve-2026-39987", "author": "matesz44", "first_seen": "2026-08-12", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-39987 PoC: Marimo<0.23.0 Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass", "summary": "CVE-2026-39987 PoC: Marimo<0.23.0 Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass", "url": "https://github.com/matesz44/cve-2026-39987" }, { "repository": "MADA0L/CVE-2026-39987-Poc", "author": "MADA0L", "first_seen": "2026-08-10", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Proof of Concept (PoC) WebSocket client for CVE-2026-39987 (Marimo Pre-Auth RCE), intended for authorized security testing.", "summary": "Proof of Concept (PoC) WebSocket client for CVE-2026-39987 (Marimo Pre-Auth RCE), intended for authorized security testing.", "url": "https://github.com/MADA0L/CVE-2026-39987-Poc" }, { "repository": "alreadyClosed/CVE-2026-39987", "author": "alreadyClosed", "first_seen": "2026-08-07", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-39987 for marimo 0.20.4 PoC", "summary": "CVE-2026-39987 for marimo 0.20.4 PoC", "url": "https://github.com/alreadyClosed/CVE-2026-39987" }, { "repository": "jasonbernier/CVE-2026-39987", "author": "jasonbernier", "first_seen": "2026-08-02", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Simple POC for CVE-2026-39987", "summary": "Simple POC for CVE-2026-39987", "url": "https://github.com/jasonbernier/CVE-2026-39987" }, { "repository": "Wind010/CVE-2026-39987_PoC", "author": "Wind010", "first_seen": "2026-08-03", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "A proof-of-concept for CVE-2026-39987", "summary": "A proof-of-concept for CVE-2026-39987", "url": "https://github.com/Wind010/CVE-2026-39987_PoC" }, { "repository": "vanhari/CVE-2026-39987", "author": "vanhari", "first_seen": "2026-08-02", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-39987 poc", "summary": "CVE-2026-39987 poc", "url": "https://github.com/vanhari/CVE-2026-39987" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/52673", "https://github.com/Ghxstsec/CVE-2026-39987", "https://github.com/Clara-M-Grossl/Exploit-Marimo", "https://github.com/dodeepsink/CVE-2026-39987.py", "https://github.com/K3ysTr0K3R/CVE-2026-39987", "https://github.com/matesz44/cve-2026-39987", "https://github.com/MADA0L/CVE-2026-39987-Poc", "https://github.com/alreadyClosed/CVE-2026-39987", "https://github.com/jasonbernier/CVE-2026-39987", "https://github.com/Wind010/CVE-2026-39987_PoC", "https://github.com/vanhari/CVE-2026-39987" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-23", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-23", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-23", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-23", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-23", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-23", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-23", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-23", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-36669", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-36669-FengOffice exploit", "summary": "Exploit for CVE-2026-36669. CVSS 9.8.", "updated_at": "2026-09-05T08:11:22Z", "published_at": "2026-09-05T08:11:22Z", "cvss": 9.8, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 30, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-434", "what_happened": "Unauthenticated file upload in Feng Office 3.11.13.11 via ck_upload_handler.php enabling XSS.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-36669-FengOffice", "summary": "Unauthenticated file upload in Feng Office 3.11.13.11 via ck_upload_handler.php enabling XSS.", "what_happened": "Unauthenticated file upload in Feng Office 3.11.13.11 via ck_upload_handler.php enabling XSS.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-434", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FIRSTLAX6T-CVE-2026-36669-FENGOFFICE", "https://kitploit.com/zh/tools/github/firstlax6t/cve-2026-36669-fengoffice/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-05T08:11:22", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FIRSTLAX6T-CVE-2026-36669-FENGOFFICE" }, { "title": "Exploit for CVE-2026-36669-FengOffice", "summary": "Unauthenticated file upload in Feng Office 3.11.13.11 via ck_upload_handler.php enabling XSS.", "what_happened": "Unauthenticated file upload in Feng Office 3.11.13.11 via ck_upload_handler.php enabling XSS.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-434", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FIRSTLAX6T-CVE-2026-36669-FENGOFFICE", "https://kitploit.com/zh/tools/github/firstlax6t/cve-2026-36669-fengoffice/" ], "repository": "kitploit.com", "author": "zh", "first_seen": "2026-09-05T08:11:22", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/zh/tools/github/firstlax6t/cve-2026-36669-fengoffice/" }, { "repository": "firstlax6t/CVE-2026-36669-FengOffice", "author": "firstlax6t", "first_seen": "2026-07-15", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-36669 repository", "summary": "", "url": "https://github.com/firstlax6t/CVE-2026-36669-FengOffice" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FIRSTLAX6T-CVE-2026-36669-FENGOFFICE", "https://kitploit.com/zh/tools/github/firstlax6t/cve-2026-36669-fengoffice/", "https://github.com/firstlax6t/CVE-2026-36669-FengOffice" ], "timeline": [ { "at": "2026-09-05T08:11:22Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FIRSTLAX6T-CVE-2026-36669-FENGOFFICE" } ] }, { "id": "CVE-2026-35333", "vendor": "Unknown vendor", "product": "Unknown product", "title": "strongSwan 5.9.13 - DoS", "summary": "strongSwan 5.9.13 - DoS", "updated_at": "2026-08-11T22:00:00Z", "published_at": "2026-08-11T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 19, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "strongSwan 5.9.13 DoS", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52586", "author": "Lukas Johannes Moeller", "first_seen": "2026-05-29", "confidence": "High", "title": "strongSwan 5.9.13 - DoS", "summary": "strongSwan 5.9.13 - DoS", "url": "https://www.exploit-db.com/exploits/52586", "verification": "verified", "verified": true }, { "repository": "CXSecurity WLB-2026080007", "author": "Lukas Johannes Moeller", "first_seen": "2026-08-12", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "strongSwan 5.9.13 DoS", "summary": "strongSwan 5.9.13 DoS", "what_happened": "strongSwan 5.9.13 DoS", "cvss": 0, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "url": "https://cxsecurity.com/issue/WLB-2026080007", "cwe": "Unknown" } ], "references": [ "https://www.exploit-db.com/exploits/52586", "https://cxsecurity.com/issue/WLB-2026080007" ], "timeline": [ { "at": "2026-08-11T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52586" } ] }, { "id": "CVE-2026-34486", "vendor": "Apache", "product": "Tomcat", "title": "Apache Tomcat Missing Encryption of Sensitive Data Vulnerability", "summary": "Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.", "updated_at": "2026-08-03T22:00:00Z", "published_at": "2026-08-03T22:00:00Z", "cvss": 0, "confidence": 65, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-03T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-33824", "vendor": "Microsoft", "product": "Internet Key Exchange (IKE) Service Extensions", "title": "Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability", "summary": "Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.", "updated_at": "2026-08-17T22:00:00Z", "published_at": "2026-08-17T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-17T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-33630", "vendor": "c-ares", "product": "c-ares", "title": "c-ares vulnerability", "summary": "c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.", "updated_at": "2026-09-05T03:17:15.290", "published_at": "2026-09-03T19:17:27.420", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": ">= 1.32.3, < 1.34.7", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-415", "what_happened": "c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc", "https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a", "https://github.com/c-ares/c-ares/pull/1237", "https://github.com/c-ares/c-ares/releases/tag/v1.34.7", "https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542" ], "timeline": [ { "at": "2026-09-03T19:17:27.420", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33630" } ] }, { "id": "CVE-2026-31807", "vendor": "OpenSSH", "product": "OpenSSH Agent", "title": "OpenSSH agent forwarding path validation", "summary": "A path validation error in an agent-forwarding workflow can expose an unintended local socket under specific forwarding configurations.", "updated_at": "2026-09-01T09:38:00Z", "published_at": "2026-09-01T07:12:00Z", "cvss": 9.8, "confidence": 100, "confidence_label": "review", "affected": "≤ 9.9p1", "fixed": "10.0p1", "source_count": 22, "kev": false, "attack_vector": "Remote", "authentication": "Required", "complexity": "Low", "cwe": "CWE-22", "what_happened": "The forwarding path is insufficiently constrained in a narrow agent-forwarding configuration. A remote actor with an existing authenticated path may influence how a local socket is resolved.", "why_matters": "Agent forwarding often bridges trust boundaries. A validation failure can expose credentials or administrative workflows beyond the intended host.", "mitigations": [ "Upgrade to OpenSSH 10.0p1 or later.", "Disable agent forwarding where it is not operationally required.", "Restrict forwarding to explicitly trusted hosts and review agent socket access." ], "pocs": [ { "repository": "openssh-forwarding-validation", "author": "research-lab", "first_seen": "Sep 1, 2026", "confidence": "High", "url": "https://github.com/search?q=CVE-2026-31807&type=repositories" } ], "references": [ "https://github.com/search?q=CVE-2026-31807&type=repositories" ] }, { "id": "CVE-2026-31431", "vendor": "Linux", "product": "Kernel", "title": "Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability", "summary": "Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.", "updated_at": "2026-08-26T10:41:21Z", "published_at": "2026-08-26T10:41:21Z", "cvss": 7.8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 95, "kev": true, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-669", "what_happened": "Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · Liverwortenuresis371/copyfail-rs", "author": "Liverwortenuresis371", "first_seen": "2026-05-05", "last_seen": "2026-08-26T10:41:21Z", "pushed_at": "2026-08-26T10:38:53Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "LPE", "language": "Rust", "stars": 0, "forks": 0, "topics": [ "af-alg", "auditd", "copyfail", "cve", "cve-2026-31431", "detection-engineering", "ebpf", "local-privilege-escalation" ], "title": "Exploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.", "repository_description": "Exploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.", "summary": "Exploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.", "source": "CVE-Intel", "url": "https://github.com/Liverwortenuresis371/copyfail-rs", "cvss": 7.8, "severity": "HIGH", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-669", "kev": true, "epss": 0.99907, "metadata_source": "CNA", "cve_published_at": "2026-04-22", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · theori-io/copy-fail-CVE-2026-31431", "author": "theori-io", "first_seen": "2026-04-29", "last_seen": "2026-08-26T07:37:15Z", "pushed_at": "2026-04-29T21:21:46Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "LPE", "language": "Python", "stars": 4050, "forks": 910, "topics": [ "ai-security", "cve-2026-31431", "exploit", "linux-kernel", "privilege-escalation", "privilege-escalation-exploits", "security-research", "theori" ], "title": "Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code", "repository_description": "Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code", "summary": "Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code", "source": "CVE-Intel", "url": "https://github.com/theori-io/copy-fail-CVE-2026-31431", "cvss": 7.8, "severity": "HIGH", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-669", "kev": true, "epss": 0.99907, "metadata_source": "CNA", "cve_published_at": "2026-04-22", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail", "author": "iss4cf0ng", "first_seen": "2026-04-30", "last_seen": "2026-08-25T13:15:07Z", "pushed_at": "2026-04-30T15:39:36Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "LPE", "language": "Rust", "stars": 56, "forks": 21, "topics": [ "cve", "cve-2026-31431", "exploit", "explotation", "linux", "linux-vulnerability", "poc", "privilege-escalation" ], "title": "Rust implementation Exploit/PoC of CVE-2026-31431-Linux-Copy-Fail, allow executing customized shellcode (such as Meterpreter).", "repository_description": "Rust implementation Exploit/PoC of CVE-2026-31431-Linux-Copy-Fail, allow executing customized shellcode (such as Meterpreter).", "summary": "Rust implementation Exploit/PoC of CVE-2026-31431-Linux-Copy-Fail, allow executing customized shellcode (such as Meterpreter).", "source": "CVE-Intel", "url": "https://github.com/iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail", "cvss": 7.8, "severity": "HIGH", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-669", "kev": true, "epss": 0.99907, "metadata_source": "CNA", "cve_published_at": "2026-04-22", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · EynaExp/Copy-Fail-CVE-2026-31431-modernized", "author": "EynaExp", "first_seen": "2026-05-02", "last_seen": "2026-08-25T07:56:01Z", "pushed_at": "2026-05-02T07:50:43Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 3, "forks": 0, "topics": [], "title": "A modernized version of Copy Fail PE", "repository_description": "A modernized version of Copy Fail PE", "summary": "A modernized version of Copy Fail PE", "source": "CVE-Intel", "url": "https://github.com/EynaExp/Copy-Fail-CVE-2026-31431-modernized", "cvss": 7.8, "severity": "HIGH", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-669", "kev": true, "epss": 0.99907, "metadata_source": "CNA", "cve_published_at": "2026-04-22", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail", "author": "Dullpurple-sloop726", "first_seen": "2026-05-06", "last_seen": "2026-08-25T04:00:30Z", "pushed_at": "2026-08-25T03:59:58Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "LPE", "language": "Rust", "stars": 3, "forks": 0, "topics": [ "af-alg", "container-security", "copy-fail", "cve-2026-31431", "educational", "explotation", "kernel-exploit", "linux-vulnerability" ], "title": "Exploit CVE-2026-31431 on Linux using a Rust implementation to achieve local privilege escalation via an arbitrary page cache write primitive.", "repository_description": "Exploit CVE-2026-31431 on Linux using a Rust implementation to achieve local privilege escalation via an arbitrary page cache write primitive.", "summary": "Exploit CVE-2026-31431 on Linux using a Rust implementation to achieve local privilege escalation via an arbitrary page cache write primitive.", "source": "CVE-Intel", "url": "https://github.com/Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail", "cvss": 7.8, "severity": "HIGH", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-669", "kev": true, "epss": 0.99907, "metadata_source": "CNA", "cve_published_at": "2026-04-22", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · painoob/Copy-Fail-Exploit-CVE-2026-31431", "author": "painoob", "first_seen": "2026-04-29", "last_seen": "2026-08-24T15:16:36Z", "pushed_at": "2026-04-29T21:22:27Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 104, "forks": 22, "topics": [], "title": "Most Linux LPEs need a race window or a kernel-specific offset. Copy Fail is a straight-line logic flaw, it needs neither. The same 732-byte Python script (or .c elf) roots every Linux distribution shipped since 2017.", "repository_description": "Most Linux LPEs need a race window or a kernel-specific offset. Copy Fail is a straight-line logic flaw, it needs neither. The same 732-byte Python script (or .c elf) roots every Linux distribution shipped since 2017.", "summary": "Most Linux LPEs need a race window or a kernel-specific offset. Copy Fail is a straight-line logic flaw, it needs neither. The same 732-byte Python script (or .c elf) roots every Linux distribution shipped since 2017.", "source": "CVE-Intel", "url": "https://github.com/painoob/Copy-Fail-Exploit-CVE-2026-31431", "cvss": 7.8, "severity": "HIGH", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-669", "kev": true, "epss": 0.99907, "metadata_source": "CNA", "cve_published_at": "2026-04-22", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · 6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284", "author": "6abc", "first_seen": "2026-05-05", "last_seen": "2026-08-24T14:12:39Z", "pushed_at": "2026-08-13T13:20:57Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "C", "stars": 1, "forks": 0, "topics": [], "title": "Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284", "cvss": 7.8, "severity": "HIGH", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-669", "kev": true, "epss": 0.99907, "metadata_source": "CNA", "cve_published_at": "2026-04-22", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · xeloxa/copyfail-exploit", "author": "xeloxa", "first_seen": "2026-05-04", "last_seen": "2026-08-24T08:30:43Z", "pushed_at": "2026-05-05T07:01:53Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "LPE", "language": "Python", "stars": 24, "forks": 4, "topics": [ "af-alg", "copy-fail", "cve-2026-31431", "exploit", "linux-kernel", "lpe", "privilege-escalation", "security-research" ], "title": "Copy Fail (CVE-2026-31431) LPE exploit. A clean, multi-arch Python reimplementation targeting the Linux kernel AF_ALG page cache vulnerability.", "repository_description": "Copy Fail (CVE-2026-31431) LPE exploit. A clean, multi-arch Python reimplementation targeting the Linux kernel AF_ALG page cache vulnerability.", "summary": "Copy Fail (CVE-2026-31431) LPE exploit. A clean, multi-arch Python reimplementation targeting the Linux kernel AF_ALG page cache vulnerability.", "source": "CVE-Intel", "url": "https://github.com/xeloxa/copyfail-exploit", "cvss": 7.8, "severity": "HIGH", "cve_description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-669", "kev": true, "epss": 0.99907, "metadata_source": "CNA", "cve_published_at": "2026-04-22", "cve_status": "Analyzed" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://github.com/Liverwortenuresis371/copyfail-rs", "https://github.com/theori-io/copy-fail-CVE-2026-31431", "https://github.com/iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail", "https://github.com/EynaExp/Copy-Fail-CVE-2026-31431-modernized", "https://github.com/Dullpurple-sloop726/CVE-2026-31431-Linux-Copy-Fail", "https://github.com/painoob/Copy-Fail-Exploit-CVE-2026-31431", "https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284", "https://github.com/xeloxa/copyfail-exploit" ], "timeline": [ { "at": "2026-08-26T10:41:21Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-05-01", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-05-01", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-05-01", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-05-01", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-05-01", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-05-01", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "epss": 0.99907, "severity": "HIGH", "metadata_source": "CNA", "cve_status": "Analyzed", "cve_published_at": "2026-04-22", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2026-29711", "vendor": "Acme", "product": "Edge Gateway", "title": "Acme Edge Gateway authentication bypass", "summary": "An authentication boundary flaw may allow a remote unauthenticated actor to access administrative functions on affected gateways.", "updated_at": "2026-09-01T09:27:00Z", "published_at": "2026-05-24T00:37:00Z", "cvss": 8.8, "severity": "HIGH", "epss": 0.61234, "metadata_source": "NIST", "cve_status": "Analyzed", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 100, "confidence_label": "review", "affected": "≤ 3.2.4", "fixed": "3.2.5", "source_count": 29, "kev": true, "attack_vector": "Remote", "authentication": "None", "complexity": "Low", "cwe": "CWE-288", "what_happened": "A flaw in the authentication boundary of Acme Edge Gateway allows a remote unauthenticated actor to access administrative endpoints intended for authorized users. The issue stems from improper validation of session state before routing requests to privileged functionality.", "why_matters": "Successful use can result in administrative access to the gateway, including configuration changes and service disruption. Internet-facing, centrally deployed gateways have the highest exposure.", "mitigations": [ "Upgrade to Acme Edge Gateway 3.2.5 or later.", "Monitor for unusual administrative actions and configuration changes.", "Restrict administrative interfaces to trusted networks.", "Review gateway access logs for unauthenticated requests to administrative paths." ], "pocs": [ { "repository": "CVE-2026-29711-poc", "author": "0x4D31F", "first_seen": "May 24, 2026", "confidence": "Low", "url": "https://github.com/search?q=CVE-2026-29711&type=repositories" }, { "repository": "CVE-Intel · infosec-research/Acme-Edge-CVE-2026-29711", "author": "infosec-research", "first_seen": "2026-05-24", "last_seen": "2026-05-26T14:30:00Z", "pushed_at": "2026-05-26T13:45:00Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Bypass", "language": "PHP", "stars": 18, "forks": 4, "topics": [ "cve", "proof-of-concept" ], "title": "Authentication bypass demonstration for CVE-2026-29711", "repository_description": "Authentication bypass demonstration for CVE-2026-29711", "summary": "Authentication bypass demonstration for CVE-2026-29711", "severity": "HIGH", "epss": 0.61234, "metadata_source": "NIST", "cve_status": "Analyzed", "source": "CVE-Intel", "url": "https://github.com/infosec-research/Acme-Edge-CVE-2026-29711" } ], "timeline": [ { "at": "May 23, 2026 21:14 UTC", "label": "Vendor advisory published", "url": "#" }, { "at": "May 24, 2026 00:37 UTC", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29711" }, { "at": "May 24, 2026 05:02 UTC", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "May 24, 2026 08:41 UTC", "label": "Public PoC repository observed", "url": "https://github.com/search?q=CVE-2026-29711&type=repositories" } ], "references": [ "https://github.com/search?q=CVE-2026-29711&type=repositories", "https://github.com/infosec-research/Acme-Edge-CVE-2026-29711" ] }, { "id": "CVE-2026-29053", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Ghost_CMS 6.19.0 - Remote Code Execution", "summary": "Ghost_CMS 6.19.0 - Remote Code Execution", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 34, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52676", "author": "Maksim Rogov", "first_seen": "2026-09-02", "confidence": "High", "title": "Ghost_CMS 6.19.0 - Remote Code Execution", "summary": "Ghost_CMS 6.19.0 - Remote Code Execution", "url": "https://www.exploit-db.com/exploits/52676", "verification": "verified", "verified": true }, { "repository": "AC8999/CVE-2026-29053", "author": "AC8999", "first_seen": "2026-04-21", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "(RCE) vulnerability discovered in Ghost CMS (specifically affecting versions 0.7.2 through 6.19.0)", "summary": "(RCE) vulnerability discovered in Ghost CMS (specifically affecting versions 0.7.2 through 6.19.0)", "url": "https://github.com/AC8999/CVE-2026-29053" }, { "repository": "rootxran/CVE-2026-29053", "author": "rootxran", "first_seen": "2026-03-12", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-29053 repository", "summary": "", "url": "https://github.com/rootxran/CVE-2026-29053" } ], "references": [ "https://www.exploit-db.com/exploits/52676", "https://github.com/AC8999/CVE-2026-29053", "https://github.com/rootxran/CVE-2026-29053" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52676" } ] }, { "id": "CVE-2026-28402", "vendor": "Google", "product": "Chromium", "title": "Chromium V8 type confusion", "summary": "A type-confusion condition in V8 may allow crafted web content to violate browser process memory safety.", "updated_at": "2026-09-01T09:15:00Z", "published_at": "2026-08-31T19:20:00Z", "cvss": 8.1, "confidence": 64, "confidence_label": "observed", "affected": "138.0.7204.0", "fixed": "138.0.7204.12", "source_count": 9, "kev": false, "attack_vector": "Remote", "authentication": "None", "complexity": "High", "cwe": "CWE-843", "what_happened": "An incorrect object type assumption in V8 can lead to unsafe memory access when processing specially formed JavaScript.", "why_matters": "Browsers process untrusted content continuously, making memory-safety defects relevant even when additional containment must be bypassed.", "mitigations": [ "Update Chromium-based browsers to the latest stable release.", "Confirm managed browser fleets apply automatic updates.", "Monitor vendor advisories for revised affected-version ranges." ], "pocs": [], "references": [] }, { "id": "CVE-2026-27912", "vendor": "Unknown vendor", "product": "Unknown product", "title": "POC tool for ResetNightmare (CVE-2026-27912)", "summary": "POC tool for ResetNightmare (CVE-2026-27912)", "updated_at": "2026-08-26T09:08:08Z", "published_at": "2026-08-26T09:08:08Z", "cvss": 8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 34, "kev": false, "attack_vector": "Adjacent", "authentication": "Low", "complexity": "Low", "cwe": "CWE-285", "what_happened": "Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · Semperis-Community/ResetNightmare", "author": "Semperis-Community", "first_seen": "2026-08-02", "last_seen": "2026-08-26T09:08:08Z", "pushed_at": "2026-08-20T16:44:53Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "PowerShell", "stars": 208, "forks": 37, "topics": [], "title": "POC tool for ResetNightmare (CVE-2026-27912)", "repository_description": "POC tool for ResetNightmare (CVE-2026-27912)", "summary": "POC tool for ResetNightmare (CVE-2026-27912)", "source": "CVE-Intel", "url": "https://github.com/Semperis-Community/ResetNightmare", "cvss": 8, "severity": "HIGH", "cve_description": "Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.", "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Adjacent", "authentication": "Low", "complexity": "Low", "cwe": "CWE-285", "kev": false, "epss": 0.00409, "metadata_source": "NIST", "cve_published_at": "2026-04-14", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · oxstussz-eng/Kerberos-CVE-2026-27912", "author": "oxstussz-eng", "first_seen": "2026-08-14", "last_seen": "2026-08-23T09:44:49Z", "pushed_at": "2026-08-14T15:07:53Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "Python", "stars": 2, "forks": 0, "topics": [], "title": "PoC for CVE-2026-27912 - Windows Kerberos Elevation of Privilege (ResetNightmare). Unauthorized password reset via Kerberos flaw. For security research only.", "repository_description": "PoC for CVE-2026-27912 - Windows Kerberos Elevation of Privilege (ResetNightmare). Unauthorized password reset via Kerberos flaw. For security research only.", "summary": "PoC for CVE-2026-27912 - Windows Kerberos Elevation of Privilege (ResetNightmare). Unauthorized password reset via Kerberos flaw. For security research only.", "source": "CVE-Intel", "url": "https://github.com/oxstussz-eng/Kerberos-CVE-2026-27912", "cvss": 8, "severity": "HIGH", "cve_description": "Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.", "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Adjacent", "authentication": "Low", "complexity": "Low", "cwe": "CWE-285", "kev": false, "epss": 0.00409, "metadata_source": "NIST", "cve_published_at": "2026-04-14", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · mihat2/ResetNightmare-impacket", "author": "mihat2", "first_seen": "2026-08-08", "last_seen": "2026-08-20T10:17:39Z", "pushed_at": "2026-08-11T18:15:39Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "Python", "stars": 4, "forks": 4, "topics": [ "active-directory", "active-directory-security", "cve", "cve-2026-27912", "impacket", "kadmin-changepw", "kerberos", "ldap" ], "title": "CVE-2026-27912 (ResetNightmare) — Linux/impacket port of Semperis Community's Invoke-ResetNightmare PoC", "repository_description": "CVE-2026-27912 (ResetNightmare) — Linux/impacket port of Semperis Community's Invoke-ResetNightmare PoC", "summary": "CVE-2026-27912 (ResetNightmare) — Linux/impacket port of Semperis Community's Invoke-ResetNightmare PoC", "source": "CVE-Intel", "url": "https://github.com/mihat2/ResetNightmare-impacket", "cvss": 8, "severity": "HIGH", "cve_description": "Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.", "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Adjacent", "authentication": "Low", "complexity": "Low", "cwe": "CWE-285", "kev": false, "epss": 0.00409, "metadata_source": "NIST", "cve_published_at": "2026-04-14", "cve_status": "Analyzed" } ], "references": [ "https://github.com/Semperis-Community/ResetNightmare", "https://github.com/oxstussz-eng/Kerberos-CVE-2026-27912", "https://github.com/mihat2/ResetNightmare-impacket" ], "timeline": [ { "at": "2026-08-26T09:08:08Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/Semperis-Community/ResetNightmare" } ], "epss": 0.00409, "severity": "HIGH", "metadata_source": "NIST", "cve_status": "Analyzed", "cve_published_at": "2026-04-14", "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2026-27119", "vendor": "ExampleCMS", "product": "ExampleCMS", "title": "ExampleCMS unrestricted file upload", "summary": "An authenticated content editor can upload a file type outside the intended media policy.", "updated_at": "2026-09-01T08:59:00Z", "published_at": "2026-08-31T16:00:00Z", "cvss": 7.5, "confidence": 59, "confidence_label": "observed", "affected": "≤ 2.6.3", "fixed": "2.6.4", "source_count": 7, "kev": false, "attack_vector": "Remote", "authentication": "Required", "complexity": "Low", "cwe": "CWE-434", "what_happened": "The media upload workflow relies on an incomplete file-type validation sequence for authenticated editors.", "why_matters": "Content-management systems frequently expose uploaded content through the web tier, increasing the impact of policy bypasses.", "mitigations": [ "Upgrade to ExampleCMS 2.6.4.", "Restrict editor roles.", "Store uploaded files outside executable web paths." ], "pocs": [], "references": [] }, { "id": "CVE-2026-25574", "vendor": "Linux", "product": "Linux kernel", "title": "Linux kernel netfilter use-after-free", "summary": "A lifecycle error in a netfilter object can cause a stale reference to be reused by a local process.", "updated_at": "2026-09-01T08:47:00Z", "published_at": "2026-08-30T11:18:00Z", "cvss": 7.8, "confidence": 100, "confidence_label": "review", "affected": "5.10–6.8.9", "fixed": "Vendor dependent", "source_count": 21, "kev": false, "attack_vector": "Local", "authentication": "Local user", "complexity": "Low", "cwe": "CWE-416", "what_happened": "A netfilter object can remain reachable after its expected lifecycle has ended, creating a stale-reference condition.", "why_matters": "Kernel memory-safety issues can cross local privilege boundaries. Distribution-specific backports make package-level verification important.", "mitigations": [ "Apply the kernel update provided by the operating-system vendor.", "Review container and local-user exposure.", "Use distribution advisories rather than upstream version alone to determine status." ], "pocs": [ { "repository": "netfilter-uaf-reproducer", "author": "kernel-research", "first_seen": "Aug 31, 2026", "confidence": "High", "url": "https://github.com/search?q=CVE-2026-25574&type=repositories" } ], "references": [ "https://github.com/search?q=CVE-2026-25574&type=repositories" ] }, { "id": "CVE-2026-25544", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Payload CMS 3.72.0 - Blind SQL Injection", "summary": "Payload CMS 3.72.0 - Blind SQL Injection", "updated_at": "2026-08-31T22:00:00Z", "published_at": "2026-08-31T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52671", "author": "cardosource", "first_seen": "2026-09-01", "confidence": "High", "title": "Payload CMS 3.72.0 - Blind SQL Injection", "summary": "Payload CMS 3.72.0 - Blind SQL Injection", "url": "https://www.exploit-db.com/exploits/52671", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52671" ], "timeline": [ { "at": "2026-08-31T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52671" } ] }, { "id": "CVE-2026-24110", "vendor": "Microsoft", "product": "Windows Print Service", "title": "Windows print service boundary error", "summary": "A service boundary error may permit local privilege escalation under a constrained set of spooler configurations.", "updated_at": "2026-09-01T08:31:00Z", "published_at": "2026-08-29T09:00:00Z", "cvss": 7.8, "confidence": 73, "confidence_label": "observed", "affected": "Server 2022–2025", "fixed": "Latest security update", "source_count": 8, "kev": true, "attack_vector": "Local", "authentication": "Local user", "complexity": "Low", "cwe": "CWE-269", "what_happened": "A print-service operation applies insufficient authorization checks when transitioning a job between trust contexts.", "why_matters": "Print services are commonly present on enterprise hosts and may provide a path from an existing user context to elevated permissions.", "mitigations": [ "Apply the latest vendor security update.", "Disable the print service where it is not required.", "Monitor service configuration changes." ], "pocs": [], "references": [] }, { "id": "CVE-2026-24061", "vendor": "GNU", "product": "InetUtils", "title": "GNU InetUtils Argument Injection Vulnerability", "summary": "GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a \"-f root\" value for the USER environment variable.", "updated_at": "2026-08-26T10:23:43Z", "published_at": "2026-08-26T10:23:43Z", "cvss": 9.8, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 106, "kev": true, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-88", "what_happened": "GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a \"-f root\" value for the USER environment variable.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52524", "author": "aliguliyev", "first_seen": "2026-04-29", "confidence": "High", "title": "GNU InetUtils 2.6 - Telnetd Remote Privilege Escalation", "summary": "GNU InetUtils 2.6 - Telnetd Remote Privilege Escalation", "url": "https://www.exploit-db.com/exploits/52524", "verification": "verified", "verified": true }, { "repository": "CVE-Intel · obrunolima1910/CVE-2026-24061", "author": "obrunolima1910", "first_seen": "2026-02-03", "last_seen": "2026-08-26T10:23:43Z", "pushed_at": "2026-08-26T10:21:17Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Bypass", "language": "Python", "stars": 0, "forks": 0, "topics": [ "agent", "auth", "book", "computer-vision", "cv", "deep-learning", "gluon", "image-classification" ], "title": "🚨 Exploit CVE-2026-24061, a critical remote authentication bypass in GNU inetutils-telnetd, for instant root shell access without authentication.", "repository_description": "🚨 Exploit CVE-2026-24061, a critical remote authentication bypass in GNU inetutils-telnetd, for instant root shell access without authentication.", "summary": "🚨 Exploit CVE-2026-24061, a critical remote authentication bypass in GNU inetutils-telnetd, for instant root shell access without authentication.", "source": "CVE-Intel", "url": "https://github.com/obrunolima1910/CVE-2026-24061", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-88", "kev": true, "epss": 0.97878, "metadata_source": "CNA", "cve_published_at": "2026-01-21", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · jacubes/CVE-2026-24061", "author": "jacubes", "first_seen": "2026-03-08", "last_seen": "2026-08-24T15:14:38Z", "pushed_at": "2026-08-20T10:06:17Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "Python", "stars": 824, "forks": 15, "topics": [ "cve", "cve-2026-24061", "cve-poc", "exploit", "vulnerability" ], "title": "CVE-2026-24061 exploit PoC", "repository_description": "CVE-2026-24061 exploit PoC", "summary": "CVE-2026-24061 exploit PoC", "source": "CVE-Intel", "url": "https://github.com/jacubes/CVE-2026-24061", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-88", "kev": true, "epss": 0.97878, "metadata_source": "CNA", "cve_published_at": "2026-01-21", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · SafeBreach-Labs/CVE-2026-24061", "author": "SafeBreach-Labs", "first_seen": "2026-01-22", "last_seen": "2026-08-24T14:53:01Z", "pushed_at": "2026-01-22T19:37:20Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 207, "forks": 47, "topics": [], "title": "Exploitation of CVE-2026-24061", "repository_description": "Exploitation of CVE-2026-24061", "summary": "Exploitation of CVE-2026-24061", "source": "CVE-Intel", "url": "https://github.com/SafeBreach-Labs/CVE-2026-24061", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-88", "kev": true, "epss": 0.97878, "metadata_source": "CNA", "cve_published_at": "2026-01-21", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · franckferman/CVE-2026-24061", "author": "franckferman", "first_seen": "2026-02-02", "last_seen": "2026-08-21T01:27:11Z", "pushed_at": "2026-03-27T13:51:19Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Injection", "language": "Python", "stars": 4, "forks": 0, "topics": [ "authentication-bypass", "cve", "cve-2026-24061", "cves", "exploit", "exploitation", "exploiting", "inetutils" ], "title": "GNU InetUtils telnetd - Unauthenticated Remote Root via NEW-ENVIRON Variable Injection.", "repository_description": "GNU InetUtils telnetd - Unauthenticated Remote Root via NEW-ENVIRON Variable Injection.", "summary": "GNU InetUtils telnetd - Unauthenticated Remote Root via NEW-ENVIRON Variable Injection.", "source": "CVE-Intel", "url": "https://github.com/franckferman/CVE-2026-24061", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-88", "kev": true, "epss": 0.97878, "metadata_source": "CNA", "cve_published_at": "2026-01-21", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · ekomsSavior/telnet_scan", "author": "ekomsSavior", "first_seen": "2026-03-26", "last_seen": "2026-08-19T23:49:50Z", "pushed_at": "2026-05-22T01:07:58Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 12, "forks": 6, "topics": [], "title": "scanner/exploiter CVE-2026-24061 & CVE-2026-32746", "repository_description": "scanner/exploiter CVE-2026-24061 & CVE-2026-32746", "summary": "scanner/exploiter CVE-2026-24061 & CVE-2026-32746", "source": "CVE-Intel", "url": "https://github.com/ekomsSavior/telnet_scan", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-88", "kev": true, "epss": 0.97878, "metadata_source": "CNA", "cve_published_at": "2026-01-21", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · 0p5cur/CVE-2026-24061-POC", "author": "0p5cur", "first_seen": "2026-01-24", "last_seen": "2026-08-11T18:49:26Z", "pushed_at": "2026-08-11T18:48:52Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 7, "forks": 3, "topics": [ "cve", "cve-2026-24061", "poc", "rce", "root", "telnet", "telnet-server", "unauthenticated-rce" ], "title": "CVE-2026-24061's poc : a critical authentication bypass in telnetd leading to RCE as root Affects systems with telnetd versions containing the vulnerability from 2015 onwards.", "repository_description": "CVE-2026-24061's poc : a critical authentication bypass in telnetd leading to RCE as root Affects systems with telnetd versions containing the vulnerability from 2015 onwards.", "summary": "CVE-2026-24061's poc : a critical authentication bypass in telnetd leading to RCE as root Affects systems with telnetd versions containing the vulnerability from 2015 onwards.", "source": "CVE-Intel", "url": "https://github.com/0p5cur/CVE-2026-24061-POC", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-88", "kev": true, "epss": 0.97878, "metadata_source": "CNA", "cve_published_at": "2026-01-21", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · s-vx/CVE-2026-24061", "author": "s-vx", "first_seen": "2026-07-25", "last_seen": "2026-07-25T20:22:56Z", "pushed_at": "2026-07-25T20:16:02Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Bypass", "language": "Python", "stars": 0, "forks": 0, "topics": [], "title": "Auth Bypass in inetutils-telnetd", "repository_description": "Auth Bypass in inetutils-telnetd", "summary": "Auth Bypass in inetutils-telnetd", "source": "CVE-Intel", "url": "https://github.com/s-vx/CVE-2026-24061", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-88", "kev": true, "epss": 0.97878, "metadata_source": "CNA", "cve_published_at": "2026-01-21", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · Lingzesec/CVE-2026-24061-GUI", "author": "Lingzesec", "first_seen": "2026-01-26", "last_seen": "2026-07-24T01:11:06Z", "pushed_at": "2026-01-28T02:28:40Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 17, "forks": 1, "topics": [], "title": "CVE-2026-24061 GNU Inetutils telnetd 身份验证绕过漏洞检测与利用 GUI 工具", "repository_description": "CVE-2026-24061 GNU Inetutils telnetd 身份验证绕过漏洞检测与利用 GUI 工具", "summary": "CVE-2026-24061 GNU Inetutils telnetd 身份验证绕过漏洞检测与利用 GUI 工具", "source": "CVE-Intel", "url": "https://github.com/Lingzesec/CVE-2026-24061-GUI", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-88", "kev": true, "epss": 0.97878, "metadata_source": "CNA", "cve_published_at": "2026-01-21", "cve_status": "Analyzed" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/52524", "https://github.com/obrunolima1910/CVE-2026-24061", "https://github.com/jacubes/CVE-2026-24061", "https://github.com/SafeBreach-Labs/CVE-2026-24061", "https://github.com/franckferman/CVE-2026-24061", "https://github.com/ekomsSavior/telnet_scan", "https://github.com/0p5cur/CVE-2026-24061-POC", "https://github.com/s-vx/CVE-2026-24061", "https://github.com/Lingzesec/CVE-2026-24061-GUI" ], "timeline": [ { "at": "2026-08-26T10:23:43Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-01-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-01-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-01-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-01-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-01-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-01-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "epss": 0.97878, "severity": "CRITICAL", "metadata_source": "CNA", "cve_status": "Analyzed", "cve_published_at": "2026-01-21", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2026-22948", "vendor": "Cisco", "product": "Secure Access Appliance", "title": "Cisco appliance request parser inconsistency", "summary": "Different request parsing paths can disagree about a protected route on affected appliances.", "updated_at": "2026-09-01T08:12:00Z", "published_at": "2026-08-28T18:05:00Z", "cvss": 9.1, "confidence": 82, "confidence_label": "observed", "affected": "4.8.x", "fixed": "4.8.7", "source_count": 12, "kev": false, "attack_vector": "Remote", "authentication": "None", "complexity": "Low", "cwe": "CWE-444", "what_happened": "Two request parsing layers disagree about how a protected route is normalized.", "why_matters": "Edge appliances sit at a sensitive network boundary and are frequently accessible from less-trusted networks.", "mitigations": [ "Upgrade to version 4.8.7.", "Restrict management interfaces.", "Review reverse-proxy and appliance logs for normalization anomalies." ], "pocs": [], "references": [] }, { "id": "CVE-2026-21962", "vendor": "Oracle", "product": "HTTP Server and Oracle Weblogic Server Proxy Plug-in", "title": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability", "summary": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.", "updated_at": "2026-08-23T22:00:00Z", "published_at": "2026-08-23T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-23T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-24", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-24", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-24", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-24", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-24", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-24", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-21803", "vendor": "Apple", "product": "WebKit", "title": "WebKit out-of-bounds read", "summary": "Malformed web content can trigger an out-of-bounds read in an image-processing path.", "updated_at": "2026-09-01T07:55:00Z", "published_at": "2026-08-28T13:44:00Z", "cvss": 6.5, "confidence": 78, "confidence_label": "observed", "affected": "Vendor advisory", "fixed": "Latest OS update", "source_count": 6, "kev": false, "attack_vector": "Remote", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "An image-processing path can read beyond the expected object boundary when handling malformed web content.", "why_matters": "The affected engine is used across several system applications, broadening potential content exposure.", "mitigations": [ "Apply the latest operating-system and browser updates.", "Prioritize managed mobile and desktop fleets.", "Review the vendor advisory for platform-specific fixed versions." ], "pocs": [], "references": [] }, { "id": "CVE-2026-20841", "vendor": "Unknown vendor", "product": "Unknown product", "title": "🛠 Demonstrate remote code execution in Windows Notepad versions below 11.2510 using the CVE-2026-20841 proof of concept.", "summary": "🛠 Demonstrate remote code execution in Windows Notepad versions below 11.2510 using the CVE-2026-20841 proof of concept.", "updated_at": "2026-08-26T10:26:04Z", "published_at": "2026-08-26T10:26:04Z", "cvss": 7.8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 89, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "what_happened": "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · 404godd/CVE-2026-20841-PoC", "author": "404godd", "first_seen": "2026-02-26", "last_seen": "2026-08-26T10:26:04Z", "pushed_at": "2026-08-26T10:24:25Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "RCE", "language": "", "stars": 0, "forks": 0, "topics": [ "agent", "chinese", "cv", "cve-2016-0856", "cve-2026-20841", "deep-learning", "ethereum", "hacktoberfest" ], "title": "🛠 Demonstrate remote code execution in Windows Notepad versions below 11.2510 using the CVE-2026-20841 proof of concept.", "repository_description": "🛠 Demonstrate remote code execution in Windows Notepad versions below 11.2510 using the CVE-2026-20841 proof of concept.", "summary": "🛠 Demonstrate remote code execution in Windows Notepad versions below 11.2510 using the CVE-2026-20841 proof of concept.", "source": "CVE-Intel", "url": "https://github.com/404godd/CVE-2026-20841-PoC", "cvss": 7.8, "severity": "HIGH", "cve_description": "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "kev": false, "epss": 0.1165, "metadata_source": "CNA", "cve_published_at": "2026-02-10", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · hamzamalik3461/CVE-2026-20841", "author": "hamzamalik3461", "first_seen": "2024-09-22", "last_seen": "2026-08-26T03:34:31Z", "pushed_at": "2026-08-26T03:33:42Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "RCE", "language": "", "stars": 1, "forks": 2, "topics": [ "agent", "command-injection", "cv", "cve", "cve-2016-0856", "cve-2026-20841", "ethereum", "exploit" ], "title": "🛠 Demonstrate remote code execution in Windows Notepad via markdown links exploiting unsecured URL protocols.", "repository_description": "🛠 Demonstrate remote code execution in Windows Notepad via markdown links exploiting unsecured URL protocols.", "summary": "🛠 Demonstrate remote code execution in Windows Notepad via markdown links exploiting unsecured URL protocols.", "source": "CVE-Intel", "url": "https://github.com/hamzamalik3461/CVE-2026-20841", "cvss": 7.8, "severity": "HIGH", "cve_description": "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "kev": false, "epss": 0.1165, "metadata_source": "CNA", "cve_published_at": "2026-02-10", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · BTtea/CVE-2026-20841-PoC", "author": "BTtea", "first_seen": "2026-02-11", "last_seen": "2026-08-23T14:24:35Z", "pushed_at": "2026-02-11T05:56:43Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "PoC", "language": "", "stars": 141, "forks": 21, "topics": [], "title": "PoC", "repository_description": "PoC", "summary": "PoC", "source": "CVE-Intel", "url": "https://github.com/BTtea/CVE-2026-20841-PoC", "cvss": 7.8, "severity": "HIGH", "cve_description": "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "kev": false, "epss": 0.1165, "metadata_source": "CNA", "cve_published_at": "2026-02-10", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · uky007/CVE-2026-20841_notepad_analysis", "author": "uky007", "first_seen": "2026-02-12", "last_seen": "2026-08-20T01:06:23Z", "pushed_at": "2026-02-12T08:06:24Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 3, "forks": 1, "topics": [], "title": "CVE-2026-20841_notepad_analysis", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/uky007/CVE-2026-20841_notepad_analysis", "cvss": 7.8, "severity": "HIGH", "cve_description": "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "kev": false, "epss": 0.1165, "metadata_source": "CNA", "cve_published_at": "2026-02-10", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · 0xBlackash/CVE-2026-20841", "author": "0xBlackash", "first_seen": "2026-06-01", "last_seen": "2026-06-03T05:49:04Z", "pushed_at": "2026-06-02T09:16:26Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "JavaScript", "stars": 1, "forks": 1, "topics": [], "title": "CVE-2026-20841", "repository_description": "CVE-2026-20841", "summary": "CVE-2026-20841", "source": "CVE-Intel", "url": "https://github.com/0xBlackash/CVE-2026-20841", "cvss": 7.8, "severity": "HIGH", "cve_description": "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "kev": false, "epss": 0.1165, "metadata_source": "CNA", "cve_published_at": "2026-02-10", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · whiskeylab/notepad_CVE_2026_20841", "author": "whiskeylab", "first_seen": "2026-04-07", "last_seen": "2026-04-07T15:08:54Z", "pushed_at": "2026-04-07T15:07:24Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "Exploit", "language": "", "stars": 0, "forks": 0, "topics": [], "title": "Notepad CVE-2026-20841", "repository_description": "Notepad CVE-2026-20841", "summary": "Notepad CVE-2026-20841", "source": "CVE-Intel", "url": "https://github.com/whiskeylab/notepad_CVE_2026_20841", "cvss": 7.8, "severity": "HIGH", "cve_description": "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "kev": false, "epss": 0.1165, "metadata_source": "CNA", "cve_published_at": "2026-02-10", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · atiilla/CVE-2026-20841", "author": "atiilla", "first_seen": "2026-02-12", "last_seen": "2026-03-12T20:31:12Z", "pushed_at": "2026-02-12T12:54:53Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 5, "forks": 4, "topics": [], "title": "CVE-2026-20841", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/atiilla/CVE-2026-20841", "cvss": 7.8, "severity": "HIGH", "cve_description": "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "kev": false, "epss": 0.1165, "metadata_source": "CNA", "cve_published_at": "2026-02-10", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · tangent65536/CVE-2026-20841", "author": "tangent65536", "first_seen": "2026-02-11", "last_seen": "2026-02-28T11:25:53Z", "pushed_at": "2026-02-11T14:55:48Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 2, "forks": 1, "topics": [], "title": "PoC for the \"Windows Notepad RCE\"", "repository_description": "PoC for the \"Windows Notepad RCE\"", "summary": "PoC for the \"Windows Notepad RCE\"", "source": "CVE-Intel", "url": "https://github.com/tangent65536/CVE-2026-20841", "cvss": 7.8, "severity": "HIGH", "cve_description": "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "kev": false, "epss": 0.1165, "metadata_source": "CNA", "cve_published_at": "2026-02-10", "cve_status": "Analyzed" } ], "references": [ "https://github.com/404godd/CVE-2026-20841-PoC", "https://github.com/hamzamalik3461/CVE-2026-20841", "https://github.com/BTtea/CVE-2026-20841-PoC", "https://github.com/uky007/CVE-2026-20841_notepad_analysis", "https://github.com/0xBlackash/CVE-2026-20841", "https://github.com/whiskeylab/notepad_CVE_2026_20841", "https://github.com/atiilla/CVE-2026-20841", "https://github.com/tangent65536/CVE-2026-20841" ], "timeline": [ { "at": "2026-08-26T10:26:04Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/404godd/CVE-2026-20841-PoC" } ], "epss": 0.1165, "severity": "HIGH", "metadata_source": "CNA", "cve_status": "Analyzed", "cve_published_at": "2026-02-10", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "id": "CVE-2026-20349", "vendor": "Cisco", "product": "Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)", "title": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability", "summary": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.", "updated_at": "2026-08-10T22:00:00Z", "published_at": "2026-08-10T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 6, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-10T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-11", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-20316", "vendor": "Cisco", "product": "Secure Firewall Management Center (FMC)", "title": "Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability", "summary": "Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.", "updated_at": "2026-07-28T22:00:00Z", "published_at": "2026-07-28T22:00:00Z", "cvss": 0, "confidence": 65, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-07-28T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-29", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-19887", "vendor": "uscnanbu", "product": "Welcart e-Commerce", "title": "Welcart e-Commerce vulnerability", "summary": "The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or theme is required. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, including wp-config.php, which can lead to remote code execution when an attacker re-runs the WordPress installer against a database they control. Successful exploitation is contingent on an admin printing an invoice to trigger file deletion.", "updated_at": "2026-09-05T07:17:11.657", "published_at": "2026-09-05T07:17:11.657", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.12.1 (semver)", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or theme is required. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, including wp-config.php, which can lead to remote code execution when an attacker re-runs the WordPress installer against a database they control. Successful exploitation is contingent on an admin printing an invoice to trigger file deletion.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/usc-e-shop/trunk/classes/cart.class.php#L546", "https://plugins.trac.wordpress.org/browser/usc-e-shop/trunk/classes/orderData.class.php#L41", "https://plugins.trac.wordpress.org/browser/usc-e-shop/trunk/functions/function.php#L218", "https://plugins.trac.wordpress.org/browser/usc-e-shop/trunk/functions/hoock_func.php#L517", "https://plugins.trac.wordpress.org/browser/usc-e-shop/trunk/includes/order_print.php#L16", "https://plugins.trac.wordpress.org/browser/usc-e-shop/trunk/pdf/tcpdf/tcpdf.php#L7794", "https://plugins.trac.wordpress.org/changeset/3673344/usc-e-shop/trunk/classes/orderData.class.php", "https://plugins.trac.wordpress.org/changeset?old_path=%2Fusc-e-shop/tags/2.12.1&new_path=%2Fusc-e-shop/tags/2.12.2", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3673346%40usc-e-shop%2Ftags%2F2.12.2&old=3651925%40usc-e-shop%2Ftags%2F2.12.1", "https://www.wordfence.com/threat-intel/vulnerabilities/id/716a7c3c-2e26-4da9-a299-7dcbaa7e4895?source=cve" ], "timeline": [ { "at": "2026-09-05T07:17:11.657", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19887" } ] }, { "id": "CVE-2026-19861", "vendor": "Unknown", "product": "JetFormBuilder — Dynamic Blocks Form Builder", "title": "JetFormBuilder — Dynamic Blocks Form Builder vulnerability", "summary": "The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless.", "updated_at": "2026-09-05T07:17:11.563", "published_at": "2026-09-05T07:17:11.563", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 3.6.5.2 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/c9c834a3-dc65-4972-9315-d4dcc7f26599/" ], "timeline": [ { "at": "2026-09-05T07:17:11.563", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19861" } ] }, { "id": "CVE-2026-19858", "vendor": "Unknown", "product": "JetFormBuilder — Dynamic Blocks Form Builder", "title": "JetFormBuilder — Dynamic Blocks Form Builder vulnerability", "summary": "The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.", "updated_at": "2026-09-05T07:17:11.467", "published_at": "2026-09-05T07:17:11.467", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 3.6.5.2 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/a9d091f3-6887-4f26-a736-ba26a81d2b32/" ], "timeline": [ { "at": "2026-09-05T07:17:11.467", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19858" } ] }, { "id": "CVE-2026-19769", "vendor": "kstover", "product": "Ninja Forms – The Contact Form Builder That Grows With You", "title": "Ninja Forms – The Contact Form Builder That Grows With You vulnerability", "summary": "The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Ninja Forms File Uploads add-on to be active, as the attack routes the unwhitelisted child entry through the File Uploads handler to write an attacker-supplied HTML file containing arbitrary JavaScript into any web-server-writable directory, including the site root, where it is served from the site's own origin.", "updated_at": "2026-09-05T07:17:11.333", "published_at": "2026-09-05T07:17:11.333", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.15.1 (semver)", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Ninja Forms File Uploads add-on to be active, as the attack routes the unwhitelisted child entry through the File Uploads handler to write an attacker-supplied HTML file containing arbitrary JavaScript into any web-server-writable directory, including the site root, where it is served from the site's own origin.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.14.11/includes/AJAX/Controllers/Submission.php#L303", "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.14.11/includes/AJAX/Controllers/Submission.php#L55", "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.14.11/includes/AJAX/Controllers/Submission.php#L609", "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.14.11/includes/AJAX/Controllers/Submission.php#L61", "https://plugins.trac.wordpress.org/changeset/3674413/ninja-forms/trunk/includes/AJAX/Controllers/Submission.php", "https://plugins.trac.wordpress.org/changeset?old_path=%2Fninja-forms/tags/3.15.1&new_path=%2Fninja-forms/tags/3.15.2", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3674413%40ninja-forms%2Ftags%2F3.15.2&old=3663678%40ninja-forms%2Ftags%2F3.15.1", "https://www.wordfence.com/threat-intel/vulnerabilities/id/2330e381-7db3-4b79-8827-818d2ea954b5?source=cve" ], "timeline": [ { "at": "2026-09-05T07:17:11.333", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19769" } ] }, { "id": "CVE-2026-19632", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-19632 - TranslatePress One-Day PoC", "summary": "CVE-2026-19632 - TranslatePress One-Day PoC", "updated_at": "2026-08-26T10:16:08Z", "published_at": "2026-08-26T10:16:08Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 12, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · YonLiud/CVE-2026-19632", "author": "YonLiud", "first_seen": "2026-08-26", "last_seen": "2026-08-26T10:16:08Z", "pushed_at": "2026-08-26T09:39:24Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "Python", "stars": 0, "forks": 0, "topics": [ "cve", "poc", "wordpress", "wordpress-plugin" ], "title": "CVE-2026-19632 - TranslatePress One-Day PoC", "repository_description": "CVE-2026-19632 - TranslatePress One-Day PoC", "summary": "CVE-2026-19632 - TranslatePress One-Day PoC", "source": "CVE-Intel", "url": "https://github.com/YonLiud/CVE-2026-19632" } ], "references": [ "https://github.com/YonLiud/CVE-2026-19632" ], "timeline": [ { "at": "2026-08-26T10:16:08Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/YonLiud/CVE-2026-19632" } ] }, { "id": "CVE-2026-19490", "vendor": "Unknown vendor", "product": "Unknown product", "title": "NetScaler ADC/Gateway SAML unsigned-assertion bypass via HTTP-Redirect binding (CTX696939) - root cause analysis + PoC", "summary": "NetScaler ADC/Gateway SAML unsigned-assertion bypass via HTTP-Redirect binding (CTX696939) - root cause analysis + PoC", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "PoC-in-GitHub · TarPeg007/CVE-2026-19490", "author": "TarPeg007", "first_seen": "2026-09-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "NetScaler ADC/Gateway SAML unsigned-assertion bypass via HTTP-Redirect binding (CTX696939) - root cause analysis + PoC", "summary": "NetScaler ADC/Gateway SAML unsigned-assertion bypass via HTTP-Redirect binding (CTX696939) - root cause analysis + PoC", "url": "https://github.com/TarPeg007/CVE-2026-19490" } ], "references": [ "https://github.com/TarPeg007/CVE-2026-19490" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through PoC-in-GitHub", "url": "https://github.com/TarPeg007/CVE-2026-19490" } ] }, { "id": "CVE-2026-19130", "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "title": "multicluster engine for Kubernetes 2.1 vulnerability", "summary": "A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.", "updated_at": "2026-09-05T15:17:28.733", "published_at": "2026-08-12T21:17:37.703", "cvss": 5.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-639", "what_happened": "A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/security/cve/CVE-2026-19130", "https://bugzilla.redhat.com/show_bug.cgi?id=2512105" ], "timeline": [ { "at": "2026-08-12T21:17:37.703", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19130" } ] }, { "id": "CVE-2026-18963", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-18963", "summary": "CVE-2026-18963", "updated_at": "2026-08-26T12:33:22Z", "published_at": "2026-08-26T12:33:22Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 109, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · Red-Darkin/CVE-2026-18963-keycloak", "author": "Red-Darkin", "first_seen": "2026-08-24", "last_seen": "2026-08-26T12:33:22Z", "pushed_at": "2026-08-25T18:22:45Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 16, "forks": 3, "topics": [], "title": "CVE-2026-18963", "repository_description": "CVE-2026-18963", "summary": "CVE-2026-18963", "source": "CVE-Intel", "url": "https://github.com/Red-Darkin/CVE-2026-18963-keycloak" }, { "repository": "CVE-Intel · Snizi/CVE-2026-18963-Exploit", "author": "Snizi", "first_seen": "2026-08-20", "last_seen": "2026-08-26T08:33:39Z", "pushed_at": "2026-08-20T22:38:38Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Bypass", "language": "Python", "stars": 24, "forks": 6, "topics": [ "account-takeover", "authentication-bypass", "cve-2026-18963", "exploit", "keycloak", "oauth2", "penetration-testing", "poc" ], "title": "Exploit for KeyCloak CVE-2026-18963", "repository_description": "Exploit for KeyCloak CVE-2026-18963", "summary": "Exploit for KeyCloak CVE-2026-18963", "source": "CVE-Intel", "url": "https://github.com/Snizi/CVE-2026-18963-Exploit" }, { "repository": "CVE-Intel · prot0tw/Keycloak_CVE-2026-18963_PoC", "author": "prot0tw", "first_seen": "2026-08-25", "last_seen": "2026-08-26T08:14:10Z", "pushed_at": "2026-08-26T08:13:39Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "Python", "stars": 13, "forks": 0, "topics": [], "title": "This repo is poc of cve-2026-18963. Please use it on legal products (lab, local,...).", "repository_description": "This repo is poc of cve-2026-18963. Please use it on legal products (lab, local,...).", "summary": "This repo is poc of cve-2026-18963. Please use it on legal products (lab, local,...).", "source": "CVE-Intel", "url": "https://github.com/prot0tw/Keycloak_CVE-2026-18963_PoC" }, { "repository": "CVE-Intel · T0w0T/POC-CVE-2026-18963", "author": "T0w0T", "first_seen": "2026-08-24", "last_seen": "2026-08-25T20:19:58Z", "pushed_at": "2026-08-24T13:07:07Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "Python", "stars": 2, "forks": 0, "topics": [], "title": "POC-CVE-2026-18963", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/T0w0T/POC-CVE-2026-18963" }, { "repository": "CVE-Intel · debugactiveprocess/CVE-2026-18963", "author": "debugactiveprocess", "first_seen": "2026-08-25", "last_seen": "2026-08-25T16:58:52Z", "pushed_at": "2026-08-25T16:49:33Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "Exploit", "language": "", "stars": 0, "forks": 0, "topics": [], "title": "Nuclei template to discover Keycloak reset-credentials endpoints related to CVE-2026-18963 exposure validation.", "repository_description": "Nuclei template to discover Keycloak reset-credentials endpoints related to CVE-2026-18963 exposure validation.", "summary": "Nuclei template to discover Keycloak reset-credentials endpoints related to CVE-2026-18963 exposure validation.", "source": "CVE-Intel", "url": "https://github.com/debugactiveprocess/CVE-2026-18963" }, { "repository": "CVE-Intel · gman0x00/keycloak-CVE-2026-18963", "author": "gman0x00", "first_seen": "2026-08-25", "last_seen": "2026-08-25T15:27:37Z", "pushed_at": "2026-08-25T15:05:16Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "Python", "stars": 0, "forks": 0, "topics": [], "title": "PoC, Dockerfile playground and root cause from patch diff analysis.", "repository_description": "PoC, Dockerfile playground and root cause from patch diff analysis.", "summary": "PoC, Dockerfile playground and root cause from patch diff analysis.", "source": "CVE-Intel", "url": "https://github.com/gman0x00/keycloak-CVE-2026-18963" }, { "repository": "CVE-Intel · kyos-public/keycloak-cve-2026-18963-hunt", "author": "kyos-public", "first_seen": "2026-08-20", "last_seen": "2026-08-25T09:13:33Z", "pushed_at": "2026-08-24T15:28:14Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "Exploit", "language": "", "stars": 11, "forks": 1, "topics": [ "cve", "incident-response", "keycloak", "postgresql", "security" ], "title": "Hunt for CVE-2026-18963 exploitation traces (Keycloak unauthenticated account takeover) in the Keycloak database", "repository_description": "Hunt for CVE-2026-18963 exploitation traces (Keycloak unauthenticated account takeover) in the Keycloak database", "summary": "Hunt for CVE-2026-18963 exploitation traces (Keycloak unauthenticated account takeover) in the Keycloak database", "source": "CVE-Intel", "url": "https://github.com/kyos-public/keycloak-cve-2026-18963-hunt" }, { "repository": "CVE-Intel · minh3102011/CVE-2026-18963_analyst", "author": "minh3102011", "first_seen": "2026-08-24", "last_seen": "2026-08-24T08:57:27Z", "pushed_at": "2026-08-24T08:55:48Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "Exploit", "language": "", "stars": 0, "forks": 0, "topics": [], "title": "CVE-2026-18963_analyst", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/minh3102011/CVE-2026-18963_analyst" }, { "repository": "PoC-in-GitHub · BlackHatExploitation/Exploit-For-CVE-2026-18963", "author": "BlackHatExploitation", "first_seen": "2026-08-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Exploit for CVE-2026-18963 by BlackHatExploitation", "summary": "Exploit for CVE-2026-18963 by BlackHatExploitation", "url": "https://github.com/BlackHatExploitation/Exploit-For-CVE-2026-18963" }, { "repository": "PoC-in-GitHub · alt3kx/CVE-2026-18963", "author": "alt3kx", "first_seen": "2026-08-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detector", "summary": "CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detector", "url": "https://github.com/alt3kx/CVE-2026-18963" }, { "repository": "PoC-in-GitHub · M4xSec/My-Exploits", "author": "M4xSec", "first_seen": "2026-08-31", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Metasploit modules, Python PoCs and throwaway Docker labs for four platform CVEs: Keycloak (CVE-2026-18963), Apache NiFi (CVE-2026-39816), HashiCorp Vault (CVE-2026-5006), HashiCorp Nomad (CVE-2026-7474).", "summary": "Metasploit modules, Python PoCs and throwaway Docker labs for four platform CVEs: Keycloak (CVE-2026-18963), Apache NiFi (CVE-2026-39816), HashiCorp Vault (CVE-2026-5006), HashiCorp Nomad (CVE-2026-7474).", "url": "https://github.com/M4xSec/My-Exploits" }, { "repository": "PoC-in-GitHub · EQSTLab/CVE-2026-18963", "author": "EQSTLab", "first_seen": "2026-09-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Keycloak reset-credentials flow bypass", "summary": "Keycloak reset-credentials flow bypass", "url": "https://github.com/EQSTLab/CVE-2026-18963" } ], "references": [ "https://github.com/Red-Darkin/CVE-2026-18963-keycloak", "https://github.com/Snizi/CVE-2026-18963-Exploit", "https://github.com/prot0tw/Keycloak_CVE-2026-18963_PoC", "https://github.com/T0w0T/POC-CVE-2026-18963", "https://github.com/debugactiveprocess/CVE-2026-18963", "https://github.com/gman0x00/keycloak-CVE-2026-18963", "https://github.com/kyos-public/keycloak-cve-2026-18963-hunt", "https://github.com/minh3102011/CVE-2026-18963_analyst", "https://github.com/BlackHatExploitation/Exploit-For-CVE-2026-18963", "https://github.com/alt3kx/CVE-2026-18963", "https://github.com/M4xSec/My-Exploits", "https://github.com/EQSTLab/CVE-2026-18963" ], "timeline": [ { "at": "2026-08-26T12:33:22Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/Red-Darkin/CVE-2026-18963-keycloak" } ] }, { "id": "CVE-2026-18874", "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "title": "Red Hat Advanced Cluster Management for Kubernetes 2.11 vulnerability", "summary": "A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.", "updated_at": "2026-09-05T15:17:28.587", "published_at": "2026-08-19T18:16:36.080", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "High", "cwe": "CWE-94", "what_happened": "A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60389", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/security/cve/CVE-2026-18874", "https://bugzilla.redhat.com/show_bug.cgi?id=2511115" ], "timeline": [ { "at": "2026-08-19T18:16:36.080", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18874" } ] }, { "id": "CVE-2026-18843", "vendor": "The Beaver Builder Team", "product": "Beaver Builder Plugin (Starter Version)", "title": "Beaver Builder Plugin (Starter Version) vulnerability", "summary": "The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", "updated_at": "2026-09-05T07:17:11.207", "published_at": "2026-09-05T07:17:11.207", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.11.0.1 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.wordfence.com/threat-intel/vulnerabilities/id/074c95bb-c68e-452d-bd2e-c44866aeedba?source=cve", "https://www.wpbeaverbuilder.com/" ], "timeline": [ { "at": "2026-09-05T07:17:11.207", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18843" } ] }, { "id": "CVE-2026-18577", "vendor": "N-able", "product": "N-central", "title": "N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability", "summary": "N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.", "updated_at": "2026-08-02T22:00:00Z", "published_at": "2026-08-02T22:00:00Z", "cvss": 0, "confidence": 65, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-02T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-18556", "vendor": "N-able", "product": "N-central", "title": "N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability", "summary": "N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.", "updated_at": "2026-08-03T22:00:00Z", "published_at": "2026-08-03T22:00:00Z", "cvss": 0, "confidence": 65, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-03T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-18406", "vendor": "brainstormforce", "product": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz", "title": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz vulnerability", "summary": "The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "updated_at": "2026-09-05T07:17:11.040", "published_at": "2026-09-05T07:17:11.040", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.12.2 (semver)", "fixed": "See vendor advisory", "source_count": 9, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/sureforms/tags/2.12.2/assets/build/entries.js#L172", "https://plugins.trac.wordpress.org/browser/sureforms/tags/2.12.2/inc/form-submit.php#L1451", "https://plugins.trac.wordpress.org/browser/sureforms/tags/2.12.2/inc/form-submit.php#L229", "https://plugins.trac.wordpress.org/browser/sureforms/tags/2.12.2/inc/form-submit.php#L93", "https://plugins.trac.wordpress.org/browser/sureforms/tags/2.12.2/inc/helper.php#L241", "https://plugins.trac.wordpress.org/changeset/3635980/sureforms/trunk/inc/form-submit.php", "https://plugins.trac.wordpress.org/changeset?old_path=%2Fsureforms/tags/2.12.2&new_path=%2Fsureforms/tags/2.12.3", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3636000%40sureforms%2Ftags%2F2.12.3&old=3618798%40sureforms%2Ftags%2F2.12.2", "https://www.wordfence.com/threat-intel/vulnerabilities/id/8583c1f2-0820-492c-9fa1-d96e0ce2ddf2?source=cve" ], "timeline": [ { "at": "2026-09-05T07:17:11.040", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18406" } ] }, { "id": "CVE-2026-18404", "vendor": "quadlayers", "product": "Social Chat – Click To Chat App Button", "title": "Social Chat – Click To Chat App Button vulnerability", "summary": "The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires no user interaction beyond page load, as setting auto_open and consent_enabled to 'yes' in the injected data-box JSON causes the consent box — and the embedded script — to execute immediately on page load.", "updated_at": "2026-09-05T06:17:09.577", "published_at": "2026-09-05T06:17:09.577", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 8.6.2 (semver)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires no user interaction beyond page load, as setting auto_open and consent_enabled to 'yes' in the injected data-box JSON causes the consent box — and the embedded script — to execute immediately on page load.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/wp-whatsapp-chat/tags/8.5.1/build/frontend/js/index.js#L2", "https://plugins.trac.wordpress.org/browser/wp-whatsapp-chat/tags/8.5.1/lib/controllers/class-frontend.php#L86", "https://plugins.trac.wordpress.org/browser/wp-whatsapp-chat/tags/8.6.1/build/frontend/js/index.js#L2", "https://plugins.trac.wordpress.org/browser/wp-whatsapp-chat/tags/8.6.1/lib/controllers/class-frontend.php#L86", "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-whatsapp-chat/tags/8.6.2&new_path=%2Fwp-whatsapp-chat/tags/8.6.3", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3667778%40wp-whatsapp-chat%2Ftags%2F8.6.3&old=3664149%40wp-whatsapp-chat%2Ftags%2F8.6.2", "https://www.wordfence.com/threat-intel/vulnerabilities/id/f159392b-5bc6-4c12-a924-13ea170bb7fa?source=cve" ], "timeline": [ { "at": "2026-09-05T06:17:09.577", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18404" } ] }, { "id": "CVE-2026-18366", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator", "summary": "Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator", "updated_at": "2026-09-04T22:00:00Z", "published_at": "2026-09-04T22:00:00Z", "cvss": 0, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "PoC-in-GitHub · Nxploited/CVE-2026-18366", "author": "Nxploited", "first_seen": "2026-08-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator", "summary": "Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator", "url": "https://github.com/Nxploited/CVE-2026-18366" }, { "repository": "PoC-in-GitHub · ghostpels/CVE-2026-18366", "author": "ghostpels", "first_seen": "2026-08-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2026-18366: Events Manager < 7.4.1 — Unauthenticated Privilege Escalation to Administrator. Write-up and proof-of-concept (poc.py).", "summary": "CVE-2026-18366: Events Manager < 7.4.1 — Unauthenticated Privilege Escalation to Administrator. Write-up and proof-of-concept (poc.py).", "url": "https://github.com/ghostpels/CVE-2026-18366" }, { "repository": "PoC-in-GitHub · katranSefa/CVE-2026-18366", "author": "katranSefa", "first_seen": "2026-09-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2026-18366 repository", "summary": "", "url": "https://github.com/katranSefa/CVE-2026-18366" } ], "references": [ "https://github.com/Nxploited/CVE-2026-18366", "https://github.com/ghostpels/CVE-2026-18366", "https://github.com/katranSefa/CVE-2026-18366" ], "timeline": [ { "at": "2026-09-04T22:00:00Z", "label": "Discovered through PoC-in-GitHub", "url": "https://github.com/Nxploited/CVE-2026-18366" } ] }, { "id": "CVE-2026-17543", "vendor": "Unknown vendor", "product": "Unknown product", "title": "e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout", "summary": "Safe PowerShell validator for PHP CVE-2026-17543 exposure via HTTP headers and non-destructive login-form probes.", "updated_at": "2026-08-26T11:32:38Z", "published_at": "2026-08-26T11:32:38Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 27, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · Hunt-Benito/e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout", "author": "Hunt-Benito", "first_seen": "2026-08-06", "last_seen": "2026-08-26T11:32:38Z", "pushed_at": "2026-08-06T17:08:12Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Injection", "language": "PHP", "stars": 1, "forks": 1, "topics": [], "title": "e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/Hunt-Benito/e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout" }, { "repository": "CVE-Intel · pratham220/CVE-2026-17543-PHP-Exposure-Validator", "author": "pratham220", "first_seen": "2026-08-04", "last_seen": "2026-08-11T13:38:52Z", "pushed_at": "2026-08-06T07:49:29Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "PowerShell", "stars": 0, "forks": 0, "topics": [], "title": "Safe PowerShell validator for PHP CVE-2026-17543 exposure via HTTP headers and non-destructive login-form probes.", "repository_description": "Safe PowerShell validator for PHP CVE-2026-17543 exposure via HTTP headers and non-destructive login-form probes.", "summary": "Safe PowerShell validator for PHP CVE-2026-17543 exposure via HTTP headers and non-destructive login-form probes.", "source": "CVE-Intel", "url": "https://github.com/pratham220/CVE-2026-17543-PHP-Exposure-Validator" } ], "references": [ "https://github.com/Hunt-Benito/e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout", "https://github.com/pratham220/CVE-2026-17543-PHP-Exposure-Validator" ], "timeline": [ { "at": "2026-08-26T11:32:38Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/Hunt-Benito/e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout" } ] }, { "id": "CVE-2026-17107", "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "title": "multicluster engine for Kubernetes 2.1 vulnerability", "summary": "A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.", "updated_at": "2026-09-05T15:17:28.427", "published_at": "2026-07-24T19:16:55.907", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 9, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-441", "what_happened": "A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47388", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47949", "https://access.redhat.com/errata/RHSA-2026:47953", "https://access.redhat.com/errata/RHSA-2026:47974", "https://access.redhat.com/errata/RHSA-2026:48284", "https://access.redhat.com/security/cve/CVE-2026-17107", "https://bugzilla.redhat.com/show_bug.cgi?id=2506771" ], "timeline": [ { "at": "2026-07-24T19:16:55.907", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17107" } ] }, { "id": "CVE-2026-17106", "vendor": "Unknown vendor", "product": "Unknown product", "title": "PoC repository for the blog post CopyEscape: Taking Over Docker Hosts with docker cp", "summary": "PoC repository for the blog post CopyEscape: Taking Over Docker Hosts with docker cp", "updated_at": "2026-08-26T08:01:44Z", "published_at": "2026-08-26T08:01:44Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 34, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · masasron/CopyEscape-CVE-2026-17106", "author": "masasron", "first_seen": "2026-08-09", "last_seen": "2026-08-26T08:01:44Z", "pushed_at": "2026-08-09T21:04:41Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "C", "stars": 21, "forks": 4, "topics": [], "title": "PoC repository for the blog post CopyEscape: Taking Over Docker Hosts with docker cp", "repository_description": "PoC repository for the blog post CopyEscape: Taking Over Docker Hosts with docker cp", "summary": "PoC repository for the blog post CopyEscape: Taking Over Docker Hosts with docker cp", "source": "CVE-Intel", "url": "https://github.com/masasron/CopyEscape-CVE-2026-17106" }, { "repository": "CVE-Intel · 686f6c61/POC-CopyEscape-CVE-2026-17106", "author": "686f6c61", "first_seen": "2026-08-12", "last_seen": "2026-08-14T16:06:55Z", "pushed_at": "2026-08-12T16:41:56Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "C", "stars": 1, "forks": 0, "topics": [ "container-escape", "cve", "cve-2026-17106", "docker", "docker-security", "exploit", "inotify", "ld-preload" ], "title": "PoC funcional de CVE-2026-17106 (CopyEscape): carrera TOCTOU en docker cp que permite escritura arbitraria en el host Docker. Laboratorio Docker + monitor inotify + LD_PRELOAD. Variante macOS inocua y Linux destructiva.", "repository_description": "PoC funcional de CVE-2026-17106 (CopyEscape): carrera TOCTOU en docker cp que permite escritura arbitraria en el host Docker. Laboratorio Docker + monitor inotify + LD_PRELOAD. Variante macOS inocua y Linux destructiva.", "summary": "PoC funcional de CVE-2026-17106 (CopyEscape): carrera TOCTOU en docker cp que permite escritura arbitraria en el host Docker. Laboratorio Docker + monitor inotify + LD_PRELOAD. Variante macOS inocua y Linux destructiva.", "source": "CVE-Intel", "url": "https://github.com/686f6c61/POC-CopyEscape-CVE-2026-17106" }, { "repository": "CVE-Intel · HackSpeak/CVE-2026-17106", "author": "HackSpeak", "first_seen": "2026-08-11", "last_seen": "2026-08-12T10:41:42Z", "pushed_at": "2026-08-11T11:35:07Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "C", "stars": 1, "forks": 0, "topics": [], "title": "CopyEscape (CVE-2026-17106) docker cp container-to-host arbitrary file write PoC mirror — Imperva Ron Masas, MIT; for authorized security testing", "repository_description": "CopyEscape (CVE-2026-17106) docker cp container-to-host arbitrary file write PoC mirror — Imperva Ron Masas, MIT; for authorized security testing", "summary": "CopyEscape (CVE-2026-17106) docker cp container-to-host arbitrary file write PoC mirror — Imperva Ron Masas, MIT; for authorized security testing", "source": "CVE-Intel", "url": "https://github.com/HackSpeak/CVE-2026-17106" } ], "references": [ "https://github.com/masasron/CopyEscape-CVE-2026-17106", "https://github.com/686f6c61/POC-CopyEscape-CVE-2026-17106", "https://github.com/HackSpeak/CVE-2026-17106" ], "timeline": [ { "at": "2026-08-26T08:01:44Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/masasron/CopyEscape-CVE-2026-17106" } ] }, { "id": "CVE-2026-16812", "vendor": "Arista", "product": "VeloCloud Orchestrator", "title": "Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability", "summary": "Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.", "updated_at": "2026-07-26T22:00:00Z", "published_at": "2026-07-26T22:00:00Z", "cvss": 0, "confidence": 65, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-07-26T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-16649", "vendor": "Gravity Forms", "product": "Gravity Forms", "title": "Gravity Forms vulnerability", "summary": "The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time sanitization because wp_kses_post allows the required HTML tags and attributes, and the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML while only stripping script elements, leaving onerror and other event-handler attributes fully intact and executable.", "updated_at": "2026-09-05T07:17:10.917", "published_at": "2026-09-05T07:17:10.917", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.10.5 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time sanitization because wp_kses_post allows the required HTML tags and attributes, and the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML while only stripping script elements, leaving onerror and other event-handler attributes fully intact and executable.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://docs.gravityforms.com/gravityforms-change-log/", "https://www.wordfence.com/threat-intel/vulnerabilities/id/187a420d-a5a5-4b0e-945b-c5694243e68f?source=cve" ], "timeline": [ { "at": "2026-09-05T07:17:10.917", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16649" } ] }, { "id": "CVE-2026-16242", "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "title": "multicluster engine for Kubernetes 2.1 vulnerability", "summary": "A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.", "updated_at": "2026-09-05T15:17:28.160", "published_at": "2026-07-20T08:16:29.833", "cvss": 9.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 19, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "what_happened": "A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47388", "https://access.redhat.com/errata/RHSA-2026:47728", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47949", "https://access.redhat.com/errata/RHSA-2026:47953", "https://access.redhat.com/errata/RHSA-2026:47974", "https://access.redhat.com/errata/RHSA-2026:48284", "https://access.redhat.com/errata/RHSA-2026:48657", "https://access.redhat.com/errata/RHSA-2026:48670", "https://access.redhat.com/errata/RHSA-2026:48676", "https://access.redhat.com/errata/RHSA-2026:48693", "https://access.redhat.com/errata/RHSA-2026:48699", "https://access.redhat.com/errata/RHSA-2026:50758", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/security/cve/CVE-2026-16242", "https://bugzilla.redhat.com/show_bug.cgi?id=2502690", "https://github.com/openshift/hypershift/pull/9031" ], "timeline": [ { "at": "2026-07-20T08:16:29.833", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16242" } ] }, { "id": "CVE-2026-15984", "vendor": "Themovation", "product": "QuickCal", "title": "QuickCal vulnerability", "summary": "The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenticated booked_add_appt AJAX action is publicly embedded on any page rendering the booking calendar shortcode, making it trivially obtainable by unauthenticated attackers without any prior account or privilege.", "updated_at": "2026-09-05T07:17:10.793", "published_at": "2026-09-05T07:17:10.793", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.20 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenticated booked_add_appt AJAX action is publicly embedded on any page rendering the booking calendar shortcode, making it trivially obtainable by unauthenticated attackers without any prior account or privilege.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://codecanyon.net/item/quickcal-appointment-booking-calendar-for-wordpress/47981746", "https://www.wordfence.com/threat-intel/vulnerabilities/id/9bfcfc13-ccfb-4319-99a7-7d7510a11cfe?source=cve" ], "timeline": [ { "at": "2026-09-05T07:17:10.793", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15984" } ] }, { "id": "CVE-2026-15981", "vendor": "Unknown vendor", "product": "Unknown product", "title": "SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter", "summary": "SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter", "updated_at": "2026-09-04T22:00:00Z", "published_at": "2026-09-04T22:00:00Z", "cvss": 0, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "PoC-in-GitHub · Nxploited/CVE-2026-15981", "author": "Nxploited", "first_seen": "2026-07-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter", "summary": "SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter", "url": "https://github.com/Nxploited/CVE-2026-15981" }, { "repository": "PoC-in-GitHub · katranSefa/CVE-2026-15981", "author": "katranSefa", "first_seen": "2026-09-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2026-15981 repository", "summary": "", "url": "https://github.com/katranSefa/CVE-2026-15981" } ], "references": [ "https://github.com/Nxploited/CVE-2026-15981", "https://github.com/katranSefa/CVE-2026-15981" ], "timeline": [ { "at": "2026-09-04T22:00:00Z", "label": "Discovered through PoC-in-GitHub", "url": "https://github.com/Nxploited/CVE-2026-15981" } ] }, { "id": "CVE-2026-15550", "vendor": "Saturday Drive", "product": "Ninja Forms - Save Progress", "title": "Ninja Forms - Save Progress vulnerability", "summary": "The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions.", "updated_at": "2026-09-05T12:16:47.050", "published_at": "2026-09-05T12:16:47.050", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.0.30 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://ninjaforms.com/extensions/save-progress/", "https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d3e6ce-e6d7-455b-a43d-a14189b30491?source=cve" ], "timeline": [ { "at": "2026-09-05T12:16:47.050", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15550" } ] }, { "id": "CVE-2026-15247", "vendor": "Unknown", "product": "Search Atlas SEO", "title": "Search Atlas SEO vulnerability", "summary": "The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.", "updated_at": "2026-09-05T07:17:10.693", "published_at": "2026-09-05T07:17:10.693", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 2.6.24 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/1618ba19-c410-440b-a2d9-1e1526614549/" ], "timeline": [ { "at": "2026-09-05T07:17:10.693", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15247" } ] }, { "id": "CVE-2026-15013", "vendor": "Unknown vendor", "product": "Unknown product", "title": "miniOrange 5.4.3 - Unauthenticated Auth Bypass", "summary": "miniOrange 5.4.3 - Unauthenticated Auth Bypass", "updated_at": "2026-08-31T22:00:00Z", "published_at": "2026-08-31T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52668", "author": "zer0dayf", "first_seen": "2026-09-01", "confidence": "High", "title": "miniOrange 5.4.3 - Unauthenticated Auth Bypass", "summary": "miniOrange 5.4.3 - Unauthenticated Auth Bypass", "url": "https://www.exploit-db.com/exploits/52668", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52668" ], "timeline": [ { "at": "2026-08-31T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52668" } ] }, { "id": "CVE-2026-14975", "vendor": "JoomUnited", "product": "WP File Download", "title": "WP File Download vulnerability", "summary": "The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta value via the unprotected file.save handler, after which the streaming endpoint — hooked on init with no authentication requirement — resolves and streams the traversed file path to any caller, including unauthenticated visitors.", "updated_at": "2026-09-05T07:17:10.560", "published_at": "2026-09-05T07:17:10.560", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.3.8 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-22", "what_happened": "The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta value via the unprotected file.save handler, after which the streaming endpoint — hooked on init with no authentication requirement — resolves and streams the traversed file path to any caller, including unauthenticated visitors.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/wp-file-download/trunk/app/site/init.php#L225", "https://www.joomunited.com/changelog/wp-file-download-changelog", "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b99e525-c1d3-463d-8b87-b7d7fdd535d1?source=cve" ], "timeline": [ { "at": "2026-09-05T07:17:10.560", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14975" } ] }, { "id": "CVE-2026-14620", "vendor": "Unknown vendor", "product": "Unknown product", "title": "webpack_devserver 5.2.5 - CSRF", "summary": "webpack_devserver 5.2.5 - CSRF", "updated_at": "2026-08-16T22:00:00Z", "published_at": "2026-08-16T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52649", "author": "Jorge González Milla", "first_seen": "2026-08-17", "confidence": "High", "title": "webpack_devserver 5.2.5 - CSRF", "summary": "webpack_devserver 5.2.5 - CSRF", "url": "https://www.exploit-db.com/exploits/52649", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52649" ], "timeline": [ { "at": "2026-08-16T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52649" } ] }, { "id": "CVE-2026-13447", "vendor": "inspireui", "product": "MStore API – Create Native Android & iOS Apps On The Cloud", "title": "MStore API – Create Native Android & iOS Apps On The Cloud vulnerability", "summary": "The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.", "updated_at": "2026-09-05T06:17:09.403", "published_at": "2026-09-05T06:17:09.403", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.20.0 (semver)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-287", "what_happened": "The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/flutter-user.php#L829", "https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/flutter-user.php#L940", "https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/helpers/firebase-phone-auth-helper.php#L5", "https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L829", "https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L940", "https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/helpers/firebase-phone-auth-helper.php#L5", "https://www.wordfence.com/threat-intel/vulnerabilities/id/4a1127af-74f6-4748-9aee-5a8c6c2766a4?source=cve" ], "timeline": [ { "at": "2026-09-05T06:17:09.403", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13447" } ] }, { "id": "CVE-2026-12843", "vendor": "StellarWP", "product": "LearnDash LMS", "title": "LearnDash LMS vulnerability", "summary": "The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content.", "updated_at": "2026-09-05T12:16:46.923", "published_at": "2026-09-05T12:16:46.923", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "4.25.0 through 5.1.6 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://docs.nexcess.com/software/changelogs/learndash/sfwd-lms/5-1-6-1/", "https://www.wordfence.com/threat-intel/vulnerabilities/id/48d29e8d-4084-401e-82ff-e4750d739c7c?source=cve" ], "timeline": [ { "at": "2026-09-05T12:16:46.923", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12843" } ] }, { "id": "CVE-2026-11057", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-5281-CVE-2026-11057-fullchain", "summary": "Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)", "updated_at": "2026-08-26T08:07:16Z", "published_at": "2026-08-26T08:07:16Z", "cvss": 6.5, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 12, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-457", "what_happened": "Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · jaf0rk/CVE-2026-5281-CVE-2026-11057-fullchain", "author": "jaf0rk", "first_seen": "2026-08-25", "last_seen": "2026-08-26T08:07:16Z", "pushed_at": "2026-08-26T08:03:18Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "HTML", "stars": 1, "forks": 0, "topics": [], "title": "CVE-2026-5281-CVE-2026-11057-fullchain", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/jaf0rk/CVE-2026-5281-CVE-2026-11057-fullchain", "cvss": 6.5, "severity": "MEDIUM", "cve_description": "Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-457", "kev": false, "epss": 0.0025, "metadata_source": "CNA", "cve_published_at": "2026-06-04", "cve_status": "Analyzed" } ], "references": [ "https://github.com/jaf0rk/CVE-2026-5281-CVE-2026-11057-fullchain" ], "timeline": [ { "at": "2026-08-26T08:07:16Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/jaf0rk/CVE-2026-5281-CVE-2026-11057-fullchain" } ], "epss": 0.0025, "severity": "MEDIUM", "metadata_source": "CNA", "cve_status": "Analyzed", "cve_published_at": "2026-06-04", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "id": "CVE-2026-10196", "vendor": "getwpfunnels", "product": "Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails", "title": "Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails vulnerability", "summary": "The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code on the server. The vulnerability was partially patched in version 1.23.1.", "updated_at": "2026-09-05T12:16:46.790", "published_at": "2026-09-05T12:16:46.790", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.31.0 (semver)", "fixed": "See vendor advisory", "source_count": 9, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code on the server. The vulnerability was partially patched in version 1.23.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.21.0/app/API/Actions/Frontend/FormAction.php#L59", "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.21.0/app/Database/models/ContactModel.php#L460", "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.21.0/vendor/posthog/posthog-php/lib/Consumer/ForkCurl.php#L96", "https://plugins.trac.wordpress.org/browser/mail-mint/trunk/app/API/Actions/Frontend/FormAction.php#L59", "https://plugins.trac.wordpress.org/browser/mail-mint/trunk/app/Database/models/ContactModel.php#L460", "https://plugins.trac.wordpress.org/browser/mail-mint/trunk/vendor/posthog/posthog-php/lib/Consumer/ForkCurl.php#L96", "https://plugins.trac.wordpress.org/changeset/3545065/", "https://plugins.trac.wordpress.org/changeset/3675453/", "https://www.wordfence.com/threat-intel/vulnerabilities/id/76c073d9-9572-43e4-82eb-49adf678535b?source=cve" ], "timeline": [ { "at": "2026-09-05T12:16:46.790", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10196" } ] }, { "id": "CVE-2026-10090", "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "title": "Red Hat Advanced Cluster Management for Kubernetes 2.11 vulnerability", "summary": "A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped \"edit\" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whether the subscription creator holds the \"open-cluster-management:subscription-admin\" role and without restricting applied resources to the subscription namespace. This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the \"cluster-admin\" ClusterRole. Successful exploitation results in full cluster-admin privilege escalation. This contradicts the ACM documentation which states that non-subscription-admin users should have resources deployed into the subscription namespace only.", "updated_at": "2026-09-05T15:17:28.010", "published_at": "2026-08-05T09:18:14.667", "cvss": 9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-267", "what_happened": "A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped \"edit\" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whether the subscription creator holds the \"open-cluster-management:subscription-admin\" role and without restricting applied resources to the subscription namespace. This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the \"cluster-admin\" ClusterRole. Successful exploitation results in full cluster-admin privilege escalation. This contradicts the ACM documentation which states that non-subscription-admin users should have resources deployed into the subscription namespace only.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60389", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/security/cve/CVE-2026-10090", "https://bugzilla.redhat.com/show_bug.cgi?id=2483292" ], "timeline": [ { "at": "2026-08-05T09:18:14.667", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10090" } ] }, { "id": "CVE-2026-10059", "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "title": "multicluster engine for Kubernetes 2.1 vulnerability", "summary": "A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.", "updated_at": "2026-09-05T15:17:27.253", "published_at": "2026-08-05T09:18:13.720", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-266", "what_happened": "A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/security/cve/CVE-2026-10059", "https://bugzilla.redhat.com/show_bug.cgi?id=2483187" ], "timeline": [ { "at": "2026-08-05T09:18:13.720", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10059" } ] }, { "id": "CVE-2026-9830", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-9830 Proof of Concept", "summary": "CVE-2026-9830 Proof of Concept", "updated_at": "2026-08-26T12:56:07Z", "published_at": "2026-08-26T12:56:07Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 27, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · opaxial/CVE-2026-9830", "author": "opaxial", "first_seen": "2026-08-15", "last_seen": "2026-08-26T12:56:07Z", "pushed_at": "2026-08-20T21:56:15Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "PoC", "language": "Python", "stars": 343, "forks": 5, "topics": [ "cve", "cve-2026-9830", "cvss", "exploit", "exploit-db", "latest", "poc", "proof-of-concept" ], "title": "CVE-2026-9830 Proof of Concept", "repository_description": "CVE-2026-9830 Proof of Concept", "summary": "CVE-2026-9830 Proof of Concept", "source": "CVE-Intel", "url": "https://github.com/opaxial/CVE-2026-9830" }, { "repository": "CVE-Intel · ChPratik/CVE-2026-9830", "author": "ChPratik", "first_seen": "2026-07-27", "last_seen": "2026-07-27T16:42:49Z", "pushed_at": "2026-07-27T16:39:18Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": false, "artifact_type": "Exploit", "language": "", "stars": 0, "forks": 0, "topics": [], "title": "The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.", "repository_description": "The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.", "summary": "The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.", "source": "CVE-Intel", "url": "https://github.com/ChPratik/CVE-2026-9830" } ], "references": [ "https://github.com/opaxial/CVE-2026-9830", "https://github.com/ChPratik/CVE-2026-9830" ], "timeline": [ { "at": "2026-08-26T12:56:07Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/opaxial/CVE-2026-9830" } ] }, { "id": "CVE-2026-9736", "vendor": "IBM", "product": "Netezza Software", "title": "Netezza Software vulnerability", "summary": "IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.", "updated_at": "2026-09-05T03:17:24.683", "published_at": "2026-09-03T21:17:24.560", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "11.3.0.3 through Interim Fix 002 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-117", "what_happened": "IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.ibm.com/support/pages/node/7284359" ], "timeline": [ { "at": "2026-09-03T21:17:24.560", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9736" } ] }, { "id": "CVE-2026-9586", "vendor": "Sangoma", "product": "Switchvox", "title": "Sangoma Switchvox SQL Injection Vulnerability", "summary": "Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 9, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-09-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-9198", "vendor": "IBM", "product": "Langflow", "title": "IBM Langflow Code Injection Vulnerability", "summary": "Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 24, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52675", "author": "Richard Howe", "first_seen": "2026-09-02", "confidence": "High", "title": "Langflow 1.10.0 - RCE", "summary": "Langflow 1.10.0 - RCE", "url": "https://www.exploit-db.com/exploits/52675", "verification": "verified", "verified": true } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/52675" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-8625", "vendor": "dearhive", "product": "DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer", "title": "DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer vulnerability", "summary": "The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (Custom HTML block inner HTML)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can insert a crafted .df-element div with data-df-lightbox='thumb' via a Custom HTML block, whose inner HTML is passed as the title argument to parseThumbs() at render time, enabling both innerHTML injection into a span element and attribute breakout via an onerror handler on a constructed img element.", "updated_at": "2026-09-05T06:17:10.690", "published_at": "2026-09-05T06:17:10.690", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.4.30 (semver)", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (Custom HTML block inner HTML)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can insert a crafted .df-element div with data-df-lightbox='thumb' via a Custom HTML block, whose inner HTML is passed as the title argument to parseThumbs() at render time, enabling both innerHTML injection into a span element and attribute breakout via an onerror handler on a constructed img element.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/tags/2.4.27/assets/js/dflip.js#L2712", "https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/tags/2.4.27/assets/js/dflip.js#L2718", "https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/tags/2.4.27/assets/js/dflip.js#L2791", "https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/tags/2.4.27/assets/js/dflip.js#L2796", "https://plugins.trac.wordpress.org/changeset/3641463/3d-flipbook-dflip-lite/trunk/assets/js/dflip.js", "https://plugins.trac.wordpress.org/changeset?old_path=%2F3d-flipbook-dflip-lite/tags/2.4.30&new_path=%2F3d-flipbook-dflip-lite/tags/2.4.37", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3641463%403d-flipbook-dflip-lite%2Ftags%2F2.4.37&old=3557511%403d-flipbook-dflip-lite%2Ftags%2F2.4.30", "https://www.wordfence.com/threat-intel/vulnerabilities/id/741150a3-1b2a-4b54-9dd5-992d3d7079dc?source=cve" ], "timeline": [ { "at": "2026-09-05T06:17:10.690", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8625" } ] }, { "id": "CVE-2026-8623", "vendor": "dearhive", "product": "DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer", "title": "DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer vulnerability", "summary": "The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (class attribute of .dvcss element)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is embedded as a Base64-encoded JSON object in a CSS class name on a Custom HTML block; the frontend parseCSSElements() function decodes it client-side with atob() and JSON.parse() and renders the logo property as raw HTML, meaning no server-side or client-side sanitization intercepts the malicious script before DOM insertion.", "updated_at": "2026-09-05T06:17:10.547", "published_at": "2026-09-05T06:17:10.547", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.4.30 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (class attribute of .dvcss element)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is embedded as a Base64-encoded JSON object in a CSS class name on a Custom HTML block; the frontend parseCSSElements() function decodes it client-side with atob() and JSON.parse() and renders the logo property as raw HTML, meaning no server-side or client-side sanitization intercepts the malicious script before DOM insertion.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/tags/2.4.27/assets/js/dflip.js#L11255", "https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/tags/2.4.27/assets/js/dflip.js#L2687", "https://plugins.trac.wordpress.org/changeset/3641463/3d-flipbook-dflip-lite/trunk/assets/js/dflip.js", "https://plugins.trac.wordpress.org/changeset?old_path=%2F3d-flipbook-dflip-lite/tags/2.4.30&new_path=%2F3d-flipbook-dflip-lite/tags/2.4.37", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3641463%403d-flipbook-dflip-lite%2Ftags%2F2.4.37&old=3557511%403d-flipbook-dflip-lite%2Ftags%2F2.4.30", "https://www.wordfence.com/threat-intel/vulnerabilities/id/27e2848d-6271-4bb9-92e2-0f8c8860745d?source=cve" ], "timeline": [ { "at": "2026-09-05T06:17:10.547", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8623" } ] }, { "id": "CVE-2026-8452", "vendor": "Citrix", "product": "NetScaler ADC and NetScaler Gateway", "title": "Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability", "summary": "Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.", "updated_at": "2026-08-25T22:00:00Z", "published_at": "2026-08-25T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-25T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-8037", "vendor": "Progress", "product": "LoadMaster", "title": "Progress LoadMaster Command Injection Vulnerability", "summary": "Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.", "updated_at": "2026-08-06T22:00:00Z", "published_at": "2026-08-06T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 6, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-06T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-07", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-07", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-07", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-07", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-07", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-5281", "vendor": "Google", "product": "Dawn", "title": "Google Dawn Use-After-Free Vulnerability", "summary": "Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "updated_at": "2026-08-26T08:07:16Z", "published_at": "2026-08-26T08:07:16Z", "cvss": 8.8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 51, "kev": true, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-416", "what_happened": "Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · jaf0rk/CVE-2026-5281-CVE-2026-11057-fullchain", "author": "jaf0rk", "first_seen": "2026-08-25", "last_seen": "2026-08-26T08:07:16Z", "pushed_at": "2026-08-26T08:03:18Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "HTML", "stars": 1, "forks": 0, "topics": [], "title": "CVE-2026-5281-CVE-2026-11057-fullchain", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/jaf0rk/CVE-2026-5281-CVE-2026-11057-fullchain", "cvss": 8.8, "severity": "HIGH", "cve_description": "Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-416", "kev": true, "epss": 0.04938, "metadata_source": "CNA", "cve_published_at": "2026-04-01", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · TheMalwareGuardian/CVE-2026-5281", "author": "TheMalwareGuardian", "first_seen": "2026-04-06", "last_seen": "2026-07-23T13:54:17Z", "pushed_at": "2026-04-07T18:24:14Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 2, "forks": 1, "topics": [ "browser-exploitation", "cve-2026-5281", "google-chrome" ], "title": "CVE-2026-5281 (Chrome Dawn WebGPU UAF) analysis, lab validation tools, and reproducible environment for vulnerable vs patched builds.", "repository_description": "CVE-2026-5281 (Chrome Dawn WebGPU UAF) analysis, lab validation tools, and reproducible environment for vulnerable vs patched builds.", "summary": "CVE-2026-5281 (Chrome Dawn WebGPU UAF) analysis, lab validation tools, and reproducible environment for vulnerable vs patched builds.", "source": "CVE-Intel", "url": "https://github.com/TheMalwareGuardian/CVE-2026-5281", "cvss": 8.8, "severity": "HIGH", "cve_description": "Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-416", "kev": true, "epss": 0.04938, "metadata_source": "CNA", "cve_published_at": "2026-04-01", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · jaf0rk/CVE-2026-5281", "author": "jaf0rk", "first_seen": "2026-05-22", "last_seen": "2026-07-18T02:15:41Z", "pushed_at": "2026-07-18T02:15:38Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "HTML", "stars": 0, "forks": 0, "topics": [], "title": "CVE-2026-5281", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/jaf0rk/CVE-2026-5281", "cvss": 8.8, "severity": "HIGH", "cve_description": "Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-416", "kev": true, "epss": 0.04938, "metadata_source": "CNA", "cve_published_at": "2026-04-01", "cve_status": "Analyzed" }, { "repository": "CVE-Intel · umair-aziz025/CVE-2026-5281-Research-Toolkit", "author": "umair-aziz025", "first_seen": "2026-04-02", "last_seen": "2026-06-21T01:44:18Z", "pushed_at": "2026-04-02T03:45:14Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 4, "forks": 6, "topics": [], "title": "Chrome WebGPU Use-After-Free (CWE-416) This toolkit is for security research and defensive verification around CVE-2026-5281. Patched Chrome version: 146.0.7680.178 Potentially vulnerable versions: anything below 146.0.7680.178", "repository_description": "Chrome WebGPU Use-After-Free (CWE-416) This toolkit is for security research and defensive verification around CVE-2026-5281. Patched Chrome version: 146.0.7680.178 Potentially vulnerable versions: anything below 146.0.7680.178", "summary": "Chrome WebGPU Use-After-Free (CWE-416) This toolkit is for security research and defensive verification around CVE-2026-5281. Patched Chrome version: 146.0.7680.178 Potentially vulnerable versions: anything below 146.0.7680.178", "source": "CVE-Intel", "url": "https://github.com/umair-aziz025/CVE-2026-5281-Research-Toolkit", "cvss": 8.8, "severity": "HIGH", "cve_description": "Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-416", "kev": true, "epss": 0.04938, "metadata_source": "CNA", "cve_published_at": "2026-04-01", "cve_status": "Analyzed" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://github.com/jaf0rk/CVE-2026-5281-CVE-2026-11057-fullchain", "https://github.com/TheMalwareGuardian/CVE-2026-5281", "https://github.com/jaf0rk/CVE-2026-5281", "https://github.com/umair-aziz025/CVE-2026-5281-Research-Toolkit" ], "timeline": [ { "at": "2026-08-26T08:07:16Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-01", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-01", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-01", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-01", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-01", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-04-01", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "epss": 0.04938, "severity": "HIGH", "metadata_source": "CNA", "cve_status": "Analyzed", "cve_published_at": "2026-04-01", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "id": "CVE-2026-5027", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Langflow 1.8.4 - Path Traversal to Remote Code Execution", "summary": "Langflow 1.8.4 - Path Traversal to Remote Code Execution", "updated_at": "2026-08-30T22:00:00Z", "published_at": "2026-08-30T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52659", "author": "cardosource", "first_seen": "2026-08-31", "confidence": "High", "title": "Langflow 1.8.4 - Path Traversal to Remote Code Execution", "summary": "Langflow 1.8.4 - Path Traversal to Remote Code Execution", "url": "https://www.exploit-db.com/exploits/52659", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52659" ], "timeline": [ { "at": "2026-08-30T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52659" } ] }, { "id": "CVE-2026-4740", "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "title": "multicluster engine for Kubernetes 2.1 vulnerability", "summary": "A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.", "updated_at": "2026-09-05T14:17:23.253", "published_at": "2026-04-07T15:17:46.797", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "confidence": 80, "confidence_label": "verified", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 17, "kev": false, "attack_vector": "Local", "authentication": "High", "complexity": "Low", "cwe": "CWE-295", "what_happened": "A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "blog.arfevrier.fr", "author": "NVD reference", "first_seen": "2026-04-07", "confidence": "High", "verification": "verified", "verified": true, "url": "https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/" } ], "references": [ "https://access.redhat.com/errata/RHSA-2026:11414", "https://access.redhat.com/errata/RHSA-2026:13542", "https://access.redhat.com/errata/RHSA-2026:13853", "https://access.redhat.com/errata/RHSA-2026:8218", "https://access.redhat.com/errata/RHSA-2026:9848", "https://access.redhat.com/security/cve/CVE-2026-4740", "https://blog.arfevrier.fr/open-cluster-management-cross-cluster-escape/", "https://bugzilla.redhat.com/show_bug.cgi?id=2450590", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4740.json" ], "timeline": [ { "at": "2026-04-07T15:17:46.797", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4740" } ] }, { "id": "CVE-2026-4361", "vendor": "Elegant Themes", "product": "Divi", "title": "Divi vulnerability", "summary": "The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oembed_thumbnail_resolution()` function using `wp_remote_get()` instead of `wp_safe_remote_get()` to fetch a remote image URL, which does not restrict requests to private or reserved IP ranges. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application server. The response body is not returned to the attacker (blind SSRF), but two oracles exist: a status oracle (the returned URL string differs depending on whether the target responded with HTTP 200) and a timing oracle (response time varies by target reachability).", "updated_at": "2026-09-05T07:17:11.930", "published_at": "2026-09-05T07:17:11.930", "cvss": 5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.27.6 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-918", "what_happened": "The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oembed_thumbnail_resolution()` function using `wp_remote_get()` instead of `wp_safe_remote_get()` to fetch a remote image URL, which does not restrict requests to private or reserved IP ranges. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application server. The response body is not returned to the attacker (blind SSRF), but two oracles exist: a status oracle (the returned URL string differs depending on whether the target responded with HTTP 200) and a timing oracle (response time varies by target reachability).", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.divichangelog.com/divi-update/divi-4/version-4-27-7", "https://www.elegantthemes.com/", "https://www.wordfence.com/threat-intel/vulnerabilities/id/f35c0de9-abed-4cbf-a28c-48f8133a1bad?source=cve" ], "timeline": [ { "at": "2026-09-05T07:17:11.930", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4361" } ] }, { "id": "CVE-2026-3891", "vendor": "Unknown vendor", "product": "Unknown product", "title": "WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload", "summary": "WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload", "updated_at": "2026-08-20T22:00:00Z", "published_at": "2026-08-20T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 23, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "WooCommerce 1.5.0 Unauthenticated Arbitrary File Upload", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52642", "author": "Mohammad Hossein Sadeghian", "first_seen": "2026-08-17", "confidence": "High", "title": "WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload", "summary": "WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload", "url": "https://www.exploit-db.com/exploits/52642", "verification": "verified", "verified": true }, { "repository": "CXSecurity WLB-2026080011", "author": "Mohammad Hossein Sadeghian", "first_seen": "2026-08-21", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "WooCommerce 1.5.0 Unauthenticated Arbitrary File Upload", "summary": "WooCommerce 1.5.0 Unauthenticated Arbitrary File Upload", "what_happened": "WooCommerce 1.5.0 Unauthenticated Arbitrary File Upload", "cvss": 0, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "url": "https://cxsecurity.com/issue/WLB-2026080011", "cwe": "Unknown" } ], "references": [ "https://www.exploit-db.com/exploits/52642", "https://cxsecurity.com/issue/WLB-2026080011" ], "timeline": [ { "at": "2026-08-20T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52642" } ] }, { "id": "CVE-2026-3853", "vendor": "Elegant Themes", "product": "Divi", "title": "Divi vulnerability", "summary": "The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options` whitelist (which only contains `url`, `button_link`, `button_url`), so it never receives `esc_url_raw()` at save time. On the server side, the value is rendered into a `data-image` HTML attribute using `esc_attr()`, which encodes double quotes as `"`. However, the client-side JavaScript carousel code in `custom.unified.js` reads this attribute using jQuery's `.data('image')`, which returns the browser-decoded value (with `"` decoded back to `\"`). The decoded value is then concatenated directly into an HTML string and injected into the DOM via `jQuery.after()` without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.", "updated_at": "2026-09-05T07:17:11.803", "published_at": "2026-09-05T07:17:11.803", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.27.6 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options` whitelist (which only contains `url`, `button_link`, `button_url`), so it never receives `esc_url_raw()` at save time. On the server side, the value is rendered into a `data-image` HTML attribute using `esc_attr()`, which encodes double quotes as `"`. However, the client-side JavaScript carousel code in `custom.unified.js` reads this attribute using jQuery's `.data('image')`, which returns the browser-decoded value (with `"` decoded back to `\"`). The decoded value is then concatenated directly into an HTML string and injected into the DOM via `jQuery.after()` without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.divichangelog.com/divi-update/divi-4/version-4-27-7", "https://www.wordfence.com/threat-intel/vulnerabilities/id/d5de8f35-266f-45ce-8678-e52a33036b30?source=cve" ], "timeline": [ { "at": "2026-09-05T07:17:11.803", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3853" } ] }, { "id": "CVE-2026-3844", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-3844", "summary": "The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if \"Host Files Locally - Gravatars\" is enabled, which is disabled by default.", "updated_at": "2026-08-26T10:21:42Z", "published_at": "2026-08-26T10:21:42Z", "cvss": 9.8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 89, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-434", "what_happened": "The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if \"Host Files Locally - Gravatars\" is enabled, which is disabled by default.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "CVE-Intel · Alevtinka19/CVE-2026-3844", "author": "Alevtinka19", "first_seen": "2026-08-26", "last_seen": "2026-08-26T10:21:42Z", "pushed_at": "2026-08-26T10:19:29Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "PHP", "stars": 0, "forks": 0, "topics": [], "title": "CVE-2026-3844", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/Alevtinka19/CVE-2026-3844", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if \"Host Files Locally - Gravatars\" is enabled, which is disabled by default.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-434", "kev": false, "epss": 0.27701, "metadata_source": "NIST", "cve_published_at": "2026-04-23", "cve_status": "Deferred" }, { "repository": "CVE-Intel · AnggaTechI/CVE-2026-3844", "author": "AnggaTechI", "first_seen": "2026-08-08", "last_seen": "2026-08-14T19:56:11Z", "pushed_at": "2026-08-08T12:05:37Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 2, "forks": 0, "topics": [], "title": "CVE-2026-3844 — Unauthenticated Arbitrary File Upload to RCE in Breeze Cache (WordPress). CVSS 9.8 CRITICAL. Mass scanner + auto shell injector with multi-threading.", "repository_description": "CVE-2026-3844 — Unauthenticated Arbitrary File Upload to RCE in Breeze Cache (WordPress). CVSS 9.8 CRITICAL. Mass scanner + auto shell injector with multi-threading.", "summary": "CVE-2026-3844 — Unauthenticated Arbitrary File Upload to RCE in Breeze Cache (WordPress). CVSS 9.8 CRITICAL. Mass scanner + auto shell injector with multi-threading.", "source": "CVE-Intel", "url": "https://github.com/AnggaTechI/CVE-2026-3844", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if \"Host Files Locally - Gravatars\" is enabled, which is disabled by default.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-434", "kev": false, "epss": 0.27701, "metadata_source": "NIST", "cve_published_at": "2026-04-23", "cve_status": "Deferred" }, { "repository": "CVE-Intel · tausifzaman/CVE-2026-3844", "author": "tausifzaman", "first_seen": "2026-04-24", "last_seen": "2026-07-24T18:41:06Z", "pushed_at": "2026-04-24T10:28:28Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 3, "forks": 0, "topics": [ "automation", "cve", "cve-2026-3844", "exploit", "hacking-script", "hacking-tool", "poc" ], "title": "PoC exploit for CVE-2026-3844, a critical unauthenticated file upload vulnerability in the WordPress Breeze plugin leading to RCE.", "repository_description": "PoC exploit for CVE-2026-3844, a critical unauthenticated file upload vulnerability in the WordPress Breeze plugin leading to RCE.", "summary": "PoC exploit for CVE-2026-3844, a critical unauthenticated file upload vulnerability in the WordPress Breeze plugin leading to RCE.", "source": "CVE-Intel", "url": "https://github.com/tausifzaman/CVE-2026-3844", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if \"Host Files Locally - Gravatars\" is enabled, which is disabled by default.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-434", "kev": false, "epss": 0.27701, "metadata_source": "NIST", "cve_published_at": "2026-04-23", "cve_status": "Deferred" }, { "repository": "CVE-Intel · dinosn/CVE-2026-3844", "author": "dinosn", "first_seen": "2026-04-25", "last_seen": "2026-07-08T11:02:10Z", "pushed_at": "2026-04-25T17:53:39Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 5, "forks": 1, "topics": [], "title": "CVE-2026-3844: Breeze Cache <= 2.4.4 Unauthenticated Arbitrary File Upload to RCE (CVSS 9.8)", "repository_description": "CVE-2026-3844: Breeze Cache <= 2.4.4 Unauthenticated Arbitrary File Upload to RCE (CVSS 9.8)", "summary": "CVE-2026-3844: Breeze Cache <= 2.4.4 Unauthenticated Arbitrary File Upload to RCE (CVSS 9.8)", "source": "CVE-Intel", "url": "https://github.com/dinosn/CVE-2026-3844", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if \"Host Files Locally - Gravatars\" is enabled, which is disabled by default.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-434", "kev": false, "epss": 0.27701, "metadata_source": "NIST", "cve_published_at": "2026-04-23", "cve_status": "Deferred" }, { "repository": "CVE-Intel · Dhananjayasj/CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution", "author": "Dhananjayasj", "first_seen": "2026-06-06", "last_seen": "2026-06-06T08:38:54Z", "pushed_at": "2026-06-06T08:38:51Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 0, "forks": 0, "topics": [], "title": "CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/Dhananjayasj/CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if \"Host Files Locally - Gravatars\" is enabled, which is disabled by default.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-434", "kev": false, "epss": 0.27701, "metadata_source": "NIST", "cve_published_at": "2026-04-23", "cve_status": "Deferred" }, { "repository": "CVE-Intel · 0xgh057r3c0n/CVE-2026-3844", "author": "0xgh057r3c0n", "first_seen": "2026-04-24", "last_seen": "2026-05-27T14:43:58Z", "pushed_at": "2026-04-24T10:18:25Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 1, "forks": 1, "topics": [], "title": "WordPress - Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload", "repository_description": "WordPress - Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload", "summary": "WordPress - Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload", "source": "CVE-Intel", "url": "https://github.com/0xgh057r3c0n/CVE-2026-3844", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if \"Host Files Locally - Gravatars\" is enabled, which is disabled by default.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-434", "kev": false, "epss": 0.27701, "metadata_source": "NIST", "cve_published_at": "2026-04-23", "cve_status": "Deferred" }, { "repository": "CVE-Intel · rootdirective-sec/CVE-2026-3844-Lab", "author": "rootdirective-sec", "first_seen": "2026-05-08", "last_seen": "2026-05-15T08:53:24Z", "pushed_at": "2026-05-15T08:53:20Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "Exploit", "language": "Python", "stars": 0, "forks": 1, "topics": [], "title": "CVE-2026-3844-Lab", "repository_description": "", "summary": "", "source": "CVE-Intel", "url": "https://github.com/rootdirective-sec/CVE-2026-3844-Lab", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if \"Host Files Locally - Gravatars\" is enabled, which is disabled by default.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-434", "kev": false, "epss": 0.27701, "metadata_source": "NIST", "cve_published_at": "2026-04-23", "cve_status": "Deferred" }, { "repository": "CVE-Intel · halilkirazkaya/CVE-2026-3844", "author": "halilkirazkaya", "first_seen": "2026-04-30", "last_seen": "2026-05-09T16:19:27Z", "pushed_at": "2026-04-30T11:05:55Z", "confidence": "Medium", "verification": "correlated", "verified": false, "has_code": true, "artifact_type": "RCE", "language": "Python", "stars": 4, "forks": 0, "topics": [ "breeze", "cve-2026-3844", "exploit", "wordpress", "wordpress-plugin" ], "title": "CVE-2026-3844 — Breeze Cache Plugin RCE Exploit", "repository_description": "CVE-2026-3844 — Breeze Cache Plugin RCE Exploit", "summary": "CVE-2026-3844 — Breeze Cache Plugin RCE Exploit", "source": "CVE-Intel", "url": "https://github.com/halilkirazkaya/CVE-2026-3844", "cvss": 9.8, "severity": "CRITICAL", "cve_description": "The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if \"Host Files Locally - Gravatars\" is enabled, which is disabled by default.", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-434", "kev": false, "epss": 0.27701, "metadata_source": "NIST", "cve_published_at": "2026-04-23", "cve_status": "Deferred" } ], "references": [ "https://github.com/Alevtinka19/CVE-2026-3844", "https://github.com/AnggaTechI/CVE-2026-3844", "https://github.com/tausifzaman/CVE-2026-3844", "https://github.com/dinosn/CVE-2026-3844", "https://github.com/Dhananjayasj/CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution", "https://github.com/0xgh057r3c0n/CVE-2026-3844", "https://github.com/rootdirective-sec/CVE-2026-3844-Lab", "https://github.com/halilkirazkaya/CVE-2026-3844" ], "timeline": [ { "at": "2026-08-26T10:21:42Z", "label": "Discovered through CVE-Intel", "url": "https://github.com/Alevtinka19/CVE-2026-3844" } ], "epss": 0.27701, "severity": "CRITICAL", "metadata_source": "NIST", "cve_status": "Deferred", "cve_published_at": "2026-04-23", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2026-3576", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF", "summary": "Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF", "updated_at": "2026-08-10T22:00:00Z", "published_at": "2026-08-10T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52636", "author": "Balachandar Gowrisankar", "first_seen": "2026-08-11", "confidence": "High", "title": "Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF", "summary": "Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF", "url": "https://www.exploit-db.com/exploits/52636", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52636" ], "timeline": [ { "at": "2026-08-10T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52636" } ] }, { "id": "CVE-2026-1784", "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.13", "title": "Red Hat OpenShift Container Platform 4.13 vulnerability", "summary": "The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.", "updated_at": "2026-09-05T13:18:11.177", "published_at": "2026-06-02T09:16:15.683", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 21, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-15", "what_happened": "The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:23241", "https://access.redhat.com/errata/RHSA-2026:23246", "https://access.redhat.com/errata/RHSA-2026:25045", "https://access.redhat.com/errata/RHSA-2026:25182", "https://access.redhat.com/errata/RHSA-2026:25194", "https://access.redhat.com/errata/RHSA-2026:26543", "https://access.redhat.com/errata/RHSA-2026:28893", "https://access.redhat.com/errata/RHSA-2026:28964", "https://access.redhat.com/security/cve/CVE-2026-1784", "https://bugzilla.redhat.com/show_bug.cgi?id=2436075", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1784.json" ], "timeline": [ { "at": "2026-06-02T09:16:15.683", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1784" } ] }, { "id": "CVE-2026-0075", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-0075 — Android ContactsProvider information disclosure via JSON error side-channel, including PoC, root-cause analysis, and patch details.", "summary": "CVE-2026-0075 — Android ContactsProvider information disclosure via JSON error side-channel, including PoC, root-cause analysis, and patch details.", "updated_at": "2026-08-11T22:00:00Z", "published_at": "2026-08-11T22:00:00Z", "cvss": 0, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "PoC-in-GitHub · QM4RS/CVE-2026-0075", "author": "QM4RS", "first_seen": "2026-08-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 13, "title": "CVE-2026-0075 — Android ContactsProvider information disclosure via JSON error side-channel, including PoC, root-cause analysis, and patch details.", "summary": "CVE-2026-0075 — Android ContactsProvider information disclosure via JSON error side-channel, including PoC, root-cause analysis, and patch details.", "url": "https://github.com/QM4RS/CVE-2026-0075" } ], "references": [ "https://github.com/QM4RS/CVE-2026-0075" ], "timeline": [ { "at": "2026-08-11T22:00:00Z", "label": "Discovered through PoC-in-GitHub", "url": "https://github.com/QM4RS/CVE-2026-0075" } ] }, { "id": "CVE-2026-0001", "vendor": "Unknown vendor", "product": "Unknown product", "title": "threat = { \"id\": \"CVE-2026-0001\", \"title\": \"Apache HTTP Server Remote Code Execution\", \"vendor\": \"Apache\", \"product\": \"HTTP Server\", \"description\": \"A vulnerability in Apache HTTP Server allows remote attackers to execute arbitrary code.\", \"cvss\": 9.8, \"kev\": True, \"published\": \"2026-06-30\" }", "summary": "threat = { \"id\": \"CVE-2026-0001\", \"title\": \"Apache HTTP Server Remote Code Execution\", \"vendor\": \"Apache\", \"product\": \"HTTP Server\", \"description\": \"A vulnerability in Apache HTTP Server allows remote attackers to execute arbitrary code.\", \"cvss\": 9.8, \"kev\": True, \"published\": \"2026-06-30\" }", "updated_at": "2026-09-04T22:00:00Z", "published_at": "2026-09-04T22:00:00Z", "cvss": 0, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "PoC-in-GitHub · sohanbhowmik/cyberthreat_DBSproject", "author": "sohanbhowmik", "first_seen": "2026-09-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "threat = { \"id\": \"CVE-2026-0001\", \"title\": \"Apache HTTP Server Remote Code Execution\", \"vendor\": \"Apache\", \"product\": \"HTTP Server\", \"description\": \"A vulnerability in Apache HTTP Server allows remote attackers to execute arbitrary code.\", \"cvss\": 9.8, \"kev\": True, \"published\": \"2026-06-30\" }", "summary": "threat = { \"id\": \"CVE-2026-0001\", \"title\": \"Apache HTTP Server Remote Code Execution\", \"vendor\": \"Apache\", \"product\": \"HTTP Server\", \"description\": \"A vulnerability in Apache HTTP Server allows remote attackers to execute arbitrary code.\", \"cvss\": 9.8, \"kev\": True, \"published\": \"2026-06-30\" }", "url": "https://github.com/sohanbhowmik/cyberthreat_DBSproject" } ], "references": [ "https://github.com/sohanbhowmik/cyberthreat_DBSproject" ], "timeline": [ { "at": "2026-09-04T22:00:00Z", "label": "Discovered through PoC-in-GitHub", "url": "https://github.com/sohanbhowmik/cyberthreat_DBSproject" } ] }, { "id": "CVE-2025-70336", "vendor": "Unknown vendor", "product": "Unknown product", "title": "PodcastGenerator 3.2.9 - Stored XSS", "summary": "PodcastGenerator 3.2.9 - Stored XSS", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 16, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52677", "author": "Sahil Arya", "first_seen": "2026-09-02", "confidence": "High", "title": "PodcastGenerator 3.2.9 - Stored XSS", "summary": "PodcastGenerator 3.2.9 - Stored XSS", "url": "https://www.exploit-db.com/exploits/52677", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52677" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52677" } ] }, { "id": "CVE-2025-68686", "vendor": "Fortinet", "product": "FortiOS", "title": "Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability", "summary": "Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.", "updated_at": "2026-07-26T22:00:00Z", "published_at": "2026-07-26T22:00:00Z", "cvss": 0, "confidence": 65, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-07-26T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-07-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2025-68137", "vendor": "Unknown vendor", "product": "Unknown product", "title": "EVerest 2025.9.0 - DoS", "summary": "EVerest 2025.9.0 - DoS", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 16, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52679", "author": "Ranjit Kumar Singh", "first_seen": "2026-09-02", "confidence": "High", "title": "EVerest 2025.9.0 - DoS", "summary": "EVerest 2025.9.0 - DoS", "url": "https://www.exploit-db.com/exploits/52679", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52679" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52679" } ] }, { "id": "CVE-2025-65856", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2025-65856", "summary": "Tools repository vulnerability identified as CVE-2025-65856.", "updated_at": "2026-08-28T09:34:00Z", "published_at": "2026-08-28T09:34:00Z", "cvss": 9.8, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "Tools repository vulnerability identified as CVE-2025-65856.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2025-65856", "summary": "Tools repository vulnerability identified as CVE-2025-65856.", "what_happened": "Tools repository vulnerability identified as CVE-2025-65856.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-LUISMIRANDAACEBEDO-CVE-2025-65856", "https://kitploit.com/hi/tools/github/luismirandaacebedo/cve-2025-65856/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-08-28T11:34:00", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-LUISMIRANDAACEBEDO-CVE-2025-65856" }, { "title": "Exploit for CVE-2025-65856", "summary": "Tools repository vulnerability identified as CVE-2025-65856.", "what_happened": "Tools repository vulnerability identified as CVE-2025-65856.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-LUISMIRANDAACEBEDO-CVE-2025-65856", "https://kitploit.com/hi/tools/github/luismirandaacebedo/cve-2025-65856/" ], "repository": "kitploit.com", "author": "hi", "first_seen": "2026-08-28T11:34:00", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/hi/tools/github/luismirandaacebedo/cve-2025-65856/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-LUISMIRANDAACEBEDO-CVE-2025-65856", "https://kitploit.com/hi/tools/github/luismirandaacebedo/cve-2025-65856/" ], "timeline": [ { "at": "2026-08-28T09:34:00Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-LUISMIRANDAACEBEDO-CVE-2025-65856" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2025-62593", "vendor": "Ray-Project", "product": "Ray", "title": "Ray-Project Ray Code Injection Vulnerability", "summary": "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.", "updated_at": "2026-08-16T22:00:00Z", "published_at": "2026-08-16T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 6, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-16T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-17", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-17", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-17", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-17", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-17", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2025-60689", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Linksys E1200_2.0.04 - Unauthenticated OS Command Injection", "summary": "Linksys E1200_2.0.04 - Unauthenticated OS Command Injection", "updated_at": "2026-08-30T22:00:00Z", "published_at": "2026-08-30T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52660", "author": "jarrett", "first_seen": "2026-08-31", "confidence": "High", "title": "Linksys E1200_2.0.04 - Unauthenticated OS Command Injection", "summary": "Linksys E1200_2.0.04 - Unauthenticated OS Command Injection", "url": "https://www.exploit-db.com/exploits/52660", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52660" ], "timeline": [ { "at": "2026-08-30T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52660" } ] }, { "id": "CVE-2025-59713", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2025-59712_CVE-2025-59713 exploit", "summary": "Exploit for CVE-2025-59712 and CVE-2025-59713. CVSS 8.1.", "updated_at": "2026-09-05T08:13:00Z", "published_at": "2026-09-05T08:13:00Z", "cvss": 8.1, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 32, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "XSS and unsafe deserialization in Snipe-IT enable JavaScript injection and remote code execution.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2025-59712_CVE-2025-59713 CVE-2025-59712 CVE-2025-59713", "summary": "XSS and unsafe deserialization in Snipe-IT enable JavaScript injection and remote code execution.", "what_happened": "XSS and unsafe deserialization in Snipe-IT enable JavaScript injection and remote code execution.", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SYNACKTIV-CVE-2025-59712_CVE-2025-59713", "https://kitploit.com/ru/tools/github/synacktiv/cve-2025-59712_cve-2025-59713/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-03T19:50:40", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SYNACKTIV-CVE-2025-59712_CVE-2025-59713" }, { "repository": "synacktiv/CVE-2025-59712_CVE-2025-59713", "author": "synacktiv", "first_seen": "2025-10-02", "confidence": "High", "verification": "verified", "verified": true, "stars": 2, "title": "Snipe-IT PoC exploit for CVE-2025-59712 and CVE-2025-59713", "summary": "Snipe-IT PoC exploit for CVE-2025-59712 and CVE-2025-59713", "url": "https://github.com/synacktiv/CVE-2025-59712_CVE-2025-59713" }, { "title": "Exploit for CVE-2025-59712_CVE-2025-59713 CVE-2025-59712 CVE-2025-59713", "summary": "XSS and unsafe deserialization in Snipe-IT enable JavaScript injection and remote code execution.", "what_happened": "XSS and unsafe deserialization in Snipe-IT enable JavaScript injection and remote code execution.", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SYNACKTIV-CVE-2025-59712_CVE-2025-59713", "https://kitploit.com/ru/tools/github/synacktiv/cve-2025-59712_cve-2025-59713/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-03T19:50:40", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/synacktiv/cve-2025-59712_cve-2025-59713/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SYNACKTIV-CVE-2025-59712_CVE-2025-59713", "https://github.com/synacktiv/CVE-2025-59712_CVE-2025-59713", "https://kitploit.com/ru/tools/github/synacktiv/cve-2025-59712_cve-2025-59713/" ], "timeline": [ { "at": "2026-09-05T08:13:00Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SYNACKTIV-CVE-2025-59712_CVE-2025-59713" } ] }, { "id": "CVE-2025-59712", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2025-59712_CVE-2025-59713 exploit", "summary": "Exploit for CVE-2025-59712 and CVE-2025-59713. CVSS 8.1.", "updated_at": "2026-09-05T08:13:00Z", "published_at": "2026-09-05T08:13:00Z", "cvss": 8.1, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 32, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "XSS and unsafe deserialization in Snipe-IT enable JavaScript injection and remote code execution.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2025-59712_CVE-2025-59713 CVE-2025-59712 CVE-2025-59713", "summary": "XSS and unsafe deserialization in Snipe-IT enable JavaScript injection and remote code execution.", "what_happened": "XSS and unsafe deserialization in Snipe-IT enable JavaScript injection and remote code execution.", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SYNACKTIV-CVE-2025-59712_CVE-2025-59713", "https://kitploit.com/ru/tools/github/synacktiv/cve-2025-59712_cve-2025-59713/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-03T19:50:40", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SYNACKTIV-CVE-2025-59712_CVE-2025-59713" }, { "repository": "synacktiv/CVE-2025-59712_CVE-2025-59713", "author": "synacktiv", "first_seen": "2025-10-02", "confidence": "High", "verification": "verified", "verified": true, "stars": 2, "title": "Snipe-IT PoC exploit for CVE-2025-59712 and CVE-2025-59713", "summary": "Snipe-IT PoC exploit for CVE-2025-59712 and CVE-2025-59713", "url": "https://github.com/synacktiv/CVE-2025-59712_CVE-2025-59713" }, { "title": "Exploit for CVE-2025-59712_CVE-2025-59713 CVE-2025-59712 CVE-2025-59713", "summary": "XSS and unsafe deserialization in Snipe-IT enable JavaScript injection and remote code execution.", "what_happened": "XSS and unsafe deserialization in Snipe-IT enable JavaScript injection and remote code execution.", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SYNACKTIV-CVE-2025-59712_CVE-2025-59713", "https://kitploit.com/ru/tools/github/synacktiv/cve-2025-59712_cve-2025-59713/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-03T19:50:40", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/synacktiv/cve-2025-59712_cve-2025-59713/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SYNACKTIV-CVE-2025-59712_CVE-2025-59713", "https://github.com/synacktiv/CVE-2025-59712_CVE-2025-59713", "https://kitploit.com/ru/tools/github/synacktiv/cve-2025-59712_cve-2025-59713/" ], "timeline": [ { "at": "2026-09-05T08:13:00Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SYNACKTIV-CVE-2025-59712_CVE-2025-59713" } ] }, { "id": "CVE-2025-57819", "vendor": "Sangoma", "product": "FreePBX", "title": "Sangoma FreePBX Authentication Bypass Vulnerability", "summary": "Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.", "updated_at": "2026-09-02T22:00:00Z", "published_at": "2026-09-02T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 24, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52681", "author": "Jared Brits", "first_seen": "2026-09-03", "confidence": "High", "title": "FreePBX 17.0.2 - Remote Code Execution (RCE)", "summary": "FreePBX 17.0.2 - Remote Code Execution (RCE)", "url": "https://www.exploit-db.com/exploits/52681", "verification": "verified", "verified": true } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/52681" ], "timeline": [ { "at": "2026-09-02T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-08-29", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-08-29", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-08-29", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-08-29", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-08-29", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-08-29", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-08-29", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-08-29", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2025-55182", "vendor": "Meta", "product": "React Server Components", "title": "Meta React Server Components Remote Code Execution Vulnerability", "summary": "Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.", "updated_at": "2026-09-01T22:00:00Z", "published_at": "2026-09-01T22:00:00Z", "cvss": 0, "confidence": 90, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 457, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52506", "author": "danieljavanrad", "first_seen": "2026-04-09", "confidence": "High", "title": "React Server 19.2.0 - Remote Code Execution", "summary": "React Server 19.2.0 - Remote Code Execution", "url": "https://www.exploit-db.com/exploits/52506", "verification": "verified", "verified": true }, { "repository": "PoC-in-GitHub · mayank729/CVE-2025-55182-scanner", "author": "mayank729", "first_seen": "2022-06-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "🔍 Scan for CVE-2025-55182 risks in React Server Components with this non-intrusive tool that helps detect critical vulnerabilities in your applications.", "summary": "🔍 Scan for CVE-2025-55182 risks in React Server Components with this non-intrusive tool that helps detect critical vulnerabilities in your applications.", "url": "https://github.com/mayank729/CVE-2025-55182-scanner" }, { "repository": "PoC-in-GitHub · pitufo1721/CVE-2025-55182-GodzillaMemoryShell", "author": "pitufo1721", "first_seen": "2023-07-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/pitufo1721/CVE-2025-55182-GodzillaMemoryShell" }, { "repository": "PoC-in-GitHub · alyaapm/CVE-2025-55182-shellinteractive", "author": "alyaapm", "first_seen": "2024-11-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/alyaapm/CVE-2025-55182-shellinteractive" }, { "repository": "PoC-in-GitHub · Mayca369/CVE-2025-55182", "author": "Mayca369", "first_seen": "2025-06-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "🚨 Exploit CVE-2025-55182 to demonstrate RCE in React Server Functions, highlighting risks from insecure prototype references in Next.js applications.", "summary": "🚨 Exploit CVE-2025-55182 to demonstrate RCE in React Server Functions, highlighting risks from insecure prototype references in Next.js applications.", "url": "https://github.com/Mayca369/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · BankkRoll/Quickcheck-CVE-2025-55182-React-and-CVE-2025-66478-Next.js", "author": "BankkRoll", "first_seen": "2025-12-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 12, "title": "Script to quick check CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) - Critical unauthenticated RCE vulnerabilities in the React Server Components (RSC) “Flight” protocol.", "summary": "Script to quick check CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) - Critical unauthenticated RCE vulnerabilities in the React Server Components (RSC) “Flight” protocol.", "url": "https://github.com/BankkRoll/Quickcheck-CVE-2025-55182-React-and-CVE-2025-66478-Next.js" }, { "repository": "PoC-in-GitHub · ejpir/CVE-2025-55182-research", "author": "ejpir", "first_seen": "2025-12-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 793, "title": "CVE-2025-55182 POC", "summary": "CVE-2025-55182 POC", "url": "https://github.com/ejpir/CVE-2025-55182-research" }, { "repository": "PoC-in-GitHub · sickwell/CVE-2025-55182", "author": "sickwell", "first_seen": "2025-12-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 14, "title": "CVE-2025-55182 - React Server Components RCE Exploit & Scanner Supports external servers and CLI interface", "summary": "CVE-2025-55182 - React Server Components RCE Exploit & Scanner Supports external servers and CLI interface", "url": "https://github.com/sickwell/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · fatguru/CVE-2025-55182-scanner", "author": "fatguru", "first_seen": "2025-12-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 111, "title": "A non-intrusive surface scanner for CVE-2025-55182 (React Server Components RCE). Detects exposed RSC endpoints in React 19 and Next.js applications", "summary": "A non-intrusive surface scanner for CVE-2025-55182 (React Server Components RCE). Detects exposed RSC endpoints in React 19 and Next.js applications", "url": "https://github.com/fatguru/CVE-2025-55182-scanner" }, { "repository": "PoC-in-GitHub · atastycookie/CVE-2025-55182", "author": "atastycookie", "first_seen": "2025-12-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 - React Server Components RCE Exploit & Scanner Supports external servers and CLI interface", "summary": "CVE-2025-55182 - React Server Components RCE Exploit & Scanner Supports external servers and CLI interface", "url": "https://github.com/atastycookie/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · santihabib/CVE-2025-55182-analysis", "author": "santihabib", "first_seen": "2025-12-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/santihabib/CVE-2025-55182-analysis" }, { "repository": "PoC-in-GitHub · xkillbit/cve-2025-55182-scanner", "author": "xkillbit", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/xkillbit/cve-2025-55182-scanner" }, { "repository": "PoC-in-GitHub · whiteov3rflow/CVE-2025-55182-poc", "author": "whiteov3rflow", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 94, "title": "React2Shell Proof of Concept", "summary": "React2Shell Proof of Concept", "url": "https://github.com/whiteov3rflow/CVE-2025-55182-poc" }, { "repository": "PoC-in-GitHub · shen771/Blackash-CVE-2025-55182", "author": "shen771", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182", "summary": "CVE-2025-55182", "url": "https://github.com/shen771/Blackash-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Pa2sw0rd/exploit-CVE-2025-55182-poc", "author": "Pa2sw0rd", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "This POC demonstrates CVE-2025-55182 using actual `react-server-dom-webpack@19.0.0` vulnerable code.", "summary": "This POC demonstrates CVE-2025-55182 using actual `react-server-dom-webpack@19.0.0` vulnerable code.", "url": "https://github.com/Pa2sw0rd/exploit-CVE-2025-55182-poc" }, { "repository": "PoC-in-GitHub · heiheishushu/rsc_detect_CVE-2025-55182", "author": "heiheishushu", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "For CVE-2025-55182 and CVE-2025-66478 Security Response", "summary": "For CVE-2025-55182 and CVE-2025-66478 Security Response", "url": "https://github.com/heiheishushu/rsc_detect_CVE-2025-55182" }, { "repository": "PoC-in-GitHub · songsanggggg/CVE-2025-55182", "author": "songsanggggg", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 漏洞利用GUI,PoC / Exploit for CVE-2025-55182 & CVE-2025-66478", "summary": "CVE-2025-55182 漏洞利用GUI,PoC / Exploit for CVE-2025-55182 & CVE-2025-66478", "url": "https://github.com/songsanggggg/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · M0onPu15e/next.js-scanner", "author": "M0onPu15e", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "检测针对 CVE-2025-55182（React 服务器组件远程代码执行漏洞）的扫描器", "summary": "检测针对 CVE-2025-55182（React 服务器组件远程代码执行漏洞）的扫描器", "url": "https://github.com/M0onPu15e/next.js-scanner" }, { "repository": "PoC-in-GitHub · ducducuc111/CVE-2025-55182-poc", "author": "ducducuc111", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/ducducuc111/CVE-2025-55182-poc" }, { "repository": "PoC-in-GitHub · ThemeHackers/CVE-2025-55182", "author": "ThemeHackers", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 22, "title": "a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC). It also includes a realistic \"Lab Environment\" to safely test and understand the vulnerability.", "summary": "a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC). It also includes a realistic \"Lab Environment\" to safely test and understand the vulnerability.", "url": "https://github.com/ThemeHackers/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · joshterrill/CVE-2025-55182-realistic-poc", "author": "joshterrill", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "a realistic POC demonstrating the missing `hasOwnProperty` check in react-server-dom-webpack@19.0.0", "summary": "a realistic POC demonstrating the missing `hasOwnProperty` check in react-server-dom-webpack@19.0.0", "url": "https://github.com/joshterrill/CVE-2025-55182-realistic-poc" }, { "repository": "PoC-in-GitHub · mingyisecurity-lab/CVE-2025-55182-TOOLS", "author": "mingyisecurity-lab", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "A Comprehensive CVE-2025-55182 Detection and Security Assessment Tool", "summary": "A Comprehensive CVE-2025-55182 Detection and Security Assessment Tool", "url": "https://github.com/mingyisecurity-lab/CVE-2025-55182-TOOLS" }, { "repository": "PoC-in-GitHub · gensecaihq/react2shell-scanner", "author": "gensecaihq", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 58, "title": "Security scanner for CVE-2025-55182 - Critical RCE vulnerability in React Server Components. Scan npm/pnpm/yarn lockfiles, Docker images, SBOMs, and live URLs. Auto-fix, SARIF output, GitHub Actions, Vercel integration, and runtime protection middleware.", "summary": "Security scanner for CVE-2025-55182 - Critical RCE vulnerability in React Server Components. Scan npm/pnpm/yarn lockfiles, Docker images, SBOMs, and live URLs. Auto-fix, SARIF output, GitHub Actions, Vercel integration, and runtime protection middleware.", "url": "https://github.com/gensecaihq/react2shell-scanner" }, { "repository": "PoC-in-GitHub · sudo-Yangziran/CVE-2025-55182POC", "author": "sudo-Yangziran", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/sudo-Yangziran/CVE-2025-55182POC" }, { "repository": "PoC-in-GitHub · Rsatan/Next.js-Exploit-Tool", "author": "Rsatan", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 119, "title": "Next.js-Exploit-Tool 图形化综合利用工具，基于 Go 开发，一款针对 CVE-2025-55182 的独立安全评估工具。", "summary": "Next.js-Exploit-Tool 图形化综合利用工具，基于 Go 开发，一款针对 CVE-2025-55182 的独立安全评估工具。", "url": "https://github.com/Rsatan/Next.js-Exploit-Tool" }, { "repository": "PoC-in-GitHub · assetnote/react2shell-scanner", "author": "assetnote", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2457, "title": "High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478)", "summary": "High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478)", "url": "https://github.com/assetnote/react2shell-scanner" }, { "repository": "PoC-in-GitHub · jf0x3a/CVE-2025-55182-exploit", "author": "jf0x3a", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "RCE Auto exploit for CVE-2025-55182", "summary": "RCE Auto exploit for CVE-2025-55182", "url": "https://github.com/jf0x3a/CVE-2025-55182-exploit" }, { "repository": "PoC-in-GitHub · harness-security-labs/CVE-2025-55182-checker", "author": "harness-security-labs", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "React/Next.js React4Shell RCE CVE-2025-55182 checker", "summary": "React/Next.js React4Shell RCE CVE-2025-55182 checker", "url": "https://github.com/harness-security-labs/CVE-2025-55182-checker" }, { "repository": "PoC-in-GitHub · dissy123/cve-2025-55182", "author": "dissy123", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/dissy123/cve-2025-55182" }, { "repository": "PoC-in-GitHub · dwisiswant0/CVE-2025-55182", "author": "dwisiswant0", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 59, "title": "Pre-auth RCE in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0.", "summary": "Pre-auth RCE in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0.", "url": "https://github.com/dwisiswant0/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Chelsea486MHz/CVE-2025-55182-test", "author": "Chelsea486MHz", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "See if your endpoint could be vulnerable.", "summary": "See if your endpoint could be vulnerable.", "url": "https://github.com/Chelsea486MHz/CVE-2025-55182-test" }, { "repository": "PoC-in-GitHub · oways/React2shell-CVE-2025-55182-checker", "author": "oways", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/oways/React2shell-CVE-2025-55182-checker" }, { "repository": "PoC-in-GitHub · msanft/CVE-2025-55182", "author": "msanft", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1431, "title": "Explanation and full RCE PoC for CVE-2025-55182", "summary": "Explanation and full RCE PoC for CVE-2025-55182", "url": "https://github.com/msanft/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · ivaavimusic/React19-fix-vibecoders", "author": "ivaavimusic", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 Fix for Vibe Coders", "summary": "CVE-2025-55182 Fix for Vibe Coders", "url": "https://github.com/ivaavimusic/React19-fix-vibecoders" }, { "repository": "PoC-in-GitHub · carlosaruy/CVE-2025-55182", "author": "carlosaruy", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC). It also includes a realistic \"Lab Environment\" to safely test and understand the vulnerability.", "summary": "a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC). It also includes a realistic \"Lab Environment\" to safely test and understand the vulnerability.", "url": "https://github.com/carlosaruy/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Security-Phoenix-demo/react2shell-scanner-rce-react-next-CVE-2025-55182-CVE-2025-66478", "author": "Security-Phoenix-demo", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "Scanner for CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) - Track and remediate a critical React Server Components (RSC) / Flight protocol vulnerability campaign impacting react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack, and RSC-enabled frameworks like Next.js.", "summary": "Scanner for CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) - Track and remediate a critical React Server Components (RSC) / Flight protocol vulnerability campaign impacting react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack, and RSC-enabled frameworks like Next.js.", "url": "https://github.com/Security-Phoenix-demo/react2shell-scanner-rce-react-next-CVE-2025-55182-CVE-2025-66478" }, { "repository": "PoC-in-GitHub · c0rydoras/CVE-2025-55182", "author": "c0rydoras", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "some notes && (somewhat?) poc-adjacent stuff for CVE-2025-55182", "summary": "some notes && (somewhat?) poc-adjacent stuff for CVE-2025-55182", "url": "https://github.com/c0rydoras/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · CymulateResearch/React2Shell-Scanner", "author": "CymulateResearch", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "React2Shell Scanner (CVE-2025-55182 & CVE-2025-66478)", "summary": "React2Shell Scanner (CVE-2025-55182 & CVE-2025-66478)", "url": "https://github.com/CymulateResearch/React2Shell-Scanner" }, { "repository": "PoC-in-GitHub · 0xPThree/cve-2025-55182", "author": "0xPThree", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/0xPThree/cve-2025-55182" }, { "repository": "PoC-in-GitHub · acheong08/CVE-2025-55182-poc", "author": "acheong08", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 11, "title": "Actual CVE-2025-55182 detection and exploit. No bullshit LLMs.", "summary": "Actual CVE-2025-55182 detection and exploit. No bullshit LLMs.", "url": "https://github.com/acheong08/CVE-2025-55182-poc" }, { "repository": "PoC-in-GitHub · jctommasi/react2shellVulnApp", "author": "jctommasi", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "Deliberately vulnerable banking app for CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) to learn, detect, and safely exercise React2Shell. Runs unpatched React 19.0.0 and Next.js 15.0.3.", "summary": "Deliberately vulnerable banking app for CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) to learn, detect, and safely exercise React2Shell. Runs unpatched React 19.0.0 and Next.js 15.0.3.", "url": "https://github.com/jctommasi/react2shellVulnApp" }, { "repository": "PoC-in-GitHub · shamo0/react2shell-PoC", "author": "shamo0", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 10, "title": "Nuclei template for detecting react2shell (CVE-2025-55182 & CVE-2025-66478)", "summary": "Nuclei template for detecting react2shell (CVE-2025-55182 & CVE-2025-66478)", "url": "https://github.com/shamo0/react2shell-PoC" }, { "repository": "PoC-in-GitHub · EynaExp/CVE-2025-55182-POC", "author": "EynaExp", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "Poc for CVE-2025-55182 (remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages)", "summary": "Poc for CVE-2025-55182 (remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages)", "url": "https://github.com/EynaExp/CVE-2025-55182-POC" }, { "repository": "PoC-in-GitHub · im-hanzou/CVE-2025-55182-POC-SCANNER", "author": "im-hanzou", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Unified Security Research Tool", "summary": "Unified Security Research Tool", "url": "https://github.com/im-hanzou/CVE-2025-55182-POC-SCANNER" }, { "repository": "PoC-in-GitHub · klassiker/CVE-2025-55182", "author": "klassiker", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/klassiker/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Emiyelbarto/CVE-2025-55182-PoC", "author": "Emiyelbarto", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Poc for CVE-2025-55182", "summary": "Poc for CVE-2025-55182", "url": "https://github.com/Emiyelbarto/CVE-2025-55182-PoC" }, { "repository": "PoC-in-GitHub · MrR0b0t19/CVE-2025-55182-shellinteractive", "author": "MrR0b0t19", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 21, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/MrR0b0t19/CVE-2025-55182-shellinteractive" }, { "repository": "PoC-in-GitHub · ps-interactive/cve-2025-55182", "author": "ps-interactive", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Vulnerable REACT app in docker container and poc code - for demos", "summary": "Vulnerable REACT app in docker container and poc code - for demos", "url": "https://github.com/ps-interactive/cve-2025-55182" }, { "repository": "PoC-in-GitHub · tobiasGuta/Next.js-RSC-RCE-Scanner-Burp-Suite-Extension", "author": "tobiasGuta", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 24, "title": "Burp Suite extension to detect the Next.js / React Server Components (RSC) Remote Code Execution vulnerability (CVE-2025-55182 & CVE-2025-66478).", "summary": "Burp Suite extension to detect the Next.js / React Server Components (RSC) Remote Code Execution vulnerability (CVE-2025-55182 & CVE-2025-66478).", "url": "https://github.com/tobiasGuta/Next.js-RSC-RCE-Scanner-Burp-Suite-Extension" }, { "repository": "PoC-in-GitHub · aquinn-r7/CVE-2025-55182-VulnCheckPOC", "author": "aquinn-r7", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Functional Python POC to test if servers are vulnerable to CVE-2025-55182", "summary": "Functional Python POC to test if servers are vulnerable to CVE-2025-55182", "url": "https://github.com/aquinn-r7/CVE-2025-55182-VulnCheckPOC" }, { "repository": "PoC-in-GitHub · MedusaSH/POC-CVE-2025-55182", "author": "MedusaSH", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "PoC CVE-2025-55182", "summary": "PoC CVE-2025-55182", "url": "https://github.com/MedusaSH/POC-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · nxgn-kd01/react2shell-scanner", "author": "nxgn-kd01", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "Detect CVE-2025-55182 (React2Shell) RCE vulnerability in React Server Components. Fast, accurate scanner with zero false positives.", "summary": "Detect CVE-2025-55182 (React2Shell) RCE vulnerability in React Server Components. Fast, accurate scanner with zero false positives.", "url": "https://github.com/nxgn-kd01/react2shell-scanner" }, { "repository": "PoC-in-GitHub · clevernyyyy/CVE-2025-55182-Dockerized", "author": "clevernyyyy", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/clevernyyyy/CVE-2025-55182-Dockerized" }, { "repository": "PoC-in-GitHub · Cillian-Collins/CVE-2025-55182", "author": "Cillian-Collins", "first_seen": "2025-12-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "A proof of concept exploit script for CVE-2025-55182", "summary": "A proof of concept exploit script for CVE-2025-55182", "url": "https://github.com/Cillian-Collins/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · ZihxS/check-react-rce-cve-2025-55182", "author": "ZihxS", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "Security scanner to detect CVE-2025-55182 & CVE-2025-66478 vulnerabilities in React Server Components (RSC) projects", "summary": "Security scanner to detect CVE-2025-55182 & CVE-2025-66478 vulnerabilities in React Server Components (RSC) projects", "url": "https://github.com/ZihxS/check-react-rce-cve-2025-55182" }, { "repository": "PoC-in-GitHub · ZemarKhos/CVE-2025-55182-Exploit-PoC-Scanner", "author": "ZemarKhos", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/ZemarKhos/CVE-2025-55182-Exploit-PoC-Scanner" }, { "repository": "PoC-in-GitHub · sherlocksecurity/CVE-2025-55182-Exploit-scanner", "author": "sherlocksecurity", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/sherlocksecurity/CVE-2025-55182-Exploit-scanner" }, { "repository": "PoC-in-GitHub · huangzccn/CVE-2025-55182", "author": "huangzccn", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182", "summary": "CVE-2025-55182", "url": "https://github.com/huangzccn/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Darker-Ink/react-ssr-vulnerability", "author": "Darker-Ink", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This is a POC script for CVE-2025-55182 (React SSR RCE)", "summary": "This is a POC script for CVE-2025-55182 (React SSR RCE)", "url": "https://github.com/Darker-Ink/react-ssr-vulnerability" }, { "repository": "PoC-in-GitHub · emadshanab/POC-for-CVE-2025-55182", "author": "emadshanab", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "POC for CVE-2025-55182", "summary": "POC for CVE-2025-55182", "url": "https://github.com/emadshanab/POC-for-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · topstar88/CVE-2025-55182", "author": "topstar88", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/topstar88/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · selectarget/CVE-2025-55182-Exploit", "author": "selectarget", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/selectarget/CVE-2025-55182-Exploit" }, { "repository": "PoC-in-GitHub · pyroxenites/Nextjs_RCE_Exploit_Tool", "author": "pyroxenites", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 142, "title": "Exploit for CVE-2025-55182 & CVE-2025-66478", "summary": "Exploit for CVE-2025-55182 & CVE-2025-66478", "url": "https://github.com/pyroxenites/Nextjs_RCE_Exploit_Tool" }, { "repository": "PoC-in-GitHub · Chocapikk/CVE-2025-55182", "author": "Chocapikk", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 68, "title": "Next.js React Server Components RCE exploit for CVE-2025-55182", "summary": "Next.js React Server Components RCE exploit for CVE-2025-55182", "url": "https://github.com/Chocapikk/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · mrknow001/RSC_Detector", "author": "mrknow001", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 592, "title": "Supports RSC fingerprinting and exploitation of the React component vulnerability CVE-2025-55182.", "summary": "Supports RSC fingerprinting and exploitation of the React component vulnerability CVE-2025-55182.", "url": "https://github.com/mrknow001/RSC_Detector" }, { "repository": "PoC-in-GitHub · Spritualkb/CVE-2025-55182-exp", "author": "Spritualkb", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 47, "title": "CVE-2025-55182 React Server Components Remote Code Execution Exploit Tool", "summary": "CVE-2025-55182 React Server Components Remote Code Execution Exploit Tool", "url": "https://github.com/Spritualkb/CVE-2025-55182-exp" }, { "repository": "PoC-in-GitHub · younesZdDz/CVE-2025-55182", "author": "younesZdDz", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/younesZdDz/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · lachlan2k/React2Shell-CVE-2025-55182-original-poc", "author": "lachlan2k", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1058, "title": "Original Proof-of-Concepts for React2Shell CVE-2025-55182", "summary": "Original Proof-of-Concepts for React2Shell CVE-2025-55182", "url": "https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc" }, { "repository": "PoC-in-GitHub · hualy13/CVE-2025-55182", "author": "hualy13", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/hualy13/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · RuoJi6/CVE-2025-55182-RCE-shell", "author": "RuoJi6", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 31, "title": "Burp Suite/antsword - Interactive shell (HTTP hijack + POST + AES-256-CBC/BASE64)", "summary": "Burp Suite/antsword - Interactive shell (HTTP hijack + POST + AES-256-CBC/BASE64)", "url": "https://github.com/RuoJi6/CVE-2025-55182-RCE-shell" }, { "repository": "PoC-in-GitHub · Saturate/CVE-2025-55182-react2shell", "author": "Saturate", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A bash scanner for detecting CVE-2025-55182 vulnerability in Next.js applications. And a PoC nodejs script", "summary": "A bash scanner for detecting CVE-2025-55182 vulnerability in Next.js applications. And a PoC nodejs script", "url": "https://github.com/Saturate/CVE-2025-55182-react2shell" }, { "repository": "PoC-in-GitHub · hoosin/CVE-2025-55182", "author": "hoosin", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/hoosin/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Pizz33/CVE-2025-55182-burpscanner", "author": "Pizz33", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 10, "title": "基于 CVE-2025-55182 漏洞检测 burpsuite 被动扫描插件", "summary": "基于 CVE-2025-55182 漏洞检测 burpsuite 被动扫描插件", "url": "https://github.com/Pizz33/CVE-2025-55182-burpscanner" }, { "repository": "PoC-in-GitHub · Y3B3L4Y3/CVE-2025-55182-test", "author": "Y3B3L4Y3", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/Y3B3L4Y3/CVE-2025-55182-test" }, { "repository": "PoC-in-GitHub · ngvcanh/CVE-2025-55182-Attack-Analysis", "author": "ngvcanh", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Real-world attack analysis of CVE-2025-55182 (React2Shell) - React Server Components RCE vulnerability", "summary": "Real-world attack analysis of CVE-2025-55182 (React2Shell) - React Server Components RCE vulnerability", "url": "https://github.com/ngvcanh/CVE-2025-55182-Attack-Analysis" }, { "repository": "PoC-in-GitHub · aliclub0x00/CVE-2025-55182-POC-NEXTJS", "author": "aliclub0x00", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 27, "title": "Working proof of concept for NextJS RCE to establish a reverse shell. [React2Shell]", "summary": "Working proof of concept for NextJS RCE to establish a reverse shell. [React2Shell]", "url": "https://github.com/aliclub0x00/CVE-2025-55182-POC-NEXTJS" }, { "repository": "PoC-in-GitHub · logesh-GIT001/CVE-2025-55182", "author": "logesh-GIT001", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "\"One crafted HTTP request can compromise your entire server.\" — React Security Team, Dec 2025", "summary": "\"One crafted HTTP request can compromise your entire server.\" — React Security Team, Dec 2025", "url": "https://github.com/logesh-GIT001/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · freeqaz/react2shell", "author": "freeqaz", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 68, "title": "An analysis of CVE-2025-55182 and CVE-2025-66478 -- the vulnerabilities behind React2Shell. Tools, technical information, etc", "summary": "An analysis of CVE-2025-55182 and CVE-2025-66478 -- the vulnerabilities behind React2Shell. Tools, technical information, etc", "url": "https://github.com/freeqaz/react2shell" }, { "repository": "PoC-in-GitHub · ABCFabian/React2Shell-CVE-2025-55182-Testing-Environment", "author": "ABCFabian", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A containerized testing environment for CVE-2025-55182, a critical (10.0 CVSS) Remote Code Execution vulnerability in React Server Components.", "summary": "A containerized testing environment for CVE-2025-55182, a critical (10.0 CVSS) Remote Code Execution vulnerability in React Server Components.", "url": "https://github.com/ABCFabian/React2Shell-CVE-2025-55182-Testing-Environment" }, { "repository": "PoC-in-GitHub · l4rm4nd/CVE-2025-55182", "author": "l4rm4nd", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 86, "title": "Docker poc lab for CVE-2025-55182 / CVE-2025-66478 (React2Shell) detection and exploitation", "summary": "Docker poc lab for CVE-2025-55182 / CVE-2025-66478 (React2Shell) detection and exploitation", "url": "https://github.com/l4rm4nd/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Airis101/CVE-2025-55182-analysis", "author": "Airis101", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "浅谈React Server Components RCE 漏洞分析", "summary": "浅谈React Server Components RCE 漏洞分析", "url": "https://github.com/Airis101/CVE-2025-55182-analysis" }, { "repository": "PoC-in-GitHub · GelukCrab/React-Server-Components-RCE", "author": "GelukCrab", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 10, "title": "React Server Components 远程代码执行漏洞(CVE-2025-55182)", "summary": "React Server Components 远程代码执行漏洞(CVE-2025-55182)", "url": "https://github.com/GelukCrab/React-Server-Components-RCE" }, { "repository": "PoC-in-GitHub · Golden-Secure/CVE-2025-55182", "author": "Golden-Secure", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Interactive RCE Web Shell (CVE-2025-55182) BY Golden-Security", "summary": "Interactive RCE Web Shell (CVE-2025-55182) BY Golden-Security", "url": "https://github.com/Golden-Secure/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · grp-ops/react2shell", "author": "grp-ops", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "Lightweight scanner and Nuclei templates for identifying React and Next.js deserialization RCEs (CVE-2025-55182 / CVE-2025-66478).", "summary": "Lightweight scanner and Nuclei templates for identifying React and Next.js deserialization RCEs (CVE-2025-55182 / CVE-2025-66478).", "url": "https://github.com/grp-ops/react2shell" }, { "repository": "PoC-in-GitHub · alexandre-briongos-wavestone/react-cve-2025-55182-lab", "author": "alexandre-briongos-wavestone", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/alexandre-briongos-wavestone/react-cve-2025-55182-lab" }, { "repository": "PoC-in-GitHub · Rat5ak/CVE-2025-55182-React2Shell-RCE-POC", "author": "Rat5ak", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "This repository documents research into deserialization behavior within Next.js React Server Components (RSC) using the Flight protocol. It focuses on how malformed multipart bodies combined with Server Action request handling can lead to prototype traversal and execution primitives on certain builds.", "summary": "This repository documents research into deserialization behavior within Next.js React Server Components (RSC) using the Flight protocol. It focuses on how malformed multipart bodies combined with Server Action request handling can lead to prototype traversal and execution primitives on certain builds.", "url": "https://github.com/Rat5ak/CVE-2025-55182-React2Shell-RCE-POC" }, { "repository": "PoC-in-GitHub · imbas007/POC-CVE-2025-55182", "author": "imbas007", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/imbas007/POC-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · RajChowdhury240/React2Shell-CVE-2025-55182", "author": "RajChowdhury240", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "React2Shell | CVE-2025-55182 - React Server Components RCE", "summary": "React2Shell | CVE-2025-55182 - React Server Components RCE", "url": "https://github.com/RajChowdhury240/React2Shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · nehkark/CVE-2025-55182", "author": "nehkark", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "PoC: CVE-2025-55182 (React) and CVE-2025-66478 (Next.js)", "summary": "PoC: CVE-2025-55182 (React) and CVE-2025-66478 (Next.js)", "url": "https://github.com/nehkark/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · prestonhashworth/cve-2025-55182", "author": "prestonhashworth", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/prestonhashworth/cve-2025-55182" }, { "repository": "PoC-in-GitHub · nomorebreach/POC-CVE-2025-55182", "author": "nomorebreach", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "POC for CVE-2025-55182 React2Shell", "summary": "POC for CVE-2025-55182 React2Shell", "url": "https://github.com/nomorebreach/POC-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · nerium-security/CVE-2025-55182", "author": "nerium-security", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Host-based detection rules for the RCE vulnerability in the React JavaScript framework.", "summary": "Host-based detection rules for the RCE vulnerability in the React JavaScript framework.", "url": "https://github.com/nerium-security/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · zzhorc/CVE-2025-55182", "author": "zzhorc", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "CVE-2025-55182复现环境及RCE回显poc", "summary": "CVE-2025-55182复现环境及RCE回显poc", "url": "https://github.com/zzhorc/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Atlantis02-sec/Vulnerability-assessment", "author": "Atlantis02-sec", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "nmap nse for detecting React2Shell (CVE-2025-55182)", "summary": "nmap nse for detecting React2Shell (CVE-2025-55182)", "url": "https://github.com/Atlantis02-sec/Vulnerability-assessment" }, { "repository": "PoC-in-GitHub · rl0x01/CVE-2025-55182_PoC", "author": "rl0x01", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Proof-of-Concept RCE pour CVE‑2025‑55182 exploitant le protocole React Flight sur Next.js App Router.", "summary": "Proof-of-Concept RCE pour CVE‑2025‑55182 exploitant le protocole React Flight sur Next.js App Router.", "url": "https://github.com/rl0x01/CVE-2025-55182_PoC" }, { "repository": "PoC-in-GitHub · subzer0x0/React2Shell", "author": "subzer0x0", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "React2Shell (CVE-2025-55182) – An intentionally vulnerable Next.js application created for educational and research purposes.", "summary": "React2Shell (CVE-2025-55182) – An intentionally vulnerable Next.js application created for educational and research purposes.", "url": "https://github.com/subzer0x0/React2Shell" }, { "repository": "PoC-in-GitHub · f0xyx/CVE-2025-55182-Scanner", "author": "f0xyx", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Security scanner for CVE-2025-55182 - Critical RCE vulnerability in React Server Components", "summary": "Security scanner for CVE-2025-55182 - Critical RCE vulnerability in React Server Components", "url": "https://github.com/f0xyx/CVE-2025-55182-Scanner" }, { "repository": "PoC-in-GitHub · Cr4at0r/Next.js-RCE-Scanner-BurpSuite-Extension-", "author": "Cr4at0r", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 28, "title": "使用burp自动检测CVE-2025-55182 Next.js RCE 漏洞", "summary": "使用burp自动检测CVE-2025-55182 Next.js RCE 漏洞", "url": "https://github.com/Cr4at0r/Next.js-RCE-Scanner-BurpSuite-Extension-" }, { "repository": "PoC-in-GitHub · ceortiz33/CVE-2025-55182", "author": "ceortiz33", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Proof of Concept for React2Shell vulnerability", "summary": "Proof of Concept for React2Shell vulnerability", "url": "https://github.com/ceortiz33/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · xkey8/react2shell", "author": "xkey8", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "PoC for React2Shell (CVE-2025-55182)", "summary": "PoC for React2Shell (CVE-2025-55182)", "url": "https://github.com/xkey8/react2shell" }, { "repository": "PoC-in-GitHub · zessu/CVE-2025-55182-Typescript", "author": "zessu", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Show case CVE-2025-55182 POC in Typrescript/Javascript", "summary": "Show case CVE-2025-55182 POC in Typrescript/Javascript", "url": "https://github.com/zessu/CVE-2025-55182-Typescript" }, { "repository": "PoC-in-GitHub · mxm0z/r2s", "author": "mxm0z", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A web-based vulnerability scanner for CVE-2025-55182, a critical Remote Code Execution (RCE) vulnerability in React Server Components.", "summary": "A web-based vulnerability scanner for CVE-2025-55182, a critical Remote Code Execution (RCE) vulnerability in React Server Components.", "url": "https://github.com/mxm0z/r2s" }, { "repository": "PoC-in-GitHub · NathanJ60/react2shell-interactive", "author": "NathanJ60", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 Interactive PoC - React Server Components RCE - Educational Security Research", "summary": "CVE-2025-55182 Interactive PoC - React Server Components RCE - Educational Security Research", "url": "https://github.com/NathanJ60/react2shell-interactive" }, { "repository": "PoC-in-GitHub · GarethMSheldon/React2Shell-CVE-2025-55182-Detector", "author": "GarethMSheldon", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/GarethMSheldon/React2Shell-CVE-2025-55182-Detector" }, { "repository": "PoC-in-GitHub · kindone09/CVE-2025-55182", "author": "kindone09", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/kindone09/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · alsaut1/react2shell-lab", "author": "alsaut1", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "CVE-2025-55182 React2Shell PoC lab", "summary": "CVE-2025-55182 React2Shell PoC lab", "url": "https://github.com/alsaut1/react2shell-lab" }, { "repository": "PoC-in-GitHub · pax-k/react2shell-CVE-2025-55182-full-rce-script", "author": "pax-k", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "React2Shell vulnerability (CVE-2025-55182 / CVE-2025-66478)", "summary": "React2Shell vulnerability (CVE-2025-55182 / CVE-2025-66478)", "url": "https://github.com/pax-k/react2shell-CVE-2025-55182-full-rce-script" }, { "repository": "PoC-in-GitHub · kOaDT/poc-cve-2025-55182", "author": "kOaDT", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 15, "title": "This repository contains a POC of CVE-2025-55182, a critical (CVSS score 10.0) pre-authentication remote code execution vulnerability affecting React Server Components, also known as React2Shell.", "summary": "This repository contains a POC of CVE-2025-55182, a critical (CVSS score 10.0) pre-authentication remote code execution vulnerability affecting React Server Components, also known as React2Shell.", "url": "https://github.com/kOaDT/poc-cve-2025-55182" }, { "repository": "PoC-in-GitHub · mohit121312/CVE-2025-55182_full_exploit", "author": "mohit121312", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "this repo have CVE-2025-55182 full exploit with RCE", "summary": "this repo have CVE-2025-55182 full exploit with RCE", "url": "https://github.com/mohit121312/CVE-2025-55182_full_exploit" }, { "repository": "PoC-in-GitHub · ejpir/CVE-2025-55182-bypass", "author": "ejpir", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "Header bypass for CVE-2025-55182 (React Server Components RCE).", "summary": "Header bypass for CVE-2025-55182 (React Server Components RCE).", "url": "https://github.com/ejpir/CVE-2025-55182-bypass" }, { "repository": "PoC-in-GitHub · StealthMoud/CVE-2025-55182-Scanner", "author": "StealthMoud", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/StealthMoud/CVE-2025-55182-Scanner" }, { "repository": "PoC-in-GitHub · yanoshercohen/React2Shell_CVE-2025-55182", "author": "yanoshercohen", "first_seen": "2025-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "React2Shell (CVE-2025-55182) Exploit", "summary": "React2Shell (CVE-2025-55182) Exploit", "url": "https://github.com/yanoshercohen/React2Shell_CVE-2025-55182" }, { "repository": "PoC-in-GitHub · emredavut/CVE-2025-55182", "author": "emredavut", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 316, "title": "RSC/Next.js RCE Vulnerability Detector & PoC Chrome Extension – CVE-2025-55182 & CVE-2025-66478", "summary": "RSC/Next.js RCE Vulnerability Detector & PoC Chrome Extension – CVE-2025-55182 & CVE-2025-66478", "url": "https://github.com/emredavut/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · rapticore/ore_react2shell_scanner", "author": "rapticore", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 (React2Shell) Scanner", "summary": "CVE-2025-55182 (React2Shell) Scanner", "url": "https://github.com/rapticore/ore_react2shell_scanner" }, { "repository": "PoC-in-GitHub · fankh/cve-2025-55182-test-lab-windows", "author": "fankh", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/fankh/cve-2025-55182-test-lab-windows" }, { "repository": "PoC-in-GitHub · cypholab/evilact", "author": "cypholab", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Fast scanner for detecting and confirming Next.js RCE vulnerabilities (CVE-2025-55182 & CVE-2025-66478).", "summary": "Fast scanner for detecting and confirming Next.js RCE vulnerabilities (CVE-2025-55182 & CVE-2025-66478).", "url": "https://github.com/cypholab/evilact" }, { "repository": "PoC-in-GitHub · greenheadHQ/CVE-2025-55182", "author": "greenheadHQ", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/greenheadHQ/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · sumanrox/rschunter", "author": "sumanrox", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 37, "title": "Mass Hunting & Exploitation PoC for CVE-2025-55182 & CVE-2025-66478", "summary": "Mass Hunting & Exploitation PoC for CVE-2025-55182 & CVE-2025-66478", "url": "https://github.com/sumanrox/rschunter" }, { "repository": "PoC-in-GitHub · I3r1h0n/React2Shell", "author": "I3r1h0n", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "My research on CVE-2025-55182", "summary": "My research on CVE-2025-55182", "url": "https://github.com/I3r1h0n/React2Shell" }, { "repository": "PoC-in-GitHub · zorejt/Rust_CVE-2025-55182", "author": "zorejt", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/zorejt/Rust_CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Archerkong/CVE-2025-55182", "author": "Archerkong", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 poc", "summary": "CVE-2025-55182 poc", "url": "https://github.com/Archerkong/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · philparzer/nextjs-react2shell-detect", "author": "philparzer", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "chrome extension to detect next.js sites vulnerable to CVE-2025-55182 (react2shell)", "summary": "chrome extension to detect next.js sites vulnerable to CVE-2025-55182 (react2shell)", "url": "https://github.com/philparzer/nextjs-react2shell-detect" }, { "repository": "PoC-in-GitHub · yunaranyancat/CVE-2025-55182-NSE", "author": "yunaranyancat", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Meow", "summary": "Meow", "url": "https://github.com/yunaranyancat/CVE-2025-55182-NSE" }, { "repository": "PoC-in-GitHub · MrSol0/CVE-2025-55182-Terminal", "author": "MrSol0", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This is a POC for testing your projects that are vulnerable to CVE-2025-55182 with a terminal and ability to scan a list", "summary": "This is a POC for testing your projects that are vulnerable to CVE-2025-55182 with a terminal and ability to scan a list", "url": "https://github.com/MrSol0/CVE-2025-55182-Terminal" }, { "repository": "PoC-in-GitHub · fullhunt/react2shell-test-server", "author": "fullhunt", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "A test server for demonstrating and testing React2Shell (CVE-2025-55182) vulnerability", "summary": "A test server for demonstrating and testing React2Shell (CVE-2025-55182) vulnerability", "url": "https://github.com/fullhunt/react2shell-test-server" }, { "repository": "PoC-in-GitHub · zack0x01/vuln-app-CVE-2025-55182", "author": "zack0x01", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 22, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/zack0x01/vuln-app-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · zack0x01/CVE-2025-55182-advanced-scanner-", "author": "zack0x01", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 283, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/zack0x01/CVE-2025-55182-advanced-scanner-" }, { "repository": "PoC-in-GitHub · rocklambros/React2Shell_Hunter", "author": "rocklambros", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "AWS Organization-wide detection toolkit for CVE-2025-55182 & CVE-2025-66478 (React Server Components / Next.js RCE vulnerabilities)", "summary": "AWS Organization-wide detection toolkit for CVE-2025-55182 & CVE-2025-66478 (React Server Components / Next.js RCE vulnerabilities)", "url": "https://github.com/rocklambros/React2Shell_Hunter" }, { "repository": "PoC-in-GitHub · alessiodos/react2shell-scanner", "author": "alessiodos", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 & CVE-2025-66478 Detection Tool for Next.js RSC RCE", "summary": "CVE-2025-55182 & CVE-2025-66478 Detection Tool for Next.js RSC RCE", "url": "https://github.com/alessiodos/react2shell-scanner" }, { "repository": "PoC-in-GitHub · Bashamega/react-CVE-2025-55182-fixer", "author": "Bashamega", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Patches CVE-2025-55182 in your repositories", "summary": "Patches CVE-2025-55182 in your repositories", "url": "https://github.com/Bashamega/react-CVE-2025-55182-fixer" }, { "repository": "PoC-in-GitHub · orgito1015/CVE-2025-55182-RCE-Exploit", "author": "orgito1015", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "More exploit-focused; great for security research repos.", "summary": "More exploit-focused; great for security research repos.", "url": "https://github.com/orgito1015/CVE-2025-55182-RCE-Exploit" }, { "repository": "PoC-in-GitHub · keklick1337/CVE-2025-55182-golang-PoC", "author": "keklick1337", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "CVE-2025-55182 React Server Components RCE - Go PoC", "summary": "CVE-2025-55182 React Server Components RCE - Go PoC", "url": "https://github.com/keklick1337/CVE-2025-55182-golang-PoC" }, { "repository": "PoC-in-GitHub · rubensuxo-eh/react2shell-exploit", "author": "rubensuxo-eh", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "React2Shell-Exploit — Complete exploitation framework for CVE-2025-55182, including Python exploit, Docker vulnerable lab, Burp Suite manual and automated exploitation, Nuclei detection template, and validated testing workflow. Developed for penetration testing and educational research.", "summary": "React2Shell-Exploit — Complete exploitation framework for CVE-2025-55182, including Python exploit, Docker vulnerable lab, Burp Suite manual and automated exploitation, Nuclei detection template, and validated testing workflow. Developed for penetration testing and educational research.", "url": "https://github.com/rubensuxo-eh/react2shell-exploit" }, { "repository": "PoC-in-GitHub · CirqueiraDev/MassExploit-CVE-2025-55182", "author": "CirqueiraDev", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "CVE-2025-55182 RCE - Massive Scanner POC", "summary": "CVE-2025-55182 RCE - Massive Scanner POC", "url": "https://github.com/CirqueiraDev/MassExploit-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · aastikgakhar/CVE-2025-55182-react2shell", "author": "aastikgakhar", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Detects exposed React Server Components vulnerable to CVE-2025-55182 via RSC negotiation.", "summary": "Detects exposed React Server Components vulnerable to CVE-2025-55182 via RSC negotiation.", "url": "https://github.com/aastikgakhar/CVE-2025-55182-react2shell" }, { "repository": "PoC-in-GitHub · zamdevio/r2s", "author": "zamdevio", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Advanced security testing tool for CVE-2025-55182 vulnerability assessment in Next.js applications. Features interactive shell, batch scanning, WAF bypass, and comprehensive reporting.", "summary": "Advanced security testing tool for CVE-2025-55182 vulnerability assessment in Next.js applications. Features interactive shell, batch scanning, WAF bypass, and comprehensive reporting.", "url": "https://github.com/zamdevio/r2s" }, { "repository": "PoC-in-GitHub · AdityaBhatt3010/React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web", "author": "AdityaBhatt3010", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "React2Shell, CVE-2025-55182, RCE Vulnerability: A critical breakdown of the unsafe deserialization flaw in React Server Components that enables unauthenticated remote code execution across default React/Next.js setups.", "summary": "React2Shell, CVE-2025-55182, RCE Vulnerability: A critical breakdown of the unsafe deserialization flaw in React Server Components that enables unauthenticated remote code execution across default React/Next.js setups.", "url": "https://github.com/AdityaBhatt3010/React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web" }, { "repository": "PoC-in-GitHub · 0xN7y/CVE-2025-55182", "author": "0xN7y", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Poc for CVE-2025-55182", "summary": "Poc for CVE-2025-55182", "url": "https://github.com/0xN7y/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · MuhammadWaseem29/React2Shell_Rce-cve-2025-55182", "author": "MuhammadWaseem29", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, contain a remote code execution vulnerability.", "summary": "React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, contain a remote code execution vulnerability.", "url": "https://github.com/MuhammadWaseem29/React2Shell_Rce-cve-2025-55182" }, { "repository": "PoC-in-GitHub · l0n3m4n/CVE-2025-55182-Waf", "author": "l0n3m4n", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-55182 RCE vulnerability in Next.js/React RSC servers (exploit and scanner)", "summary": "CVE-2025-55182 RCE vulnerability in Next.js/React RSC servers (exploit and scanner)", "url": "https://github.com/l0n3m4n/CVE-2025-55182-Waf" }, { "repository": "PoC-in-GitHub · ynsmroztas/NextRce", "author": "ynsmroztas", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 267, "title": "React Shell & Next.js RSC Exploit Tool (CVE-2025-55182)", "summary": "React Shell & Next.js RSC Exploit Tool (CVE-2025-55182)", "url": "https://github.com/ynsmroztas/NextRce" }, { "repository": "PoC-in-GitHub · shreyas-malhotra/React2Shell-CVE-2025-55182", "author": "shreyas-malhotra", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A minimal RCE PoC for CVE-2025-55182", "summary": "A minimal RCE PoC for CVE-2025-55182", "url": "https://github.com/shreyas-malhotra/React2Shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · sohaibeb/CVE-2025-55182", "author": "sohaibeb", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 PoC Exploit", "summary": "CVE-2025-55182 PoC Exploit", "url": "https://github.com/sohaibeb/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · vyvivekyadav04/RSC-Infra-Scanner", "author": "vyvivekyadav04", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This is a fast, asynchronous Python tool that fingerprints domains for likely Next.js App Router / React Server Components (RSC) infrastructure. (I made it to find the applications possibly vulnerable to CVE-2025-55182 and CVE-2025-66478)", "summary": "This is a fast, asynchronous Python tool that fingerprints domains for likely Next.js App Router / React Server Components (RSC) infrastructure. (I made it to find the applications possibly vulnerable to CVE-2025-55182 and CVE-2025-66478)", "url": "https://github.com/vyvivekyadav04/RSC-Infra-Scanner" }, { "repository": "PoC-in-GitHub · MikeTheHash/CVE-2025-55182", "author": "MikeTheHash", "first_seen": "2025-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A modified and a little boosted exploit for CVE-2025-55182, React2Shell: Pre-authentication Remote Code Execution in React Server Packages", "summary": "A modified and a little boosted exploit for CVE-2025-55182, React2Shell: Pre-authentication Remote Code Execution in React Server Packages", "url": "https://github.com/MikeTheHash/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Qixinlee/CVE-2025-55182-Scanner", "author": "Qixinlee", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Automated scanner for CVE-2025-55182: a critical RCE vulnerability in React Server Components and Next.js.", "summary": "Automated scanner for CVE-2025-55182: a critical RCE vulnerability in React Server Components and Next.js.", "url": "https://github.com/Qixinlee/CVE-2025-55182-Scanner" }, { "repository": "PoC-in-GitHub · DelvyGonzalez/react2shell-security-toolkit", "author": "DelvyGonzalez", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Security toolkit to detect CVE-2025-55182 (React2Shell) vulnerability", "summary": "Security toolkit to detect CVE-2025-55182 (React2Shell) vulnerability", "url": "https://github.com/DelvyGonzalez/react2shell-security-toolkit" }, { "repository": "PoC-in-GitHub · ahmedshamsddin/CVE-2025-55182", "author": "ahmedshamsddin", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/ahmedshamsddin/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · LemonTeatw1/CVE-2025-55182-exploit", "author": "LemonTeatw1", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "This is CVE-2025-55182 exploit", "summary": "This is CVE-2025-55182 exploit", "url": "https://github.com/LemonTeatw1/CVE-2025-55182-exploit" }, { "repository": "PoC-in-GitHub · ethicalrohitt/React2Shell_cve-2025-55182", "author": "ethicalrohitt", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/ethicalrohitt/React2Shell_cve-2025-55182" }, { "repository": "PoC-in-GitHub · ihhgimhana/React2Shell-CVE-2025-55182-PoC-Reverse-Shell", "author": "ihhgimhana", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "This is an easy to use PoC script to exploit React2Shell-CVE-2025-55182 Nextjs vulnerability. This will help to gain a reverse shell.", "summary": "This is an easy to use PoC script to exploit React2Shell-CVE-2025-55182 Nextjs vulnerability. This will help to gain a reverse shell.", "url": "https://github.com/ihhgimhana/React2Shell-CVE-2025-55182-PoC-Reverse-Shell" }, { "repository": "PoC-in-GitHub · shakilkhatri/scanner-for-CVE-2025-55182-vulnerability", "author": "shakilkhatri", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 Detector. Find which of your GitHub repositories are exposed to the critical React/Next.js RCE vulnerability and generate a clean Markdown report.", "summary": "CVE-2025-55182 Detector. Find which of your GitHub repositories are exposed to the critical React/Next.js RCE vulnerability and generate a clean Markdown report.", "url": "https://github.com/shakilkhatri/scanner-for-CVE-2025-55182-vulnerability" }, { "repository": "PoC-in-GitHub · UmmItKin/CVE-2025-55182-PoC", "author": "UmmItKin", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "react2shell PoC with Go / CVE-2025-55182", "summary": "react2shell PoC with Go / CVE-2025-55182", "url": "https://github.com/UmmItKin/CVE-2025-55182-PoC" }, { "repository": "PoC-in-GitHub · robbin0919/CVE-2025-55182", "author": "robbin0919", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/robbin0919/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · zxz3650/CVE-2025-55182-POC", "author": "zxz3650", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182-POC", "summary": "CVE-2025-55182-POC", "url": "https://github.com/zxz3650/CVE-2025-55182-POC" }, { "repository": "PoC-in-GitHub · AliHzSec/CVE-2025-55182", "author": "AliHzSec", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 15, "title": "Critical RCE vulnerability scanner for React Server Components (CVE-2025-55182). Automated exploitation framework with multi-payload support, proxy capabilities, and interactive command execution.", "summary": "Critical RCE vulnerability scanner for React Server Components (CVE-2025-55182). Automated exploitation framework with multi-payload support, proxy capabilities, and interactive command execution.", "url": "https://github.com/AliHzSec/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · zr0n/react2shell", "author": "zr0n", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 11, "title": "A complete framework for exploiting the vulnerability CVE-2025-55182", "summary": "A complete framework for exploiting the vulnerability CVE-2025-55182", "url": "https://github.com/zr0n/react2shell" }, { "repository": "PoC-in-GitHub · hunter24x24/CVE-2025-55182-mass", "author": "hunter24x24", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/hunter24x24/CVE-2025-55182-mass" }, { "repository": "PoC-in-GitHub · andressuarezmonk/CVE-2025-55182", "author": "andressuarezmonk", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/andressuarezmonk/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · cybertechajju/R2C-CVE-2025-55182-66478", "author": "cybertechajju", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 24, "title": "🔥 React2Shell Toolkit - CVE-2025-55182 & CVE-2025-66478", "summary": "🔥 React2Shell Toolkit - CVE-2025-55182 & CVE-2025-66478", "url": "https://github.com/cybertechajju/R2C-CVE-2025-55182-66478" }, { "repository": "PoC-in-GitHub · Dh4v4l8/CVE-2025-55182-poc-tool", "author": "Dh4v4l8", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/Dh4v4l8/CVE-2025-55182-poc-tool" }, { "repository": "PoC-in-GitHub · M4xSec/CVE-2025-55182-React2Shell-RCE-Shell", "author": "M4xSec", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 9, "title": "CVE-2025-55182 – React2Shell: Proof-of-Concept Remote Code Execution (RCE) exploit for Next.js apps. Features an interactive shell prompt to test and demonstrate the vulnerability in real time. Use for security research and authorized penetration-testing only.", "summary": "CVE-2025-55182 – React2Shell: Proof-of-Concept Remote Code Execution (RCE) exploit for Next.js apps. Features an interactive shell prompt to test and demonstrate the vulnerability in real time. Use for security research and authorized penetration-testing only.", "url": "https://github.com/M4xSec/CVE-2025-55182-React2Shell-RCE-Shell" }, { "repository": "PoC-in-GitHub · SainiONHacks/CVE-2025-55182-Scanner", "author": "SainiONHacks", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "A standalone GUI tool to detect and demonstrate the **React Server Components Remote Code Execution (RCE)** vulnerability (CVE-2025-55182) in Next.js applications.", "summary": "A standalone GUI tool to detect and demonstrate the **React Server Components Remote Code Execution (RCE)** vulnerability (CVE-2025-55182) in Next.js applications.", "url": "https://github.com/SainiONHacks/CVE-2025-55182-Scanner" }, { "repository": "PoC-in-GitHub · umairahmadh/react-vuln-scanner", "author": "umairahmadh", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A bash script to scan your server for React applications vulnerable to **CVE-2025-55182** — a critical remote code execution vulnerability (CVSS 10.0) in React Server Components.", "summary": "A bash script to scan your server for React applications vulnerable to **CVE-2025-55182** — a critical remote code execution vulnerability (CVSS 10.0) in React Server Components.", "url": "https://github.com/umairahmadh/react-vuln-scanner" }, { "repository": "PoC-in-GitHub · ToritoIO/Torito-R2S", "author": "ToritoIO", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "Torito React2Shell Scanner & Exploit Tool (CVE-2025-55182 / 66478)", "summary": "Torito React2Shell Scanner & Exploit Tool (CVE-2025-55182 / 66478)", "url": "https://github.com/ToritoIO/Torito-R2S" }, { "repository": "PoC-in-GitHub · surajhacx/react2shellpoc", "author": "surajhacx", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 32, "title": "react2shell CVE-2025-55182 PoC", "summary": "react2shell CVE-2025-55182 PoC", "url": "https://github.com/surajhacx/react2shellpoc" }, { "repository": "PoC-in-GitHub · kavienanj/CVE-2025-55182", "author": "kavienanj", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 38, "title": "Step-by-step walkthrough of CVE-2025-55182 (React2Shell) by tracing React's Flight protocol internals.", "summary": "Step-by-step walkthrough of CVE-2025-55182 (React2Shell) by tracing React's Flight protocol internals.", "url": "https://github.com/kavienanj/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · websecuritylabs/React2Shell-Library", "author": "websecuritylabs", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "A curated list of resources regarding CVE-2025-55182, the critical Remote Code Execution (RCE) vulnerability in React Server Components known as \"React2Shell\".", "summary": "A curated list of resources regarding CVE-2025-55182, the critical Remote Code Execution (RCE) vulnerability in React Server Components known as \"React2Shell\".", "url": "https://github.com/websecuritylabs/React2Shell-Library" }, { "repository": "PoC-in-GitHub · cyberleelawat/CVE-2025-55182", "author": "cyberleelawat", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A critical Remote Code Execution (RCE) vulnerability affecting the React Server Components (RSC) implementation within multiple packages including.", "summary": "A critical Remote Code Execution (RCE) vulnerability affecting the React Server Components (RSC) implementation within multiple packages including.", "url": "https://github.com/cyberleelawat/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · satriarizka/CVE-2025-55182-Simple-Scanner", "author": "satriarizka", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "High-fidelity RCE scanner for CVE-2025-55182 affecting Next.js RSC. Supports mass scanning, command execution, and automated recon pipelines. Built for pentesters, researchers, and bounty hunters.", "summary": "High-fidelity RCE scanner for CVE-2025-55182 affecting Next.js RSC. Supports mass scanning, command execution, and automated recon pipelines. Built for pentesters, researchers, and bounty hunters.", "url": "https://github.com/satriarizka/CVE-2025-55182-Simple-Scanner" }, { "repository": "PoC-in-GitHub · xcanwin/CVE-2025-55182-React-RCE", "author": "xcanwin", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 15, "title": "[漏洞复现] 全球首款基于RSC特性能绕过WAF检测的CVE-2025-55182 React Server RCE 漏洞 EXP。", "summary": "[漏洞复现] 全球首款基于RSC特性能绕过WAF检测的CVE-2025-55182 React Server RCE 漏洞 EXP。", "url": "https://github.com/xcanwin/CVE-2025-55182-React-RCE" }, { "repository": "PoC-in-GitHub · DoobTheGoober/CVE-2025-55182-Test-Server", "author": "DoobTheGoober", "first_seen": "2025-12-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Play with react2shell in a safe environment!", "summary": "Play with react2shell in a safe environment!", "url": "https://github.com/DoobTheGoober/CVE-2025-55182-Test-Server" }, { "repository": "PoC-in-GitHub · timsonner/React2Shell-CVE-2025-55182", "author": "timsonner", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "POC and lab setup", "summary": "POC and lab setup", "url": "https://github.com/timsonner/React2Shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · theman001/CVE-2025-55182", "author": "theman001", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-55182 React RCE Test Program", "summary": "CVE-2025-55182 React RCE Test Program", "url": "https://github.com/theman001/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · lalaterry/CVE-2025-55182-React2Shell-lab", "author": "lalaterry", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/lalaterry/CVE-2025-55182-React2Shell-lab" }, { "repository": "PoC-in-GitHub · arashiyans/CVE-2025-55182-CVE-2025-66478", "author": "arashiyans", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "scanner testing", "summary": "scanner testing", "url": "https://github.com/arashiyans/CVE-2025-55182-CVE-2025-66478" }, { "repository": "PoC-in-GitHub · faizdotid/rust-cve-2025-55182", "author": "faizdotid", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/faizdotid/rust-cve-2025-55182" }, { "repository": "PoC-in-GitHub · muthaiyanmani/react2shell-checker", "author": "muthaiyanmani", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A security vulnerability scanner for detecting the React2Shell vulnerability (CVE-2025-55182) in Next.js and React applications.", "summary": "A security vulnerability scanner for detecting the React2Shell vulnerability (CVE-2025-55182) in Next.js and React applications.", "url": "https://github.com/muthaiyanmani/react2shell-checker" }, { "repository": "PoC-in-GitHub · LucasPDiniz/CVE-2025-55182", "author": "LucasPDiniz", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "React2Shell Vulnerability", "summary": "React2Shell Vulnerability", "url": "https://github.com/LucasPDiniz/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · wangzhengquan/CVE-2025-55182", "author": "wangzhengquan", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3", "summary": "https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3", "url": "https://github.com/wangzhengquan/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · TH-SecForge/CVE-2025-55182", "author": "TH-SecForge", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/TH-SecForge/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · chitoz1300/React2Shell-CVE-2025-55182", "author": "chitoz1300", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "* React2Shell-CVE-2025-55182", "summary": "* React2Shell-CVE-2025-55182", "url": "https://github.com/chitoz1300/React2Shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Night-have-dreams/CVE-2025-55182-PoC", "author": "Night-have-dreams", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 PoC", "summary": "CVE-2025-55182 PoC", "url": "https://github.com/Night-have-dreams/CVE-2025-55182-PoC" }, { "repository": "PoC-in-GitHub · thekamran/CVE-2025-55182-Proof-of-Concept", "author": "thekamran", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/thekamran/CVE-2025-55182-Proof-of-Concept" }, { "repository": "PoC-in-GitHub · Syrins/CVE-2025-55182-React2Shell-RCE", "author": "Syrins", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "A modern, user-friendly GUI application for detecting and exploiting the CVE-2025-55182 vulnerability in React Server Components. Built with Python and Tkinter, featuring a sleek neon-themed interface for scanning targets, executing shell commands, and viewing live console output.", "summary": "A modern, user-friendly GUI application for detecting and exploiting the CVE-2025-55182 vulnerability in React Server Components. Built with Python and Tkinter, featuring a sleek neon-themed interface for scanning targets, executing shell commands, and viewing live console output.", "url": "https://github.com/Syrins/CVE-2025-55182-React2Shell-RCE" }, { "repository": "PoC-in-GitHub · 0xsj/CVE-2025-55182", "author": "0xsj", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/0xsj/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Security-Phoenix-demo/react2shell-scanner-CVE-2025-55182", "author": "Security-Phoenix-demo", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "React2shell-web-scanner", "summary": "React2shell-web-scanner", "url": "https://github.com/Security-Phoenix-demo/react2shell-scanner-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Benrich127N/react2shell_analyzer", "author": "Benrich127N", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "a dart package to analyze CVE-2025-55182 react2shell", "summary": "a dart package to analyze CVE-2025-55182 react2shell", "url": "https://github.com/Benrich127N/react2shell_analyzer" }, { "repository": "PoC-in-GitHub · randarts/react-rce", "author": "randarts", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 취약점에 대한 샘플을 AI와 함께 작성 및 테스트 했습니다.", "summary": "CVE-2025-55182 취약점에 대한 샘플을 AI와 함께 작성 및 테스트 했습니다.", "url": "https://github.com/randarts/react-rce" }, { "repository": "PoC-in-GitHub · hamm0nz/react2shell-audit", "author": "hamm0nz", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A lightweight, recursive Bash script to detect Next.js and React Server DOM versions vulnerable to CVE-2025-55182 (React2Shell) in local projects.", "summary": "A lightweight, recursive Bash script to detect Next.js and React Server DOM versions vulnerable to CVE-2025-55182 (React2Shell) in local projects.", "url": "https://github.com/hamm0nz/react2shell-audit" }, { "repository": "PoC-in-GitHub · 0xSalm0n/CVE-2025-55182", "author": "0xSalm0n", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/0xSalm0n/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Macaroniwdcheese/CVE-2025-55182-Lab", "author": "Macaroniwdcheese", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/Macaroniwdcheese/CVE-2025-55182-Lab" }, { "repository": "PoC-in-GitHub · LvMalware/CVE-2025-55182", "author": "LvMalware", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Exploit for CVE-2025-55182 (React4Shell)", "summary": "Exploit for CVE-2025-55182 (React4Shell)", "url": "https://github.com/LvMalware/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · HUAHUAI23/CVE-2025-55182-POC", "author": "HUAHUAI23", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/HUAHUAI23/CVE-2025-55182-POC" }, { "repository": "PoC-in-GitHub · cahyod/react2shell", "author": "cahyod", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Alat ini mendeteksi potensi kerentanan React2Shell (CVE-2025-55182) dalam proyek React dengan memeriksa: - File `package.json` dan file lock untuk paket rentan - Direktori `node_modules` untuk dependensi yang terpengaruh - URL secara pasif untuk deteksi jarak jauh", "summary": "Alat ini mendeteksi potensi kerentanan React2Shell (CVE-2025-55182) dalam proyek React dengan memeriksa: - File `package.json` dan file lock untuk paket rentan - Direktori `node_modules` untuk dependensi yang terpengaruh - URL secara pasif untuk deteksi jarak jauh", "url": "https://github.com/cahyod/react2shell" }, { "repository": "PoC-in-GitHub · yaupunal/CVE-2025-55182-scanner", "author": "yaupunal", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182-scanner with 2 different method", "summary": "CVE-2025-55182-scanner with 2 different method", "url": "https://github.com/yaupunal/CVE-2025-55182-scanner" }, { "repository": "PoC-in-GitHub · jandelima/cve-2025-55182-poc-test", "author": "jandelima", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/jandelima/cve-2025-55182-poc-test" }, { "repository": "PoC-in-GitHub · im-ezboy/CVE-2025-55182-zoomeye", "author": "im-ezboy", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "🔍 Next.js RCE Scanner (CVE-2025-55182) - Automated vulnerability scanner using Zoomeye search engine. Discovers targets via dorks and tests for CVE-2025-55182 with parallel scanning capabilities.", "summary": "🔍 Next.js RCE Scanner (CVE-2025-55182) - Automated vulnerability scanner using Zoomeye search engine. Discovers targets via dorks and tests for CVE-2025-55182 with parallel scanning capabilities.", "url": "https://github.com/im-ezboy/CVE-2025-55182-zoomeye" }, { "repository": "PoC-in-GitHub · FurkanKAYAPINAR/React-Next-Scanner", "author": "FurkanKAYAPINAR", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 and CVE-2025-66478", "summary": "CVE-2025-55182 and CVE-2025-66478", "url": "https://github.com/FurkanKAYAPINAR/React-Next-Scanner" }, { "repository": "PoC-in-GitHub · lowercasenumbers/CVE-2025-55182", "author": "lowercasenumbers", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 React2Shell PoC", "summary": "CVE-2025-55182 React2Shell PoC", "url": "https://github.com/lowercasenumbers/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · AggressiveUser/React2Hell", "author": "AggressiveUser", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "[React2Hell] Next.js/React Server RCE Exploit — CVE-2025-55182", "summary": "[React2Hell] Next.js/React Server RCE Exploit — CVE-2025-55182", "url": "https://github.com/AggressiveUser/React2Hell" }, { "repository": "PoC-in-GitHub · racall/cve-2025-55182-node", "author": "racall", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 Next.js RCE Exploit Tool", "summary": "CVE-2025-55182 Next.js RCE Exploit Tool", "url": "https://github.com/racall/cve-2025-55182-node" }, { "repository": "PoC-in-GitHub · FurkanKAYAPINAR/ReactNext2Shell", "author": "FurkanKAYAPINAR", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 and CVE-2025-66478", "summary": "CVE-2025-55182 and CVE-2025-66478", "url": "https://github.com/FurkanKAYAPINAR/ReactNext2Shell" }, { "repository": "PoC-in-GitHub · LQTjim/next-bug-CVE-2025-55182", "author": "LQTjim", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/LQTjim/next-bug-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · AliAbdollahiii/react2shell_detector", "author": "AliAbdollahiii", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Heuristic security scanner for detecting React Server Components (RSC) vulnerabilities, including React2Shell-style behavior (CVE-2025-55182). Safe, non-exploitative, multi-target capable.", "summary": "Heuristic security scanner for detecting React Server Components (RSC) vulnerabilities, including React2Shell-style behavior (CVE-2025-55182). Safe, non-exploitative, multi-target capable.", "url": "https://github.com/AliAbdollahiii/react2shell_detector" }, { "repository": "PoC-in-GitHub · jan0x190/CVE-2025-55182-Simple-Scanner-main", "author": "jan0x190", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/jan0x190/CVE-2025-55182-Simple-Scanner-main" }, { "repository": "PoC-in-GitHub · xiaopeng-ye/react2shell-detector", "author": "xiaopeng-ye", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "A Chrome extension for detecting React2Shell vulnerabilities (CVE-2025-55182 & CVE-2025-66478) in web applications", "summary": "A Chrome extension for detecting React2Shell vulnerabilities (CVE-2025-55182 & CVE-2025-66478) in web applications", "url": "https://github.com/xiaopeng-ye/react2shell-detector" }, { "repository": "PoC-in-GitHub · vulncheck-oss/cve-2025-55182", "author": "vulncheck-oss", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "VulnCheck CVE-2025-55182 react2shell", "summary": "VulnCheck CVE-2025-55182 react2shell", "url": "https://github.com/vulncheck-oss/cve-2025-55182" }, { "repository": "PoC-in-GitHub · Shield-Cyber/react2shell-scanner", "author": "Shield-Cyber", "first_seen": "2025-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Scanner to detect the presence of CVE-2025-55182 & CVE-2025-66478 on targeted web services.", "summary": "Scanner to detect the presence of CVE-2025-55182 & CVE-2025-66478 on targeted web services.", "url": "https://github.com/Shield-Cyber/react2shell-scanner" }, { "repository": "PoC-in-GitHub · sun977/CVE-2025-55182", "author": "sun977", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 检测方式和攻击利用", "summary": "CVE-2025-55182 检测方式和攻击利用", "url": "https://github.com/sun977/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · garux-sec/PoC-react2shell-CVE-2025-55182", "author": "garux-sec", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PoC-react2shell-CVE-2025-55182", "summary": "PoC-react2shell-CVE-2025-55182", "url": "https://github.com/garux-sec/PoC-react2shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · ancs21/react2shell-scanner-rust", "author": "ancs21", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Detect CVE-2025-55182 & CVE-2025-66478 in Next.js/RSC applications (Rust)", "summary": "Detect CVE-2025-55182 & CVE-2025-66478 in Next.js/RSC applications (Rust)", "url": "https://github.com/ancs21/react2shell-scanner-rust" }, { "repository": "PoC-in-GitHub · MoisesTapia/http-react2shell", "author": "MoisesTapia", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Detection of the React Server Actions Exploit vector – CVE-2025-55182 / CVE-2025-66478", "summary": "Detection of the React Server Actions Exploit vector – CVE-2025-55182 / CVE-2025-66478", "url": "https://github.com/MoisesTapia/http-react2shell" }, { "repository": "PoC-in-GitHub · solidevil14/Suricata-Rule-for-Detecting-CVE-2025-55182", "author": "solidevil14", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE‑2025‑55182 Detection", "summary": "CVE‑2025‑55182 Detection", "url": "https://github.com/solidevil14/Suricata-Rule-for-Detecting-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · techgaun/cve-2025-55182-scanner", "author": "techgaun", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/techgaun/cve-2025-55182-scanner" }, { "repository": "PoC-in-GitHub · rsch-io/CVE-2025-55182-React2Shell", "author": "rsch-io", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "React2Shell (CVE-2025-55182) proof-of-concept (PoC) exploit demonstrating a CRITICAL remote code execution (RCE) vulnerability in modern web frameworks using React Server Components (RSC).", "summary": "React2Shell (CVE-2025-55182) proof-of-concept (PoC) exploit demonstrating a CRITICAL remote code execution (RCE) vulnerability in modern web frameworks using React Server Components (RSC).", "url": "https://github.com/rsch-io/CVE-2025-55182-React2Shell" }, { "repository": "PoC-in-GitHub · ilixm/PoC-RCE-CVE-2025-55182", "author": "ilixm", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/ilixm/PoC-RCE-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · iamblacksolo2-BugBounty/POC-CVE-2025-55182", "author": "iamblacksolo2-BugBounty", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/iamblacksolo2-BugBounty/POC-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · joelvaiju/react2shell-CVE-2025-55182-poc", "author": "joelvaiju", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "a simple react2shell poc with basic waf bypass", "summary": "a simple react2shell poc with basic waf bypass", "url": "https://github.com/joelvaiju/react2shell-CVE-2025-55182-poc" }, { "repository": "PoC-in-GitHub · DevVaibhav07/POC-CVE-2025-55182", "author": "DevVaibhav07", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "POC-CVE-2025-55182", "summary": "POC-CVE-2025-55182", "url": "https://github.com/DevVaibhav07/POC-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · liamromanis101/cve-2025-55182", "author": "liamromanis101", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Python3 script that can be used to demonstrate **CVE-2025-55182**. It exploits a server-side JavaScript injection vulnerability in Next.js/React applications, allowing **remote code execution** via malformed multipart form data.", "summary": "Python3 script that can be used to demonstrate **CVE-2025-55182**. It exploits a server-side JavaScript injection vulnerability in Next.js/React applications, allowing **remote code execution** via malformed multipart form data.", "url": "https://github.com/liamromanis101/cve-2025-55182" }, { "repository": "PoC-in-GitHub · ysfcndgr/React2Shell-CVE-2025-55182-Advanced-Scanner", "author": "ysfcndgr", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/ysfcndgr/React2Shell-CVE-2025-55182-Advanced-Scanner" }, { "repository": "PoC-in-GitHub · alfazhossain/CVE-2025-55182-Exploiter", "author": "alfazhossain", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "CVE-2025-55182-Exploiter Google Chrome Extension. nextjs vulnerability #nextjscve", "summary": "CVE-2025-55182-Exploiter Google Chrome Extension. nextjs vulnerability #nextjscve", "url": "https://github.com/alfazhossain/CVE-2025-55182-Exploiter" }, { "repository": "PoC-in-GitHub · keshavyaduvans/cve-2025-55182", "author": "keshavyaduvans", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/keshavyaduvans/cve-2025-55182" }, { "repository": "PoC-in-GitHub · byte16384/CVE-2025-55182", "author": "byte16384", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "proof", "summary": "proof", "url": "https://github.com/byte16384/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · kondukto-io/vulnerable-next-js-poc", "author": "kondukto-io", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "POC for React2Shell (CVE-2025-55182)", "summary": "POC for React2Shell (CVE-2025-55182)", "url": "https://github.com/kondukto-io/vulnerable-next-js-poc" }, { "repository": "PoC-in-GitHub · eytannatye/R2S_CVE-2025-55182", "author": "eytannatye", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/eytannatye/R2S_CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Jaycelation/CVE-2025-55182", "author": "Jaycelation", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PoC, Hunting React2Shell about CVE-2025-55182", "summary": "PoC, Hunting React2Shell about CVE-2025-55182", "url": "https://github.com/Jaycelation/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · shyambhanushali/React2Shell", "author": "shyambhanushali", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 13, "title": "React2Shell is a Python-based proof-of-concept tool designed to exploit CVE-2025-55182 and CVE-2025-66478, both impacting Next.js applications using React Server Components (RSC).", "summary": "React2Shell is a Python-based proof-of-concept tool designed to exploit CVE-2025-55182 and CVE-2025-66478, both impacting Next.js applications using React Server Components (RSC).", "url": "https://github.com/shyambhanushali/React2Shell" }, { "repository": "PoC-in-GitHub · amir-malek/react-cve-2025-55182", "author": "amir-malek", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/amir-malek/react-cve-2025-55182" }, { "repository": "PoC-in-GitHub · Yyax13/CVE-2025-55182", "author": "Yyax13", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "RCE exploitation tool targeting CVE-2025-55182, a critical vulnerability in React Server Components (RSC) affecting React 19.0.0 - 19.2.0 and Next.js applications.", "summary": "RCE exploitation tool targeting CVE-2025-55182, a critical vulnerability in React Server Components (RSC) affecting React 19.0.0 - 19.2.0 and Next.js applications.", "url": "https://github.com/Yyax13/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Ankitspandey07/React2Shell", "author": "Ankitspandey07", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182-advanced-scanner", "summary": "CVE-2025-55182-advanced-scanner", "url": "https://github.com/Ankitspandey07/React2Shell" }, { "repository": "PoC-in-GitHub · Stonelinks/react-cve-2025-55182", "author": "Stonelinks", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "malware I found on my server", "summary": "malware I found on my server", "url": "https://github.com/Stonelinks/react-cve-2025-55182" }, { "repository": "PoC-in-GitHub · ihsansencan/React2Shell-CVE-2025-55182", "author": "ihsansencan", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "* React2Shell-CVE-2025-55182", "summary": "* React2Shell-CVE-2025-55182", "url": "https://github.com/ihsansencan/React2Shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · dr4xp/react2shell", "author": "dr4xp", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "A critical vulnerability in React Server Components affecting React 19 (CVE-2025-55182) and frameworks that use it like Next.js (CVE-2025-66478).", "summary": "A critical vulnerability in React Server Components affecting React 19 (CVE-2025-55182) and frameworks that use it like Next.js (CVE-2025-66478).", "url": "https://github.com/dr4xp/react2shell" }, { "repository": "PoC-in-GitHub · trax69/cve-2025-55182-poc", "author": "trax69", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Proof of Concept for CVE-2025-55182 (\"React2Shell\"). A fully dockerized environment demonstrating Remote Code Execution (RCE) via insecure deserialization in React Server Components. Includes vulnerable targets for both Vanilla React (Express) and Next.js, along with a custom Python exploit script.", "summary": "Proof of Concept for CVE-2025-55182 (\"React2Shell\"). A fully dockerized environment demonstrating Remote Code Execution (RCE) via insecure deserialization in React Server Components. Includes vulnerable targets for both Vanilla React (Express) and Next.js, along with a custom Python exploit script.", "url": "https://github.com/trax69/cve-2025-55182-poc" }, { "repository": "PoC-in-GitHub · osman-butt/CVE-2025-55182-demo", "author": "osman-butt", "first_seen": "2025-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Demo of CVE-2025-55182 — Next.js RCE (for educational purposes)", "summary": "Demo of CVE-2025-55182 — Next.js RCE (for educational purposes)", "url": "https://github.com/osman-butt/CVE-2025-55182-demo" }, { "repository": "PoC-in-GitHub · theori-io/reactguard", "author": "theori-io", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 18, "title": "ReactGuard provides framework- and vulnerability-detection tooling for CVE-2025-55182 (React2Shell)", "summary": "ReactGuard provides framework- and vulnerability-detection tooling for CVE-2025-55182 (React2Shell)", "url": "https://github.com/theori-io/reactguard" }, { "repository": "PoC-in-GitHub · iamblacksolo2-BugBounty/POC2-CVE-2025-55182", "author": "iamblacksolo2-BugBounty", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/iamblacksolo2-BugBounty/POC2-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · bakhod1r/CVE-2025-55182", "author": "bakhod1r", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/bakhod1r/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · theman001/CVE-2025-55182_PoC-Test-Server", "author": "theman001", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 React RCE Test Server", "summary": "CVE-2025-55182 React RCE Test Server", "url": "https://github.com/theman001/CVE-2025-55182_PoC-Test-Server" }, { "repository": "PoC-in-GitHub · gunyakit/CVE-2025-55182-PoC-exploit", "author": "gunyakit", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Next.js RCE via React Server Functions", "summary": "Next.js RCE via React Server Functions", "url": "https://github.com/gunyakit/CVE-2025-55182-PoC-exploit" }, { "repository": "PoC-in-GitHub · rix4uni/CVE-2025-55182", "author": "rix4uni", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "A command-line tool for detecting CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server Components.", "summary": "A command-line tool for detecting CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server Components.", "url": "https://github.com/rix4uni/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · gonaumov/cve-2025-55182-checker", "author": "gonaumov", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A portable Bash script to detect vulnerable versions of React Server DOM and Next.js packages affected by [CVE-2025-55182]", "summary": "A portable Bash script to detect vulnerable versions of React Server DOM and Next.js packages affected by [CVE-2025-55182]", "url": "https://github.com/gonaumov/cve-2025-55182-checker" }, { "repository": "PoC-in-GitHub · BeichenDream/CVE-2025-55182-GodzillaMemoryShell", "author": "BeichenDream", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 108, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/BeichenDream/CVE-2025-55182-GodzillaMemoryShell" }, { "repository": "PoC-in-GitHub · Legus-Yeung/CVE-2025-55182-exploit", "author": "Legus-Yeung", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/Legus-Yeung/CVE-2025-55182-exploit" }, { "repository": "PoC-in-GitHub · DanielXavierJob/-CVE-2025-55182", "author": "DanielXavierJob", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/DanielXavierJob/-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · sponte/nextjs-cve-version-confusion", "author": "sponte", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Reproduction for Next.js CVE-2025-55182 version string confusion issue", "summary": "Reproduction for Next.js CVE-2025-55182 version string confusion issue", "url": "https://github.com/sponte/nextjs-cve-version-confusion" }, { "repository": "PoC-in-GitHub · CrazyloveforWeb/Golang-CVE-2025-55182-POC", "author": "CrazyloveforWeb", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/CrazyloveforWeb/Golang-CVE-2025-55182-POC" }, { "repository": "PoC-in-GitHub · JahazielLem/NSE_CVE-2025-55182", "author": "JahazielLem", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Nmap NSE script for scanning React2Shell (CVE-2025-55182)", "summary": "Nmap NSE script for scanning React2Shell (CVE-2025-55182)", "url": "https://github.com/JahazielLem/NSE_CVE-2025-55182" }, { "repository": "PoC-in-GitHub · CerberusMrXi/Cerberus-React2Shell-Scanner-Exploit", "author": "CerberusMrXi", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Elite exploitation toolkit for CVE-2025-55182 (React Server Components RCE). Async polymorphic payloads, advanced WAF/CDN bypass, proxy rotation, Shodan/Censys mass scan, auto-pwn + reverse shells, Nuclei templates, K8s lab & C2 dashboard. Authored by Sudeepa Wanigarathna – strictly for authorized red team and penetration testing.", "summary": "Elite exploitation toolkit for CVE-2025-55182 (React Server Components RCE). Async polymorphic payloads, advanced WAF/CDN bypass, proxy rotation, Shodan/Censys mass scan, auto-pwn + reverse shells, Nuclei templates, K8s lab & C2 dashboard. Authored by Sudeepa Wanigarathna – strictly for authorized red team and penetration testing.", "url": "https://github.com/CerberusMrXi/Cerberus-React2Shell-Scanner-Exploit" }, { "repository": "PoC-in-GitHub · VeilVulp/RscScan-cve-2025-55182", "author": "VeilVulp", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "RscScan: Professional cross-platform vulnerability scanner for Next.js Server Actions (CVE-2025-55182). Detects critical RCE flaws with multi-threaded scanning, real-time analytics, and multi-language support. Built with Electron & React.", "summary": "RscScan: Professional cross-platform vulnerability scanner for Next.js Server Actions (CVE-2025-55182). Detects critical RCE flaws with multi-threaded scanning, real-time analytics, and multi-language support. Built with Electron & React.", "url": "https://github.com/VeilVulp/RscScan-cve-2025-55182" }, { "repository": "PoC-in-GitHub · yz9yt/React2Shell-CTF", "author": "yz9yt", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "A CTF challenge based on CVE-2025-55182 Vulnerability", "summary": "A CTF challenge based on CVE-2025-55182 Vulnerability", "url": "https://github.com/yz9yt/React2Shell-CTF" }, { "repository": "PoC-in-GitHub · Gymnott1/CVE-2025-55182", "author": "Gymnott1", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/Gymnott1/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · J4ck3LSyN-Gen2/CVE-2025-55182", "author": "J4ck3LSyN-Gen2", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A simple toolkit to validate, exploit & gain an interactive shell via the react2Shell Next.js RCE.", "summary": "A simple toolkit to validate, exploit & gain an interactive shell via the react2Shell Next.js RCE.", "url": "https://github.com/J4ck3LSyN-Gen2/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · pkrasulia/CVE-2025-55182-NextJS-RCE-PoC", "author": "pkrasulia", "first_seen": "2025-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "Working Proof of Concept (PoC) for CVE-2025-55182 (React2Shell) - Unauthenticated Remote Code Execution in Next.js 15.0.0 via React Server Components", "summary": "Working Proof of Concept (PoC) for CVE-2025-55182 (React2Shell) - Unauthenticated Remote Code Execution in Next.js 15.0.0 via React Server Components", "url": "https://github.com/pkrasulia/CVE-2025-55182-NextJS-RCE-PoC" }, { "repository": "PoC-in-GitHub · min8282/CVE-2025-55182", "author": "min8282", "first_seen": "2025-12-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/min8282/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Machine-farmer/PunchingBag-for-React2Shell", "author": "Machine-farmer", "first_seen": "2025-12-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Intentionally vulnerable Next.js app for CVE-2025-55182 security research and CTF challenges", "summary": "Intentionally vulnerable Next.js app for CVE-2025-55182 security research and CTF challenges", "url": "https://github.com/Machine-farmer/PunchingBag-for-React2Shell" }, { "repository": "PoC-in-GitHub · exrienz/CVE-2025-55182-NextJS-Scanner-React2Shell-PoC", "author": "exrienz", "first_seen": "2025-12-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/exrienz/CVE-2025-55182-NextJS-Scanner-React2Shell-PoC" }, { "repository": "PoC-in-GitHub · mrmtwoj/React2Shell-CVE-2025-55182", "author": "mrmtwoj", "first_seen": "2025-12-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Educational / research tool related to React / Next.js vulnerability CVE‑2025‑55182 (“React2Shell”).", "summary": "Educational / research tool related to React / Next.js vulnerability CVE‑2025‑55182 (“React2Shell”).", "url": "https://github.com/mrmtwoj/React2Shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · LC-pro/CVE-2025-55182-EXP", "author": "LC-pro", "first_seen": "2025-12-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/LC-pro/CVE-2025-55182-EXP" }, { "repository": "PoC-in-GitHub · Tiger-Foxx/exploit-react-CVE-2025-55182", "author": "Tiger-Foxx", "first_seen": "2025-12-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "This tool is a Proof of Concept (PoC) intended for security research and educational purposes only. Using this tool on systems without explicit permission is illegal and punishable by law. The author (Tiger-Foxx) assumes no responsibility for misuse.", "summary": "This tool is a Proof of Concept (PoC) intended for security research and educational purposes only. Using this tool on systems without explicit permission is illegal and punishable by law. The author (Tiger-Foxx) assumes no responsibility for misuse.", "url": "https://github.com/Tiger-Foxx/exploit-react-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · VolksRat71/react2shellexploitvisualized", "author": "VolksRat71", "first_seen": "2025-12-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "Interactive visualization of the React2Shell (CVE-2025-55182) RCE vulnerability with narrated animations for three audiences: Expert, Practitioner, and Stakeholder. Audio synced via ElevenLabs + Whisper.", "summary": "Interactive visualization of the React2Shell (CVE-2025-55182) RCE vulnerability with narrated animations for three audiences: Expert, Practitioner, and Stakeholder. Audio synced via ElevenLabs + Whisper.", "url": "https://github.com/VolksRat71/react2shellexploitvisualized" }, { "repository": "PoC-in-GitHub · anuththara2007-W/CVE-2025-55182-Exploit-extension", "author": "anuththara2007-W", "first_seen": "2025-12-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "A Chrome extension for detecting React2Shell vulnerabilities (CVE-2025-55182 & CVE-2025-66478) in web applications", "summary": "A Chrome extension for detecting React2Shell vulnerabilities (CVE-2025-55182 & CVE-2025-66478) in web applications", "url": "https://github.com/anuththara2007-W/CVE-2025-55182-Exploit-extension" }, { "repository": "PoC-in-GitHub · Nkwenti-Severian-Ndongtsop/POC_react2shell_CVE-2025-55182", "author": "Nkwenti-Severian-Ndongtsop", "first_seen": "2025-12-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/Nkwenti-Severian-Ndongtsop/POC_react2shell_CVE-2025-55182" }, { "repository": "PoC-in-GitHub · aseemyash/krle", "author": "aseemyash", "first_seen": "2025-12-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 & CVE-2025-66478 proof of concepts", "summary": "CVE-2025-55182 & CVE-2025-66478 proof of concepts", "url": "https://github.com/aseemyash/krle" }, { "repository": "PoC-in-GitHub · 4nuxd/React2Shell", "author": "4nuxd", "first_seen": "2025-12-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "R2S is a comprehensive exploitation and post-exploitation framework targeting the Next.js React Server Components vulnerability (CVE-2025-55182). It provides an interactive shell with advanced features for penetration testing, including file transfer, persistence, enumeration, privilege escalation checks, and more.", "summary": "R2S is a comprehensive exploitation and post-exploitation framework targeting the Next.js React Server Components vulnerability (CVE-2025-55182). It provides an interactive shell with advanced features for penetration testing, including file transfer, persistence, enumeration, privilege escalation checks, and more.", "url": "https://github.com/4nuxd/React2Shell" }, { "repository": "PoC-in-GitHub · j0lt-github/react2shell-burp", "author": "j0lt-github", "first_seen": "2025-12-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Burp Suite extension for identifying the React Server Components unsafe deserialization vulnerability (React2Shell / CVE-2025-55182). It provides a focused UI tab, context-menu actions, active-scanner integration, and optional Burp Collaborator confirmation.", "summary": "Burp Suite extension for identifying the React Server Components unsafe deserialization vulnerability (React2Shell / CVE-2025-55182). It provides a focused UI tab, context-menu actions, active-scanner integration, and optional Burp Collaborator confirmation.", "url": "https://github.com/j0lt-github/react2shell-burp" }, { "repository": "PoC-in-GitHub · IrsyadSEC/CVE-2025-55182-MassPayloadAttack", "author": "IrsyadSEC", "first_seen": "2025-12-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 payload", "summary": "CVE-2025-55182 payload", "url": "https://github.com/IrsyadSEC/CVE-2025-55182-MassPayloadAttack" }, { "repository": "PoC-in-GitHub · Shadowroot97/React2Shell-CVE-2025-55182", "author": "Shadowroot97", "first_seen": "2025-12-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "POC React2Shell-CVE-2025-55182", "summary": "POC React2Shell-CVE-2025-55182", "url": "https://github.com/Shadowroot97/React2Shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · yuta3003/CVE-2025-55182", "author": "yuta3003", "first_seen": "2025-12-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/yuta3003/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · rahul-securify/React2Shell-CVE-2025-55182", "author": "rahul-securify", "first_seen": "2025-12-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/rahul-securify/React2Shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · raivenLockdown/WEB-CLI_RCE_React2Shell", "author": "raivenLockdown", "first_seen": "2025-12-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "WEB-CLI_RCE_React2Shell is an educational PoC exploit tool for CVE-2025-55182, a critical Prototype Pollution flaw in Next.js applications using React Server Components. Designed for CTFs and research, it features a single-command mode, an interactive web CLI, and reverse shell capabilities to demonstrate RCE.", "summary": "WEB-CLI_RCE_React2Shell is an educational PoC exploit tool for CVE-2025-55182, a critical Prototype Pollution flaw in Next.js applications using React Server Components. Designed for CTFs and research, it features a single-command mode, an interactive web CLI, and reverse shell capabilities to demonstrate RCE.", "url": "https://github.com/raivenLockdown/WEB-CLI_RCE_React2Shell" }, { "repository": "PoC-in-GitHub · oguri-souhei/CVE-2025-55182", "author": "oguri-souhei", "first_seen": "2025-12-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 の検証用", "summary": "CVE-2025-55182 の検証用", "url": "https://github.com/oguri-souhei/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · xalgord/React2Shell", "author": "xalgord", "first_seen": "2025-12-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 53, "title": "Advanced Exploitation Toolkit for Next.js Server Actions (CVE-2025-55182)", "summary": "Advanced Exploitation Toolkit for Next.js Server Actions (CVE-2025-55182)", "url": "https://github.com/xalgord/React2Shell" }, { "repository": "PoC-in-GitHub · ryanhafid/PoC_CVE-2025-55182", "author": "ryanhafid", "first_seen": "2025-12-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/ryanhafid/PoC_CVE-2025-55182" }, { "repository": "PoC-in-GitHub · ryanhafid/Scan_CVE-2025-55182", "author": "ryanhafid", "first_seen": "2025-12-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/ryanhafid/Scan_CVE-2025-55182" }, { "repository": "PoC-in-GitHub · gagaltotal/tot-react-rce-CVE-2025-55182", "author": "gagaltotal", "first_seen": "2025-12-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 – CVE-2025-66478 – React2Shell", "summary": "CVE-2025-55182 – CVE-2025-66478 – React2Shell", "url": "https://github.com/gagaltotal/tot-react-rce-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · sho-luv/React2Shell", "author": "sho-luv", "first_seen": "2025-12-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 10, "title": "CVE-2025-55182 security test kit: CLI scanner + Chrome extension + Nuclei templates + Docker lab.", "summary": "CVE-2025-55182 security test kit: CLI scanner + Chrome extension + Nuclei templates + Docker lab.", "url": "https://github.com/sho-luv/React2Shell" }, { "repository": "PoC-in-GitHub · h0tak88r/next88", "author": "h0tak88r", "first_seen": "2025-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "High-performance Go implementation for detecting React Server Components RCE vulnerabilities (CVE-2025-55182 & CVE-2025-66478).", "summary": "High-performance Go implementation for detecting React Server Components RCE vulnerabilities (CVE-2025-55182 & CVE-2025-66478).", "url": "https://github.com/h0tak88r/next88" }, { "repository": "PoC-in-GitHub · TheStingR/ReactOOPS-WriteUp", "author": "TheStingR", "first_seen": "2025-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "Hack The Box Writeup for Retired Challenge ReactOOPS - Complete solution and educational guide to CVE-2025-55182/CVE-2025-66478 (React2Shell RCE). Includes detailed vulnerability analysis, exploitation techniques, and team learning materials.", "summary": "Hack The Box Writeup for Retired Challenge ReactOOPS - Complete solution and educational guide to CVE-2025-55182/CVE-2025-66478 (React2Shell RCE). Includes detailed vulnerability analysis, exploitation techniques, and team learning materials.", "url": "https://github.com/TheStingR/ReactOOPS-WriteUp" }, { "repository": "PoC-in-GitHub · mantvmass/react2shell", "author": "mantvmass", "first_seen": "2025-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "A CLI tool that exploits vulnerabilities in React Server Components and Server Actions (CVE-2025-55182, CVE-2025-66478) to achieve remote code execution (RCE) on vulnerable servers.", "summary": "A CLI tool that exploits vulnerabilities in React Server Components and Server Actions (CVE-2025-55182, CVE-2025-66478) to achieve remote code execution (RCE) on vulnerable servers.", "url": "https://github.com/mantvmass/react2shell" }, { "repository": "PoC-in-GitHub · MoLeft/React2Shell-Toolbox", "author": "MoLeft", "first_seen": "2025-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 37, "title": "A CVE-2025-55182(React2Shell) Toolbox Application", "summary": "A CVE-2025-55182(React2Shell) Toolbox Application", "url": "https://github.com/MoLeft/React2Shell-Toolbox" }, { "repository": "PoC-in-GitHub · Ya0h4cker/CVE-2025-55182", "author": "Ya0h4cker", "first_seen": "2025-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Analysis, Validation Environment, and POC for CVE-225-55182 Vulnerability.", "summary": "Analysis, Validation Environment, and POC for CVE-225-55182 Vulnerability.", "url": "https://github.com/Ya0h4cker/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Kugelbyte/React2Shell-Analysis", "author": "Kugelbyte", "first_seen": "2025-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A research report on CVE-2025-55182 (React2Shell).", "summary": "A research report on CVE-2025-55182 (React2Shell).", "url": "https://github.com/Kugelbyte/React2Shell-Analysis" }, { "repository": "PoC-in-GitHub · dhananjayakumarn/CVE-2025-55182-Lab", "author": "dhananjayakumarn", "first_seen": "2025-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A hands-on lab for understanding and exploiting CVE-2025-55182 (React2Shell) - Remote Code Execution in React Server Components", "summary": "A hands-on lab for understanding and exploiting CVE-2025-55182 (React2Shell) - Remote Code Execution in React Server Components", "url": "https://github.com/dhananjayakumarn/CVE-2025-55182-Lab" }, { "repository": "PoC-in-GitHub · sangleshubham/React-Security-CVE-2025-55182-Exploit", "author": "sangleshubham", "first_seen": "2025-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "NodeJS-based exploit script and scanner for the React Server Components \"React2Shell\" vulnerability (CVE-2025-55182).", "summary": "NodeJS-based exploit script and scanner for the React Server Components \"React2Shell\" vulnerability (CVE-2025-55182).", "url": "https://github.com/sangleshubham/React-Security-CVE-2025-55182-Exploit" }, { "repository": "PoC-in-GitHub · TrixSec/CVE-2025-55182-Scanner", "author": "TrixSec", "first_seen": "2025-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "A hybrid security scanner for detecting CVE-2025-55182 in Next.js and Waku applications. Features combined static code analysis and safe dynamic verification for DevSecOps workflows.", "summary": "A hybrid security scanner for detecting CVE-2025-55182 in Next.js and Waku applications. Features combined static code analysis and safe dynamic verification for DevSecOps workflows.", "url": "https://github.com/TrixSec/CVE-2025-55182-Scanner" }, { "repository": "PoC-in-GitHub · mounta11n/CHECK-CVE-2025-55182-AND-CVE-2025-66478", "author": "mounta11n", "first_seen": "2025-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Check if your server is affected by CVE-2025-55182 & CVE-2025-66478", "summary": "Check if your server is affected by CVE-2025-55182 & CVE-2025-66478", "url": "https://github.com/mounta11n/CHECK-CVE-2025-55182-AND-CVE-2025-66478" }, { "repository": "PoC-in-GitHub · grejh0t/CVE-2025-55182", "author": "grejh0t", "first_seen": "2025-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/grejh0t/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · hidden-investigations/react2shell-vulnlab", "author": "hidden-investigations", "first_seen": "2025-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "A modern Next.js vulnerable web app themed as a news / blog portal for CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) to learn, detect, and safely exercise React2Shell. Runs unpatched React 19.0.0 and Next.js 15.0.3.", "summary": "A modern Next.js vulnerable web app themed as a news / blog portal for CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) to learn, detect, and safely exercise React2Shell. Runs unpatched React 19.0.0 and Next.js 15.0.3.", "url": "https://github.com/hidden-investigations/react2shell-vulnlab" }, { "repository": "PoC-in-GitHub · MammaniNelsonD/React2P4IM0Nshell", "author": "MammaniNelsonD", "first_seen": "2025-12-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "💥Extension Tool para Auditoría y Explotación avanzada RCE/Source Leak/Dos (CVE-2025-55182/83/84) para entornos Next.js y React Server Components (RSC) directamente desde tu navegador + Laboratorio Vulnerable❌", "summary": "💥Extension Tool para Auditoría y Explotación avanzada RCE/Source Leak/Dos (CVE-2025-55182/83/84) para entornos Next.js y React Server Components (RSC) directamente desde tu navegador + Laboratorio Vulnerable❌", "url": "https://github.com/MammaniNelsonD/React2P4IM0Nshell" }, { "repository": "PoC-in-GitHub · tinashelorenzi/CVE-2025-55182", "author": "tinashelorenzi", "first_seen": "2025-12-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/tinashelorenzi/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · ProwlSec/React2Shell", "author": "ProwlSec", "first_seen": "2025-12-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "An advanced command-line framework for discovery, validation, and exploitation of CVE-2025-55182 and CVE-2025-66478 affecting Next.js applications using React Server Components (RSC).", "summary": "An advanced command-line framework for discovery, validation, and exploitation of CVE-2025-55182 and CVE-2025-66478 affecting Next.js applications using React Server Components (RSC).", "url": "https://github.com/ProwlSec/React2Shell" }, { "repository": "PoC-in-GitHub · VVVI5HNU/CVE-2025-55182", "author": "VVVI5HNU", "first_seen": "2025-12-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Proof-of-Concept for CVE-2025-55182, a critical unauthenticated RCE in React Server Components.", "summary": "Proof-of-Concept for CVE-2025-55182, a critical unauthenticated RCE in React Server Components.", "url": "https://github.com/VVVI5HNU/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · CyberPrince-hub/React2shell-ultimate-scanner", "author": "CyberPrince-hub", "first_seen": "2025-12-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182-Advanced-Scanner is an automated security tool designed to detect and validate the CVE-2025-55182 vulnerability efficiently. it helps security researchers and bug bounty hunters quickly identify affected targets with accurate results and minimal false positives.", "summary": "CVE-2025-55182-Advanced-Scanner is an automated security tool designed to detect and validate the CVE-2025-55182 vulnerability efficiently. it helps security researchers and bug bounty hunters quickly identify affected targets with accurate results and minimal false positives.", "url": "https://github.com/CyberPrince-hub/React2shell-ultimate-scanner" }, { "repository": "PoC-in-GitHub · hidden-investigations/react2shell-scanner", "author": "hidden-investigations", "first_seen": "2025-12-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "Precision-Based Detection of RSC/Next.js Remote Code Execution Vulnerabilities (CVE-2025-55182, CVE-2025-66478)", "summary": "Precision-Based Detection of RSC/Next.js Remote Code Execution Vulnerabilities (CVE-2025-55182, CVE-2025-66478)", "url": "https://github.com/hidden-investigations/react2shell-scanner" }, { "repository": "PoC-in-GitHub · mivmi/CVE-2025-55182", "author": "mivmi", "first_seen": "2025-12-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/mivmi/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · subhdotsol/CVE-2025-55182", "author": "subhdotsol", "first_seen": "2025-12-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "This project provides a fully functional demonstration of CVE-2025-55182 (React2Shell) - a critical Remote Code Execution vulnerability in React Server Components and Next.js.", "summary": "This project provides a fully functional demonstration of CVE-2025-55182 (React2Shell) - a critical Remote Code Execution vulnerability in React Server Components and Next.js.", "url": "https://github.com/subhdotsol/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Call123X/-cve-2025-55182", "author": "Call123X", "first_seen": "2025-12-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "cve-2025-55182", "summary": "cve-2025-55182", "url": "https://github.com/Call123X/-cve-2025-55182" }, { "repository": "PoC-in-GitHub · hulh122/CVE-2025-55182", "author": "hulh122", "first_seen": "2025-12-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/hulh122/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · simantchaudhari/CVE-2025-55182", "author": "simantchaudhari", "first_seen": "2025-12-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/simantchaudhari/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · premdanav/react2shelldemo", "author": "premdanav", "first_seen": "2025-12-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This repo contains the scripts you can execute to simulate the (CVE-2025-55182) along with next.js server", "summary": "This repo contains the scripts you can execute to simulate the (CVE-2025-55182) along with next.js server", "url": "https://github.com/premdanav/react2shelldemo" }, { "repository": "PoC-in-GitHub · S-Mughal/NextJS-app-CVE-2025-55182", "author": "S-Mughal", "first_seen": "2025-12-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/S-Mughal/NextJS-app-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · itumo-arigatone/study-CVE-2025-55182", "author": "itumo-arigatone", "first_seen": "2025-12-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "試してみるよん", "summary": "試してみるよん", "url": "https://github.com/itumo-arigatone/study-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · EQSTLab/CVE-2025-55182", "author": "EQSTLab", "first_seen": "2025-12-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "React2Shell", "summary": "React2Shell", "url": "https://github.com/EQSTLab/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · scumfrog/FiberBreak", "author": "scumfrog", "first_seen": "2025-12-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "React2Shell Exploitation Tool (CVE-2025-55182)", "summary": "React2Shell Exploitation Tool (CVE-2025-55182)", "url": "https://github.com/scumfrog/FiberBreak" }, { "repository": "PoC-in-GitHub · d0cnull/nextjs-CVE-2025-55182", "author": "d0cnull", "first_seen": "2025-12-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/d0cnull/nextjs-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Mustafa1p/Next.js-RCE-Scanner---CVE-2025-55182-CVE-2025-66478", "author": "Mustafa1p", "first_seen": "2025-12-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "An advanced vulnerability scanner for detecting **CVE-2025-55182** and **CVE-2025-66478** - critical Remote Code Execution (RCE) vulnerabilities in Next.js applications using React Server Components (RSC).", "summary": "An advanced vulnerability scanner for detecting **CVE-2025-55182** and **CVE-2025-66478** - critical Remote Code Execution (RCE) vulnerabilities in Next.js applications using React Server Components (RSC).", "url": "https://github.com/Mustafa1p/Next.js-RCE-Scanner---CVE-2025-55182-CVE-2025-66478" }, { "repository": "PoC-in-GitHub · M4rgs/CVE-2025-55182-React2Shell-Exploit", "author": "M4rgs", "first_seen": "2025-12-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A proof-of-concept tool for demonstrating the critical React2Shell vulnerability", "summary": "A proof-of-concept tool for demonstrating the critical React2Shell vulnerability", "url": "https://github.com/M4rgs/CVE-2025-55182-React2Shell-Exploit" }, { "repository": "PoC-in-GitHub · nulltrace1336/CVE-2025-55182-Metasploit-exploit-skeleton-real-flow-", "author": "nulltrace1336", "first_seen": "2025-12-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Quyida to‘liq LAB rejasi: demo-vulnerable app → Python PoC → Metasploit exploit skeleton", "summary": "Quyida to‘liq LAB rejasi: demo-vulnerable app → Python PoC → Metasploit exploit skeleton", "url": "https://github.com/nulltrace1336/CVE-2025-55182-Metasploit-exploit-skeleton-real-flow-" }, { "repository": "PoC-in-GitHub · pwnxpl0it/react2shell-lab", "author": "pwnxpl0it", "first_seen": "2025-12-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "React2shell vulnerable lab (CVE-2025-55182)", "summary": "React2shell vulnerable lab (CVE-2025-55182)", "url": "https://github.com/pwnxpl0it/react2shell-lab" }, { "repository": "PoC-in-GitHub · ceh-aditya-raj/CVE-2025-55182", "author": "ceh-aditya-raj", "first_seen": "2025-12-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Proof-of-concept research tool for CVE-2025-55182, a critical unauthenticated RCE in Next.js App Router caused by server-side object injection in React Server Components and Server Actions, including UTF-16LE WAF evasion techniques.", "summary": "Proof-of-concept research tool for CVE-2025-55182, a critical unauthenticated RCE in Next.js App Router caused by server-side object injection in React Server Components and Server Actions, including UTF-16LE WAF evasion techniques.", "url": "https://github.com/ceh-aditya-raj/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · r4j3sh-com/CVE-2025-55182", "author": "r4j3sh-com", "first_seen": "2025-12-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Lightweight Go toolkit plus a Dockerized Next.js lab to explore and triage CVE-2025-55182.", "summary": "Lightweight Go toolkit plus a Dockerized Next.js lab to explore and triage CVE-2025-55182.", "url": "https://github.com/r4j3sh-com/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · degenwithheart/React2Shell-Vulnerability-Verification-Script", "author": "degenwithheart", "first_seen": "2025-12-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "React2Shell Vulnerability Verification Script (React2Shell also known as CVE-2025-55182).", "summary": "React2Shell Vulnerability Verification Script (React2Shell also known as CVE-2025-55182).", "url": "https://github.com/degenwithheart/React2Shell-Vulnerability-Verification-Script" }, { "repository": "PoC-in-GitHub · rashedhasan090/cve-2025-55182-mitigator", "author": "rashedhasan090", "first_seen": "2025-12-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/rashedhasan090/cve-2025-55182-mitigator" }, { "repository": "PoC-in-GitHub · RavinduRathnayaka/CVE-2025-55182-PoC", "author": "RavinduRathnayaka", "first_seen": "2025-12-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "React2Shell (CVE-2025-66478): A Python-based Proof of Concept for Critical Remote Code Execution (RCE) in Next.js Server Components. Features an interactive CLI, custom payload injection, and cleaner output formatting. For educational research only.", "summary": "React2Shell (CVE-2025-66478): A Python-based Proof of Concept for Critical Remote Code Execution (RCE) in Next.js Server Components. Features an interactive CLI, custom payload injection, and cleaner output formatting. For educational research only.", "url": "https://github.com/RavinduRathnayaka/CVE-2025-55182-PoC" }, { "repository": "PoC-in-GitHub · open-flaw/CVE-2025-55182", "author": "open-flaw", "first_seen": "2025-12-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/open-flaw/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · chrahman/react2shell-CVE-2025-55182-full-rce-script", "author": "chrahman", "first_seen": "2025-12-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "React2Shell vulnerability (CVE-2025-55182 / CVE-2025-66478) Full Script", "summary": "React2Shell vulnerability (CVE-2025-55182 / CVE-2025-66478) Full Script", "url": "https://github.com/chrahman/react2shell-CVE-2025-55182-full-rce-script" }, { "repository": "PoC-in-GitHub · lamaper/CVE-2025-55182-Toolbox", "author": "lamaper", "first_seen": "2025-12-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/lamaper/CVE-2025-55182-Toolbox" }, { "repository": "PoC-in-GitHub · mahaveer-choudhary/CVE-2025-55182", "author": "mahaveer-choudhary", "first_seen": "2025-12-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A Python-based security scanner for detecting and exploiting **React Server Components (RSC)** vulnerabilities in Next.js applications. This tool performs passive detection, active fingerprinting, and RCE exploitation testing.", "summary": "A Python-based security scanner for detecting and exploiting **React Server Components (RSC)** vulnerabilities in Next.js applications. This tool performs passive detection, active fingerprinting, and RCE exploitation testing.", "url": "https://github.com/mahaveer-choudhary/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · MeGaNeKoS/secure-by-default-rce-demo", "author": "MeGaNeKoS", "first_seen": "2025-12-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Secure-by-default demo lab showing how container hardening (distroless images, non-root, read-only filesystem, runtime-injected secrets) can neutralize a critical Next.js/React Server Actions RCE (CVE-2025-55182 “React2Shell”), with side-by-side safe vs unsafe deployments and exploit logs", "summary": "Secure-by-default demo lab showing how container hardening (distroless images, non-root, read-only filesystem, runtime-injected secrets) can neutralize a critical Next.js/React Server Actions RCE (CVE-2025-55182 “React2Shell”), with side-by-side safe vs unsafe deployments and exploit logs", "url": "https://github.com/MeGaNeKoS/secure-by-default-rce-demo" }, { "repository": "PoC-in-GitHub · tamagorengs/react2shell-poc-CVE-2025-55182", "author": "tamagorengs", "first_seen": "2025-12-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/tamagorengs/react2shell-poc-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · xxxTectationxxx/React2Shell-CVE-Lab", "author": "xxxTectationxxx", "first_seen": "2025-12-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A self-hosted vulnerable Next.js environment running on Docker for simulating CVE-2025-55182. Built for educational security research and CTF practice.", "summary": "A self-hosted vulnerable Next.js environment running on Docker for simulating CVE-2025-55182. Built for educational security research and CTF practice.", "url": "https://github.com/xxxTectationxxx/React2Shell-CVE-Lab" }, { "repository": "PoC-in-GitHub · vijay-shirhatti/RSC-Detect-CVE-2025-55182", "author": "vijay-shirhatti", "first_seen": "2025-12-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 21, "title": "RSC Detect CVE 2025 55182", "summary": "RSC Detect CVE 2025 55182", "url": "https://github.com/vijay-shirhatti/RSC-Detect-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · p3ta00/react2shell-poc", "author": "p3ta00", "first_seen": "2025-12-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 9, "title": "CVE-2025-55182 React2Shell PoC - Critical RCE in React Server Components / Next.js. CVSS 10.0. Error-based exfil, reverse shell, interactive mode.", "summary": "CVE-2025-55182 React2Shell PoC - Critical RCE in React Server Components / Next.js. CVSS 10.0. Error-based exfil, reverse shell, interactive mode.", "url": "https://github.com/p3ta00/react2shell-poc" }, { "repository": "PoC-in-GitHub · vonuyvicoo/nextploiter", "author": "vonuyvicoo", "first_seen": "2025-12-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "NextJS exploiter for CVE-2025-55182 and more.", "summary": "NextJS exploiter for CVE-2025-55182 and more.", "url": "https://github.com/vonuyvicoo/nextploiter" }, { "repository": "PoC-in-GitHub · niokagi/react-cve-2025-55182", "author": "niokagi", "first_seen": "2025-12-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Test & Analyze the CVE-2025-55182 vulnerability within Next.js Server Actions", "summary": "Test & Analyze the CVE-2025-55182 vulnerability within Next.js Server Actions", "url": "https://github.com/niokagi/react-cve-2025-55182" }, { "repository": "PoC-in-GitHub · knightwolf01/React2Shell", "author": "knightwolf01", "first_seen": "2025-12-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "React2Shell Critical Vulnerability (CVE-2025-55182)", "summary": "React2Shell Critical Vulnerability (CVE-2025-55182)", "url": "https://github.com/knightwolf01/React2Shell" }, { "repository": "PoC-in-GitHub · BlackTechX011/React2Shell", "author": "BlackTechX011", "first_seen": "2025-12-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 12, "title": "React2Shell: An exploitation framework for CVE-2025-55182 (Next.js/React RCE).", "summary": "React2Shell: An exploitation framework for CVE-2025-55182 (Next.js/React RCE).", "url": "https://github.com/BlackTechX011/React2Shell" }, { "repository": "PoC-in-GitHub · S3cr3t-SDN/React4Shell", "author": "S3cr3t-SDN", "first_seen": "2025-12-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Exploit Code for React2Shell RCE vulnerability (CVE-2025-55182) affecting React Server Components 19.0.0-19.2.0. Exploits unsafe deserialization for unauthenticated remote code execution.", "summary": "Exploit Code for React2Shell RCE vulnerability (CVE-2025-55182) affecting React Server Components 19.0.0-19.2.0. Exploits unsafe deserialization for unauthenticated remote code execution.", "url": "https://github.com/S3cr3t-SDN/React4Shell" }, { "repository": "PoC-in-GitHub · ckex/test-vuln", "author": "ckex", "first_seen": "2025-12-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "a controlled environment to test CVE-2025-55182.", "summary": "a controlled environment to test CVE-2025-55182.", "url": "https://github.com/ckex/test-vuln" }, { "repository": "PoC-in-GitHub · jensnesten/React2Shell-PoC", "author": "jensnesten", "first_seen": "2025-12-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "RCE exploit PoC for CVE-2025-55182 and CVE-2025-66478 in Next.js and React Server Components with scanner and exploitation tools.", "summary": "RCE exploit PoC for CVE-2025-55182 and CVE-2025-66478 in Next.js and React Server Components with scanner and exploitation tools.", "url": "https://github.com/jensnesten/React2Shell-PoC" }, { "repository": "PoC-in-GitHub · Farhan9488/CVE-2025-55182-research", "author": "Farhan9488", "first_seen": "2025-12-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "🛡️ Explore CVE-2025-55182, a critical RCE vulnerability in React's Flight Protocol, demonstrating exploitation techniques and mitigation strategies.", "summary": "🛡️ Explore CVE-2025-55182, a critical RCE vulnerability in React's Flight Protocol, demonstrating exploitation techniques and mitigation strategies.", "url": "https://github.com/Farhan9488/CVE-2025-55182-research" }, { "repository": "PoC-in-GitHub · bigbluewhale111/CVE-2025-55182-LAB", "author": "bigbluewhale111", "first_seen": "2025-12-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This is a lab for reproducing CVE-2025-55182.", "summary": "This is a lab for reproducing CVE-2025-55182.", "url": "https://github.com/bigbluewhale111/CVE-2025-55182-LAB" }, { "repository": "PoC-in-GitHub · guiimoraes/react2shell-evolved", "author": "guiimoraes", "first_seen": "2025-12-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "A evolved version of assetnote CVE-2025-55182 scanner", "summary": "A evolved version of assetnote CVE-2025-55182 scanner", "url": "https://github.com/guiimoraes/react2shell-evolved" }, { "repository": "PoC-in-GitHub · itsismarcos/Bot-exploit-CVE-2025-55182", "author": "itsismarcos", "first_seen": "2025-12-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Mass Bot Exploit", "summary": "Mass Bot Exploit", "url": "https://github.com/itsismarcos/Bot-exploit-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · 0xROI/CVE-2025-55182", "author": "0xROI", "first_seen": "2025-12-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Exploitation script for CVE-2025-55182. This is modified only for my personal use. If you are facing any problem fix it yourself.", "summary": "Exploitation script for CVE-2025-55182. This is modified only for my personal use. If you are facing any problem fix it yourself.", "url": "https://github.com/0xROI/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Updatelap/CVE-2025-55182", "author": "Updatelap", "first_seen": "2025-12-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "React2Shell Scanner", "summary": "React2Shell Scanner", "url": "https://github.com/Updatelap/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · kanyokoo/React-Server-Components-Remote-Code-Execution-CVE-2025-55182-", "author": "kanyokoo", "first_seen": "2025-12-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "script to help solve the lab on hackviser covering (CVE-2025-55182)", "summary": "script to help solve the lab on hackviser covering (CVE-2025-55182)", "url": "https://github.com/kanyokoo/React-Server-Components-Remote-Code-Execution-CVE-2025-55182-" }, { "repository": "PoC-in-GitHub · KingHacker353/R2C-CVE-2025-55182-66478", "author": "KingHacker353", "first_seen": "2025-12-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/KingHacker353/R2C-CVE-2025-55182-66478" }, { "repository": "PoC-in-GitHub · amirali-ramezani/react2shell-CVE-2025-55182-", "author": "amirali-ramezani", "first_seen": "2025-12-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/amirali-ramezani/react2shell-CVE-2025-55182-" }, { "repository": "PoC-in-GitHub · git0xLai/React2ShellPoC", "author": "git0xLai", "first_seen": "2025-12-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This repository provides a proof-of-concept for CVE-2025-55182 (React2Shell), a remote code execution vulnerability in React Server Components. It demonstrates how the exploit works, including the payload and impact.", "summary": "This repository provides a proof-of-concept for CVE-2025-55182 (React2Shell), a remote code execution vulnerability in React Server Components. It demonstrates how the exploit works, including the payload and impact.", "url": "https://github.com/git0xLai/React2ShellPoC" }, { "repository": "PoC-in-GitHub · hndko/react2shell-rce-autobot", "author": "hndko", "first_seen": "2025-12-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "🎯 Automated vulnerability scanner for React2Shell RCE - Google dorking + safe detection for CVE-2025-55182/CVE-2025-66478 (CVSS 10.0)", "summary": "🎯 Automated vulnerability scanner for React2Shell RCE - Google dorking + safe detection for CVE-2025-55182/CVE-2025-66478 (CVSS 10.0)", "url": "https://github.com/hndko/react2shell-rce-autobot" }, { "repository": "PoC-in-GitHub · Goultarde/CVE-2025-55182-React2Shell-Lab", "author": "Goultarde", "first_seen": "2025-12-31", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/Goultarde/CVE-2025-55182-React2Shell-Lab" }, { "repository": "PoC-in-GitHub · xiaoLvChen/CVE-2025-55182", "author": "xiaoLvChen", "first_seen": "2026-01-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182（React Server Components 反序列化远程代码执行漏洞）", "summary": "CVE-2025-55182（React Server Components 反序列化远程代码执行漏洞）", "url": "https://github.com/xiaoLvChen/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · captain4554/CVE-2025-55182-Scanner", "author": "captain4554", "first_seen": "2026-01-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "🛡️ Scan and assess vulnerabilities in Next.js/Waku with the CVE-2025-55182-Scanner, combining static and dynamic analysis for robust security.", "summary": "🛡️ Scan and assess vulnerabilities in Next.js/Waku with the CVE-2025-55182-Scanner, combining static and dynamic analysis for robust security.", "url": "https://github.com/captain4554/CVE-2025-55182-Scanner" }, { "repository": "PoC-in-GitHub · captain4554/captain4554.github.io", "author": "captain4554", "first_seen": "2026-01-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "🔍 Scan for CVE-2025-55182 vulnerabilities with a hybrid tool that combines static and dynamic analysis for improved security assessments.", "summary": "🔍 Scan for CVE-2025-55182 vulnerabilities with a hybrid tool that combines static and dynamic analysis for improved security assessments.", "url": "https://github.com/captain4554/captain4554.github.io" }, { "repository": "PoC-in-GitHub · ghostn4444/CVE-2025-55182", "author": "ghostn4444", "first_seen": "2026-01-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 - Tool React2Shell", "summary": "CVE-2025-55182 - Tool React2Shell", "url": "https://github.com/ghostn4444/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · HackIndex-io/React2Shell-CVE-2025-55182", "author": "HackIndex-io", "first_seen": "2026-01-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A HackIndex.io sandbox environment for the React2Shell vulnerability.", "summary": "A HackIndex.io sandbox environment for the React2Shell vulnerability.", "url": "https://github.com/HackIndex-io/React2Shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · rahuulmiishra/react2shell-CVE-2025-55182", "author": "rahuulmiishra", "first_seen": "2026-01-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/rahuulmiishra/react2shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · m3ngx1ng/CVE-2025-55182-GUI", "author": "m3ngx1ng", "first_seen": "2026-01-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 漏洞检测与利用工具（GUI版）", "summary": "CVE-2025-55182 漏洞检测与利用工具（GUI版）", "url": "https://github.com/m3ngx1ng/CVE-2025-55182-GUI" }, { "repository": "PoC-in-GitHub · joaovicdev/EXPLOIT-CVE-2025-55182", "author": "joaovicdev", "first_seen": "2026-01-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/joaovicdev/EXPLOIT-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · AdityaBhatt3010/React2Shell-CVE-2025-55182", "author": "AdityaBhatt3010", "first_seen": "2026-01-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "React2Shell CVE-2025-55182: unauthenticated unsafe deserialization in React Server Components leading to reliable remote code execution via the Flight protocol.", "summary": "React2Shell CVE-2025-55182: unauthenticated unsafe deserialization in React Server Components leading to reliable remote code execution via the Flight protocol.", "url": "https://github.com/AdityaBhatt3010/React2Shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · gahoole77/gahoole77.github.io", "author": "gahoole77", "first_seen": "2026-01-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "🔍 Discover and scan vulnerable Next.js instances to protect your infrastructure from critical RCE vulnerabilities like CVE-2025-55182.", "summary": "🔍 Discover and scan vulnerable Next.js instances to protect your infrastructure from critical RCE vulnerabilities like CVE-2025-55182.", "url": "https://github.com/gahoole77/gahoole77.github.io" }, { "repository": "PoC-in-GitHub · lucyz1125/CVE-2025-55182-Next.js-RCE", "author": "lucyz1125", "first_seen": "2026-01-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Nextjs RCE Exploit", "summary": "Nextjs RCE Exploit", "url": "https://github.com/lucyz1125/CVE-2025-55182-Next.js-RCE" }, { "repository": "PoC-in-GitHub · hyan0116/Next.js-RCE-CVE-2025-55182", "author": "hyan0116", "first_seen": "2026-01-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "next.js rce exploit", "summary": "next.js rce exploit", "url": "https://github.com/hyan0116/Next.js-RCE-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · MyCompanyOrganization/React2Shell-Kingdom", "author": "MyCompanyOrganization", "first_seen": "2026-01-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "\"Once upon a time, the Castle of Reactland trusted all Flight messages... until The Imposter arrived.\" A storytelling CVE-2025-55182 (React2Shell) demo - Medieval-themed vulnerable React Server Components app for security education.", "summary": "\"Once upon a time, the Castle of Reactland trusted all Flight messages... until The Imposter arrived.\" A storytelling CVE-2025-55182 (React2Shell) demo - Medieval-themed vulnerable React Server Components app for security education.", "url": "https://github.com/MyCompanyOrganization/React2Shell-Kingdom" }, { "repository": "PoC-in-GitHub · yannisduvignau/react2shell-exploit", "author": "yannisduvignau", "first_seen": "2026-01-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182, also known as React2Shell, is a critical vulnerability affecting Next.js applications using React Server Components (RSC) and Server Actions.", "summary": "CVE-2025-55182, also known as React2Shell, is a critical vulnerability affecting Next.js applications using React Server Components (RSC) and Server Actions.", "url": "https://github.com/yannisduvignau/react2shell-exploit" }, { "repository": "PoC-in-GitHub · en0f/CVE-2025-55182-poc-json", "author": "en0f", "first_seen": "2026-01-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182-poc-json", "summary": "CVE-2025-55182-poc-json", "url": "https://github.com/en0f/CVE-2025-55182-poc-json" }, { "repository": "PoC-in-GitHub · momika233/CVE-2025-55182-bypass", "author": "momika233", "first_seen": "2026-01-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 31, "title": "CVE-2025-55182-bypass-waf", "summary": "CVE-2025-55182-bypass-waf", "url": "https://github.com/momika233/CVE-2025-55182-bypass" }, { "repository": "PoC-in-GitHub · mooowu/cve-2025-55182-poc", "author": "mooowu", "first_seen": "2026-01-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/mooowu/cve-2025-55182-poc" }, { "repository": "PoC-in-GitHub · Faithtiannn/CVE-2025-55182", "author": "Faithtiannn", "first_seen": "2026-01-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-55182漏洞检测工具", "summary": "CVE-2025-55182漏洞检测工具", "url": "https://github.com/Faithtiannn/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · termireum/react2shell", "author": "termireum", "first_seen": "2026-01-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "React2Shell is a high-performance vulnerability scanner written in Go, specifically designed to detect Server-Side Remote Code Execution (RCE) vulnerabilities in Next.js applications (CVE-2025-55182 & CVE-2025-66478).", "summary": "React2Shell is a high-performance vulnerability scanner written in Go, specifically designed to detect Server-Side Remote Code Execution (RCE) vulnerabilities in Next.js applications (CVE-2025-55182 & CVE-2025-66478).", "url": "https://github.com/termireum/react2shell" }, { "repository": "PoC-in-GitHub · Least-Significant-Bit/CVE-2025-55182", "author": "Least-Significant-Bit", "first_seen": "2026-01-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Remote code execution for React Server Components 19.0.0 - 19.2.0", "summary": "Remote code execution for React Server Components 19.0.0 - 19.2.0", "url": "https://github.com/Least-Significant-Bit/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · faisha1311/React2Shell-CVE-2025-55182-TryHackMe", "author": "faisha1311", "first_seen": "2026-01-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/faisha1311/React2Shell-CVE-2025-55182-TryHackMe" }, { "repository": "PoC-in-GitHub · BBD-YZZ/CVE-2025-55182", "author": "BBD-YZZ", "first_seen": "2026-01-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182(命令执行、反弹shell、注入内存马)", "summary": "CVE-2025-55182(命令执行、反弹shell、注入内存马)", "url": "https://github.com/BBD-YZZ/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Vladjrfhfg/React-site-CVE-2025-55182", "author": "Vladjrfhfg", "first_seen": "2026-01-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/Vladjrfhfg/React-site-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Namsom007/CVE-2025-55182-Exploit", "author": "Namsom007", "first_seen": "2026-01-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 React Server Components Remote Code Execution Exploit Lab", "summary": "CVE-2025-55182 React Server Components Remote Code Execution Exploit Lab", "url": "https://github.com/Namsom007/CVE-2025-55182-Exploit" }, { "repository": "PoC-in-GitHub · MemerGamer/CVE-2025-55182", "author": "MemerGamer", "first_seen": "2026-01-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-55182", "summary": "CVE-2025-55182", "url": "https://github.com/MemerGamer/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Sairbo/Unihackers---CVE-2025-55182-", "author": "Sairbo", "first_seen": "2026-01-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/Sairbo/Unihackers---CVE-2025-55182-" }, { "repository": "PoC-in-GitHub · AsadAhmad-1337/React-2-Shell", "author": "AsadAhmad-1337", "first_seen": "2026-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "This is a security exploit tool targeting CVE-2025-55182. It exploits a Remote Code Execution (RCE) vulnerability in React Server Components", "summary": "This is a security exploit tool targeting CVE-2025-55182. It exploits a Remote Code Execution (RCE) vulnerability in React Server Components", "url": "https://github.com/AsadAhmad-1337/React-2-Shell" }, { "repository": "PoC-in-GitHub · deepankarkumar1/CVE-2025-55182_Vulnerable-Application", "author": "deepankarkumar1", "first_seen": "2026-01-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/deepankarkumar1/CVE-2025-55182_Vulnerable-Application" }, { "repository": "PoC-in-GitHub · wnaspy/CVE-2025-55182", "author": "wnaspy", "first_seen": "2026-01-31", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "React2shell exploit (CVE-2025-55182+CVE-2025-66478)", "summary": "React2shell exploit (CVE-2025-55182+CVE-2025-66478)", "url": "https://github.com/wnaspy/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · woorifisa-service-dev-6th/tech-seminar-React2Shell", "author": "woorifisa-service-dev-6th", "first_seen": "2026-02-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "[우리 FISA] 기술 세미나 우승 - 클라우드 서비스 개발 6기 3팀 - React2Shell (CVE-2025-55182) 분석 및 연구", "summary": "[우리 FISA] 기술 세미나 우승 - 클라우드 서비스 개발 6기 3팀 - React2Shell (CVE-2025-55182) 분석 및 연구", "url": "https://github.com/woorifisa-service-dev-6th/tech-seminar-React2Shell" }, { "repository": "PoC-in-GitHub · MuhammadUwais/React2Shell", "author": "MuhammadUwais", "first_seen": "2026-02-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "A Firefox extension for detecting React2Shell vulnerabilities (CVE-2025-55182 & CVE-2025-66478) in web applications.", "summary": "A Firefox extension for detecting React2Shell vulnerabilities (CVE-2025-55182 & CVE-2025-66478) in web applications.", "url": "https://github.com/MuhammadUwais/React2Shell" }, { "repository": "PoC-in-GitHub · Evillm/CVE-2025-55182-PoC", "author": "Evillm", "first_seen": "2026-02-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/Evillm/CVE-2025-55182-PoC" }, { "repository": "PoC-in-GitHub · BrianLopezM99/react2shell-CVE-2025-55182", "author": "BrianLopezM99", "first_seen": "2026-02-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "An exploitation tool for the Next.js vulnerability CVE-2025-55182 that allows remote command execution through a poisoning prototype in React Server Components.", "summary": "An exploitation tool for the Next.js vulnerability CVE-2025-55182 that allows remote command execution through a poisoning prototype in React Server Components.", "url": "https://github.com/BrianLopezM99/react2shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · George0Papasotiriou/CVE-2025-55182-React2Shell-CVSS-10.0-", "author": "George0Papasotiriou", "first_seen": "2026-02-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/George0Papasotiriou/CVE-2025-55182-React2Shell-CVSS-10.0-" }, { "repository": "PoC-in-GitHub · snipevx/React2Shell-POC", "author": "snipevx", "first_seen": "2026-02-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "React2Shell (CVE-2025-55182) POC", "summary": "React2Shell (CVE-2025-55182) POC", "url": "https://github.com/snipevx/React2Shell-POC" }, { "repository": "PoC-in-GitHub · BIG02-bot/React2Shell-CVE-2025-55182-An-lise-T-cnica", "author": "BIG02-bot", "first_seen": "2026-02-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/BIG02-bot/React2Shell-CVE-2025-55182-An-lise-T-cnica" }, { "repository": "PoC-in-GitHub · Wyl-cmd/CVE-2025-55182", "author": "Wyl-cmd", "first_seen": "2026-02-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "针对 Next.js 原型污染漏洞 (CVE-2025-55182) 的高效批量检测工具。", "summary": "针对 Next.js 原型污染漏洞 (CVE-2025-55182) 的高效批量检测工具。", "url": "https://github.com/Wyl-cmd/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · H4R335HR/reactshell", "author": "H4R335HR", "first_seen": "2026-02-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Interactive shell client for React Server Components RCE exploitation via __proto__ pollution (CVE-2025-55182)", "summary": "Interactive shell client for React Server Components RCE exploitation via __proto__ pollution (CVE-2025-55182)", "url": "https://github.com/H4R335HR/reactshell" }, { "repository": "PoC-in-GitHub · orgito1015/CVE-2025-55182-Researching-process", "author": "orgito1015", "first_seen": "2026-02-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/orgito1015/CVE-2025-55182-Researching-process" }, { "repository": "PoC-in-GitHub · 0xBlackash/CVE-2025-55182", "author": "0xBlackash", "first_seen": "2026-02-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182", "summary": "CVE-2025-55182", "url": "https://github.com/0xBlackash/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · alptexans/RSC-Detect-CVE-2025-55182", "author": "alptexans", "first_seen": "2026-02-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 190, "title": "RSC Detect CVE 2025 55182", "summary": "RSC Detect CVE 2025 55182", "url": "https://github.com/alptexans/RSC-Detect-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · MrMahile/MassScanning-CVE-2025-55182", "author": "MrMahile", "first_seen": "2026-02-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A lightweight orchestrator and worker scanner setup for running large/continuous scans across split input files. This repository contains orchestration scripts, a Docker-based worker image, and helper scripts to run scans repeatedly and collect results.", "summary": "A lightweight orchestrator and worker scanner setup for running large/continuous scans across split input files. This repository contains orchestration scripts, a Docker-based worker image, and helper scripts to run scans repeatedly and collect results.", "url": "https://github.com/MrMahile/MassScanning-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · androidteacher/REACT-CVE-2025-55182-Lab", "author": "androidteacher", "first_seen": "2026-02-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Lab with PoC", "summary": "Lab with PoC", "url": "https://github.com/androidteacher/REACT-CVE-2025-55182-Lab" }, { "repository": "PoC-in-GitHub · InferiorAK/CVE-2025-55182-React2Shell-Async-Scanner", "author": "InferiorAK", "first_seen": "2026-02-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "Async RCE scanner for CVE-2025-55182 / CVE-2025-66478 — prototype-pollution → code execution via React Server Actions.", "summary": "Async RCE scanner for CVE-2025-55182 / CVE-2025-66478 — prototype-pollution → code execution via React Server Actions.", "url": "https://github.com/InferiorAK/CVE-2025-55182-React2Shell-Async-Scanner" }, { "repository": "PoC-in-GitHub · luoqichen/CVE-2025-55182-POC", "author": "luoqichen", "first_seen": "2026-03-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/luoqichen/CVE-2025-55182-POC" }, { "repository": "PoC-in-GitHub · lutraat/CVE-2025-55182-React-RSC-Exploit", "author": "lutraat", "first_seen": "2026-03-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Basic Proof of Concept (Poc) Exploit for React RSC - CVE-2025-55182", "summary": "Basic Proof of Concept (Poc) Exploit for React RSC - CVE-2025-55182", "url": "https://github.com/lutraat/CVE-2025-55182-React-RSC-Exploit" }, { "repository": "PoC-in-GitHub · monarchfish/cve-2025-55182-poc", "author": "monarchfish", "first_seen": "2026-03-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Proof-of-concept for CVE-2025-55182 (React2Shell): unauthenticated RCE in React Server Components / Next.js via Flight protocol deserialization.", "summary": "Proof-of-concept for CVE-2025-55182 (React2Shell): unauthenticated RCE in React Server Components / Next.js via Flight protocol deserialization.", "url": "https://github.com/monarchfish/cve-2025-55182-poc" }, { "repository": "PoC-in-GitHub · nexxp90/CVE-2025-55182_RCE_Exploit", "author": "nexxp90", "first_seen": "2026-03-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "REC Exploit is a Python-based security testing tool that automates detection of potential RCE conditions in web applications under authorized environments. It sends crafted POST requests to targets, analyzes server responses for execution indicators, and supports batch scanning with custom input, structured payload handling, and clear CLI output.", "summary": "REC Exploit is a Python-based security testing tool that automates detection of potential RCE conditions in web applications under authorized environments. It sends crafted POST requests to targets, analyzes server responses for execution indicators, and supports batch scanning with custom input, structured payload handling, and clear CLI output.", "url": "https://github.com/nexxp90/CVE-2025-55182_RCE_Exploit" }, { "repository": "PoC-in-GitHub · luoluoqingge/CVE-2025-55182", "author": "luoluoqingge", "first_seen": "2026-03-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/luoluoqingge/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · RyosukeDTomita/CVE-2025-55182", "author": "RyosukeDTomita", "first_seen": "2026-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 — React2Shell", "summary": "CVE-2025-55182 — React2Shell", "url": "https://github.com/RyosukeDTomita/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · eagle-nett/React2Shell-PoC-CVE-2025-55182", "author": "eagle-nett", "first_seen": "2026-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Khai thác lỗ hổng bảo mật CVE-2025-55182", "summary": "Khai thác lỗ hổng bảo mật CVE-2025-55182", "url": "https://github.com/eagle-nett/React2Shell-PoC-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · devianntsec/CVE-2025-55182", "author": "devianntsec", "first_seen": "2026-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Advanced security research on CVE-2025-55182 (React2Shell). Features an exploitation framework with 6 functional impact scenarios (RCE to Secret Exfiltration), an interactive reverse shell, and a complete laboratory. Portfolio piece demonstrating deep analysis of Prototype Pollution and Insecure Deserialization in React Server Components", "summary": "Advanced security research on CVE-2025-55182 (React2Shell). Features an exploitation framework with 6 functional impact scenarios (RCE to Secret Exfiltration), an interactive reverse shell, and a complete laboratory. Portfolio piece demonstrating deep analysis of Prototype Pollution and Insecure Deserialization in React Server Components", "url": "https://github.com/devianntsec/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · l0lsec/cve-2025-55182-lab", "author": "l0lsec", "first_seen": "2026-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Intentionally vulnerable Next.js RSC Docker lab for CVE-2025-55182 (React2Shell) local testing", "summary": "Intentionally vulnerable Next.js RSC Docker lab for CVE-2025-55182 (React2Shell) local testing", "url": "https://github.com/l0lsec/cve-2025-55182-lab" }, { "repository": "PoC-in-GitHub · 0x0asif/CVE-2025-55182", "author": "0x0asif", "first_seen": "2026-03-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/0x0asif/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · amikanev/CVE-2025-55182-LAB", "author": "amikanev", "first_seen": "2026-03-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/amikanev/CVE-2025-55182-LAB" }, { "repository": "PoC-in-GitHub · hujiaozhuzhu/CVE-2025-55182_liyon", "author": "hujiaozhuzhu", "first_seen": "2026-04-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182", "summary": "CVE-2025-55182", "url": "https://github.com/hujiaozhuzhu/CVE-2025-55182_liyon" }, { "repository": "PoC-in-GitHub · aliksir/nextjs-security-scanner", "author": "aliksir", "first_seen": "2026-04-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Bash script to detect CVE-2025-55182 (React2Shell) and credential exposure in Next.js projects. Zero dependencies.", "summary": "Bash script to detect CVE-2025-55182 (React2Shell) and credential exposure in Next.js projects. Zero dependencies.", "url": "https://github.com/aliksir/nextjs-security-scanner" }, { "repository": "PoC-in-GitHub · porsellaj/cve-2025-55182-react2shell-analysis", "author": "porsellaj", "first_seen": "2026-04-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Technical analysis of CVE-2025-55182 (React2Shell RCE vulnerability)", "summary": "Technical analysis of CVE-2025-55182 (React2Shell RCE vulnerability)", "url": "https://github.com/porsellaj/cve-2025-55182-react2shell-analysis" }, { "repository": "PoC-in-GitHub · masterwok/PoC-CVE-2025-55182", "author": "masterwok", "first_seen": "2026-04-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 (React2Shell) PoC: Unauthenticated RCE affecting React 19.x and Next.js < 15.1.4. Exploits vulnerabilities in the RSC Flight protocol.", "summary": "CVE-2025-55182 (React2Shell) PoC: Unauthenticated RCE affecting React 19.x and Next.js < 15.1.4. Exploits vulnerabilities in the RSC Flight protocol.", "url": "https://github.com/masterwok/PoC-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · kaxm23/CVE-2025-55182-Auto-Scanner", "author": "kaxm23", "first_seen": "2026-04-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 Auto Scanner - Improved Version For authorized CTF/testing purposes only", "summary": "CVE-2025-55182 Auto Scanner - Improved Version For authorized CTF/testing purposes only", "url": "https://github.com/kaxm23/CVE-2025-55182-Auto-Scanner" }, { "repository": "PoC-in-GitHub · kaxm23/rust-cve-2025-55182-scanner", "author": "kaxm23", "first_seen": "2026-04-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "powerfull rust cve-2025-55182-scanner used for ctf & ethical purpose only", "summary": "powerfull rust cve-2025-55182-scanner used for ctf & ethical purpose only", "url": "https://github.com/kaxm23/rust-cve-2025-55182-scanner" }, { "repository": "PoC-in-GitHub · RewantChaudhari/nextjs-rce-incident-response", "author": "RewantChaudhari", "first_seen": "2026-04-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Real-world incident response for CVE-2025-55182 (React2Shell) — script injection, server remediation, and post-incident report", "summary": "Real-world incident response for CVE-2025-55182 (React2Shell) — script injection, server remediation, and post-incident report", "url": "https://github.com/RewantChaudhari/nextjs-rce-incident-response" }, { "repository": "PoC-in-GitHub · oscar-mine/R2SAE", "author": "oscar-mine", "first_seen": "2026-04-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Firefox extension for detecting and exploiting CVE-2025-55182 — Prototype Pollution RCE in Next.js React Server Actions", "summary": "Firefox extension for detecting and exploiting CVE-2025-55182 — Prototype Pollution RCE in Next.js React Server Actions", "url": "https://github.com/oscar-mine/R2SAE" }, { "repository": "PoC-in-GitHub · AbdullahMaqbool22/Explosive-As-Hell-MCS-Qualifer-Web-500", "author": "AbdullahMaqbool22", "first_seen": "2026-04-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "[First-Blood-XO] React Server Component endpoint vulnerable to CVE-2025-55182 (RCE) → enumerated SUID binaries → /usr/bin/perl had SUID set → used Perl's POSIX setuid(0) to escalate to root → read /root/flag.txt", "summary": "[First-Blood-XO] React Server Component endpoint vulnerable to CVE-2025-55182 (RCE) → enumerated SUID binaries → /usr/bin/perl had SUID set → used Perl's POSIX setuid(0) to escalate to root → read /root/flag.txt", "url": "https://github.com/AbdullahMaqbool22/Explosive-As-Hell-MCS-Qualifer-Web-500" }, { "repository": "PoC-in-GitHub · DeDnY/CVE-2025-55182-poc-panel", "author": "DeDnY", "first_seen": "2026-04-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This is a special panel that is used to send POC requests with the output of responses.", "summary": "This is a special panel that is used to send POC requests with the output of responses.", "url": "https://github.com/DeDnY/CVE-2025-55182-poc-panel" }, { "repository": "PoC-in-GitHub · opsecramdan/react2shell-cve-2025-55182", "author": "opsecramdan", "first_seen": "2026-04-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/opsecramdan/react2shell-cve-2025-55182" }, { "repository": "PoC-in-GitHub · Mohamedniane/cve-2025-55182-analysis", "author": "Mohamedniane", "first_seen": "2026-04-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Security research & exploitation analysis of CVE-2025-55182 (React) — CVSS + OWASP Top 10 mapping", "summary": "Security research & exploitation analysis of CVE-2025-55182 (React) — CVSS + OWASP Top 10 mapping", "url": "https://github.com/Mohamedniane/cve-2025-55182-analysis" }, { "repository": "PoC-in-GitHub · joaoreis13/flight-risk", "author": "joaoreis13", "first_seen": "2026-04-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Security toolkit for CVE-2025-55182 (React2Shell) — scan, detect, correlate, and test React Server Components RCE vulnerability", "summary": "Security toolkit for CVE-2025-55182 (React2Shell) — scan, detect, correlate, and test React Server Components RCE vulnerability", "url": "https://github.com/joaoreis13/flight-risk" }, { "repository": "PoC-in-GitHub · shibaaa204/React2Shell", "author": "shibaaa204", "first_seen": "2026-04-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Poc for React2Shell CVE-2025-55182", "summary": "Poc for React2Shell CVE-2025-55182", "url": "https://github.com/shibaaa204/React2Shell" }, { "repository": "PoC-in-GitHub · Cybersecurity-Enthusiasts-CE/CVE-2025-55182-Researching-process", "author": "Cybersecurity-Enthusiasts-CE", "first_seen": "2026-04-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/Cybersecurity-Enthusiasts-CE/CVE-2025-55182-Researching-process" }, { "repository": "PoC-in-GitHub · MuharremK0/Info-Sys-Security-CVE-2025-55182", "author": "MuharremK0", "first_seen": "2026-05-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/MuharremK0/Info-Sys-Security-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · ycseo-git/CVE-2025-55182", "author": "ycseo-git", "first_seen": "2026-05-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "a.k.a. React2Shell", "summary": "a.k.a. React2Shell", "url": "https://github.com/ycseo-git/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Industri4l-H3ll-Xpl0it3rs/CVE-2025-55182-React2Shell", "author": "Industri4l-H3ll-Xpl0it3rs", "first_seen": "2026-05-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 Exploit | by infrar3d", "summary": "CVE-2025-55182 Exploit | by infrar3d", "url": "https://github.com/Industri4l-H3ll-Xpl0it3rs/CVE-2025-55182-React2Shell" }, { "repository": "PoC-in-GitHub · renewablehacking/CVE-2025-55182-React-19.2.0", "author": "renewablehacking", "first_seen": "2026-05-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/renewablehacking/CVE-2025-55182-React-19.2.0" }, { "repository": "PoC-in-GitHub · SpeatX/React2Shell-CVE-2025-55182", "author": "SpeatX", "first_seen": "2026-05-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-55182 — Unauthenticated RCE in React Server Components (React2Shell). CVSS 10.0 exploit tool for authorized penetration testing.", "summary": "CVE-2025-55182 — Unauthenticated RCE in React Server Components (React2Shell). CVSS 10.0 exploit tool for authorized penetration testing.", "url": "https://github.com/SpeatX/React2Shell-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · w3nch/CVE-2025-55182-in-go", "author": "w3nch", "first_seen": "2026-05-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/w3nch/CVE-2025-55182-in-go" }, { "repository": "PoC-in-GitHub · Jenderal92/CVE-2025-55182-React2shell", "author": "Jenderal92", "first_seen": "2026-05-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "CVE-2025-55182 Exploit Tool – Python 2.7 exploit for Next.js prototype pollution leading to RCE", "summary": "CVE-2025-55182 Exploit Tool – Python 2.7 exploit for Next.js prototype pollution leading to RCE", "url": "https://github.com/Jenderal92/CVE-2025-55182-React2shell" }, { "repository": "PoC-in-GitHub · Jeanback1/react-rsc-cve-2025-55182-lab", "author": "Jeanback1", "first_seen": "2026-05-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Educational lab demonstrating CVE-2025-55182: Critical RCE in React Server Components via prototype pollution in the Flight protocol", "summary": "Educational lab demonstrating CVE-2025-55182: Critical RCE in React Server Components via prototype pollution in the Flight protocol", "url": "https://github.com/Jeanback1/react-rsc-cve-2025-55182-lab" }, { "repository": "PoC-in-GitHub · sonnycroco/HTB-Reactor-Linux-Machine-Walkthrough", "author": "sonnycroco", "first_seen": "2026-05-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Full walkthrough of HTB's Reactor machine — exploit CVE-2025-55182 to gain a shell, then get root via an exposed Node.js debugger. Step-by-step with screenshots.", "summary": "Full walkthrough of HTB's Reactor machine — exploit CVE-2025-55182 to gain a shell, then get root via an exposed Node.js debugger. Step-by-step with screenshots.", "url": "https://github.com/sonnycroco/HTB-Reactor-Linux-Machine-Walkthrough" }, { "repository": "PoC-in-GitHub · LuizHenz/PoC-CVE-2025-55182", "author": "LuizHenz", "first_seen": "2026-05-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/LuizHenz/PoC-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · hakkuri01/r2rs", "author": "hakkuri01", "first_seen": "2026-05-31", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Interactive Ruby shell for authorized CVE-2025-55182 (react2shell) testing", "summary": "Interactive Ruby shell for authorized CVE-2025-55182 (react2shell) testing", "url": "https://github.com/hakkuri01/r2rs" }, { "repository": "PoC-in-GitHub · tanvirahmedcs/CVE-2025-55182", "author": "tanvirahmedcs", "first_seen": "2026-06-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "react CVE-2025-55182", "summary": "react CVE-2025-55182", "url": "https://github.com/tanvirahmedcs/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · rvzsec/react2shell", "author": "rvzsec", "first_seen": "2026-06-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "react2shell - CVE-2025-55182 (Next.js: CVE-2025-66478) - Unauthenticated RCE in React Server Components (Flight Protocol) - PoC Exploit", "summary": "react2shell - CVE-2025-55182 (Next.js: CVE-2025-66478) - Unauthenticated RCE in React Server Components (Flight Protocol) - PoC Exploit", "url": "https://github.com/rvzsec/react2shell" }, { "repository": "PoC-in-GitHub · TechWithOrgito/CVE-2025-55182-Researching-process", "author": "TechWithOrgito", "first_seen": "2026-06-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/TechWithOrgito/CVE-2025-55182-Researching-process" }, { "repository": "PoC-in-GitHub · AkhmadKholmurodov/React2Shell_Exploit", "author": "AkhmadKholmurodov", "first_seen": "2026-06-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "I created simple react2shell CVE-2025-55182 python exploit", "summary": "I created simple react2shell CVE-2025-55182 python exploit", "url": "https://github.com/AkhmadKholmurodov/React2Shell_Exploit" }, { "repository": "PoC-in-GitHub · Alejandro609x/JEFAZO-CVE-2025-55182-Checker", "author": "Alejandro609x", "first_seen": "2026-06-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Escáner pasivo de seguridad para CVE-2025-55182 que identifica indicadores públicos asociados a Next.js y React Server Components. Realiza validaciones seguras, analiza cabeceras y rutas, y proporciona una evaluación de exposición basada en evidencias sin explotación.", "summary": "Escáner pasivo de seguridad para CVE-2025-55182 que identifica indicadores públicos asociados a Next.js y React Server Components. Realiza validaciones seguras, analiza cabeceras y rutas, y proporciona una evaluación de exposición basada en evidencias sin explotación.", "url": "https://github.com/Alejandro609x/JEFAZO-CVE-2025-55182-Checker" }, { "repository": "PoC-in-GitHub · olezhaku/react2shell-toolkit", "author": "olezhaku", "first_seen": "2026-06-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "Toolkit for CVE-2025-55182, also known as React2Shell.", "summary": "Toolkit for CVE-2025-55182, also known as React2Shell.", "url": "https://github.com/olezhaku/react2shell-toolkit" }, { "repository": "PoC-in-GitHub · cc3305/CVE-2025-55182", "author": "cc3305", "first_seen": "2026-06-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 exploit script", "summary": "CVE-2025-55182 exploit script", "url": "https://github.com/cc3305/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · SentinelXofficial/CVE-2025-55182", "author": "SentinelXofficial", "first_seen": "2026-06-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "PoC exploit for CVE-2025-55182 (React2Shell) — Pre-auth RCE in React Server Components | CVSS 10.0", "summary": "PoC exploit for CVE-2025-55182 (React2Shell) — Pre-auth RCE in React Server Components | CVSS 10.0", "url": "https://github.com/SentinelXofficial/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Fomovet/cve-2025-55182", "author": "Fomovet", "first_seen": "2026-06-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "POC for CVE-2025-55182", "summary": "POC for CVE-2025-55182", "url": "https://github.com/Fomovet/cve-2025-55182" }, { "repository": "PoC-in-GitHub · avoidme12/CVE-2025-55182-POC", "author": "avoidme12", "first_seen": "2026-06-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "React2Shell POC", "summary": "React2Shell POC", "url": "https://github.com/avoidme12/CVE-2025-55182-POC" }, { "repository": "PoC-in-GitHub · litndat/React2Shell-PoC-CVE-2025-55182", "author": "litndat", "first_seen": "2026-06-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Khai thác lỗ hổng bảo mật CVE-2025-55182", "summary": "Khai thác lỗ hổng bảo mật CVE-2025-55182", "url": "https://github.com/litndat/React2Shell-PoC-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · k1llmelira/react2shell-exploit", "author": "k1llmelira", "first_seen": "2026-06-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "React2Shell: CVE-2025-55182 exploit from tryhackme‼️", "summary": "React2Shell: CVE-2025-55182 exploit from tryhackme‼️", "url": "https://github.com/k1llmelira/react2shell-exploit" }, { "repository": "PoC-in-GitHub · Herick-Costa/CVE-2025-55182-React2Shell-RCE", "author": "Herick-Costa", "first_seen": "2026-06-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "React2Shell (CVE-2025-55182) PoC", "summary": "React2Shell (CVE-2025-55182) PoC", "url": "https://github.com/Herick-Costa/CVE-2025-55182-React2Shell-RCE" }, { "repository": "PoC-in-GitHub · diamorphine666/React2shell-CVE-2025-55182-Exploit", "author": "diamorphine666", "first_seen": "2026-07-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Next.js / RSC - Unauthenticated RCE (React2Shell) (CVE-2025-55182)", "summary": "Next.js / RSC - Unauthenticated RCE (React2Shell) (CVE-2025-55182)", "url": "https://github.com/diamorphine666/React2shell-CVE-2025-55182-Exploit" }, { "repository": "PoC-in-GitHub · se1zer/Nextjs_Exploit_Tool", "author": "se1zer", "first_seen": "2026-07-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "Next.js RSC RCE Exploit Tool (CVE-2025-55182)", "summary": "Next.js RSC RCE Exploit Tool (CVE-2025-55182)", "url": "https://github.com/se1zer/Nextjs_Exploit_Tool" }, { "repository": "PoC-in-GitHub · 6t2kydmp8k-jpg/CVE-2025-55182-Vulnerability-Proof-of-Concept-Group-Project-", "author": "6t2kydmp8k-jpg", "first_seen": "2026-07-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/6t2kydmp8k-jpg/CVE-2025-55182-Vulnerability-Proof-of-Concept-Group-Project-" }, { "repository": "PoC-in-GitHub · razureink/cve-2025-55182-react2shell_reproduction", "author": "razureink", "first_seen": "2026-07-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE Reproduction: cve-2025-55182-react2shell_reproduction", "summary": "CVE Reproduction: cve-2025-55182-react2shell_reproduction", "url": "https://github.com/razureink/cve-2025-55182-react2shell_reproduction" }, { "repository": "PoC-in-GitHub · indra-031/React2Shell-Exploit-CVE-2025-55182", "author": "indra-031", "first_seen": "2026-07-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "React2Shell is a proof-of-concept exploit for CVE-2025-55182 affecting vulnerable React Server Components (RSC) implementations in Next.js", "summary": "React2Shell is a proof-of-concept exploit for CVE-2025-55182 affecting vulnerable React Server Components (RSC) implementations in Next.js", "url": "https://github.com/indra-031/React2Shell-Exploit-CVE-2025-55182" }, { "repository": "PoC-in-GitHub · Phucc29/CVE-2025-55182", "author": "Phucc29", "first_seen": "2026-07-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/Phucc29/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · CerberusMrXi/CVE-2025-55182-Advanced-React-Server-Components-RCE-Exploit", "author": "CerberusMrXi", "first_seen": "2026-08-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Advanced React Server Components RCE scanner for CVE-2025-55182. Features: multi-stage fingerprinting, vulnerability verification, DNS exfiltration, interactive shell, payload obfuscation, and professional reporting (JSON/HTML/PDF). Authorized testing only.", "summary": "Advanced React Server Components RCE scanner for CVE-2025-55182. Features: multi-stage fingerprinting, vulnerability verification, DNS exfiltration, interactive shell, payload obfuscation, and professional reporting (JSON/HTML/PDF). Authorized testing only.", "url": "https://github.com/CerberusMrXi/CVE-2025-55182-Advanced-React-Server-Components-RCE-Exploit" }, { "repository": "PoC-in-GitHub · dotnetguard/CVE-2025-55182-Exploit", "author": "dotnetguard", "first_seen": "2026-08-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 — Next.js Flight Deserialization RCE exploit with interactive shell, single-command execution and multi-payload reverse shell chain. For authorized penetration testing only.", "summary": "CVE-2025-55182 — Next.js Flight Deserialization RCE exploit with interactive shell, single-command execution and multi-payload reverse shell chain. For authorized penetration testing only.", "url": "https://github.com/dotnetguard/CVE-2025-55182-Exploit" }, { "repository": "PoC-in-GitHub · aisha-jimoh/cve-2025-55182-react2shell-analysis", "author": "aisha-jimoh", "first_seen": "2026-08-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Technical analysis of CVE-2025-55182 (React2Shell), covering vulnerability mechanics, root cause, controlled PoC testing, impact, and mitigation strategies.", "summary": "Technical analysis of CVE-2025-55182 (React2Shell), covering vulnerability mechanics, root cause, controlled PoC testing, impact, and mitigation strategies.", "url": "https://github.com/aisha-jimoh/cve-2025-55182-react2shell-analysis" }, { "repository": "PoC-in-GitHub · balochkainat160-cyber/cs50-cybersecurity", "author": "balochkainat160-cyber", "first_seen": "2026-08-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CS50's Introduction to Cybersecurity final project on React2Shell (CVE-2025-55182)", "summary": "CS50's Introduction to Cybersecurity final project on React2Shell (CVE-2025-55182)", "url": "https://github.com/balochkainat160-cyber/cs50-cybersecurity" }, { "repository": "PoC-in-GitHub · kevin9480/Security_incident_report", "author": "kevin9480", "first_seen": "2026-08-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "React2Shell(CVE-2025-55182) 취약점 기반 침해 시나리오를 재현하고, Wazuh/Sysmon/Coraza WAF 로그로 침해사고를 분석·대응한 DFIR 프로젝트", "summary": "React2Shell(CVE-2025-55182) 취약점 기반 침해 시나리오를 재현하고, Wazuh/Sysmon/Coraza WAF 로그로 침해사고를 분석·대응한 DFIR 프로젝트", "url": "https://github.com/kevin9480/Security_incident_report" }, { "repository": "PoC-in-GitHub · PhanHoangKhang/React2Shell", "author": "PhanHoangKhang", "first_seen": "2026-08-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Isolated Docker lab, static detection scanner, and PoC validation for React2Shell (CVE-2025-55182).", "summary": "Isolated Docker lab, static detection scanner, and PoC validation for React2Shell (CVE-2025-55182).", "url": "https://github.com/PhanHoangKhang/React2Shell" }, { "repository": "PoC-in-GitHub · h3n1s3/React2shell-Research", "author": "h3n1s3", "first_seen": "2026-08-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Analyze and reproduce CVE-2025-55182.", "summary": "Analyze and reproduce CVE-2025-55182.", "url": "https://github.com/h3n1s3/React2shell-Research" }, { "repository": "PoC-in-GitHub · Mr-Destroyer/CVE-2025-55182", "author": "Mr-Destroyer", "first_seen": "2026-08-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "SIMPLE EXPOIT FOR CVE-2025-55182 FOR RCE , COMMAND INJECTIONS AND OTHER VULNERABILITIES", "summary": "SIMPLE EXPOIT FOR CVE-2025-55182 FOR RCE , COMMAND INJECTIONS AND OTHER VULNERABILITIES", "url": "https://github.com/Mr-Destroyer/CVE-2025-55182" }, { "repository": "PoC-in-GitHub · UwUGreed/CVE-2025-55182-poc", "author": "UwUGreed", "first_seen": "2026-08-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "I know you are probably here from Hack the Box, if so, yes this one actually works.", "summary": "I know you are probably here from Hack the Box, if so, yes this one actually works.", "url": "https://github.com/UwUGreed/CVE-2025-55182-poc" }, { "repository": "PoC-in-GitHub · ChrisBarack/cve-2025-55182", "author": "ChrisBarack", "first_seen": "2026-09-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-55182 repository", "summary": "", "url": "https://github.com/ChrisBarack/cve-2025-55182" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/52506", "https://github.com/mayank729/CVE-2025-55182-scanner", "https://github.com/pitufo1721/CVE-2025-55182-GodzillaMemoryShell", "https://github.com/alyaapm/CVE-2025-55182-shellinteractive", "https://github.com/Mayca369/CVE-2025-55182", "https://github.com/BankkRoll/Quickcheck-CVE-2025-55182-React-and-CVE-2025-66478-Next.js", "https://github.com/ejpir/CVE-2025-55182-research", "https://github.com/sickwell/CVE-2025-55182", "https://github.com/fatguru/CVE-2025-55182-scanner", "https://github.com/atastycookie/CVE-2025-55182", "https://github.com/santihabib/CVE-2025-55182-analysis", "https://github.com/xkillbit/cve-2025-55182-scanner", "https://github.com/whiteov3rflow/CVE-2025-55182-poc", "https://github.com/shen771/Blackash-CVE-2025-55182", "https://github.com/Pa2sw0rd/exploit-CVE-2025-55182-poc", "https://github.com/heiheishushu/rsc_detect_CVE-2025-55182", "https://github.com/songsanggggg/CVE-2025-55182", "https://github.com/M0onPu15e/next.js-scanner", "https://github.com/ducducuc111/CVE-2025-55182-poc", "https://github.com/ThemeHackers/CVE-2025-55182", "https://github.com/joshterrill/CVE-2025-55182-realistic-poc", "https://github.com/mingyisecurity-lab/CVE-2025-55182-TOOLS", "https://github.com/gensecaihq/react2shell-scanner", "https://github.com/sudo-Yangziran/CVE-2025-55182POC", "https://github.com/Rsatan/Next.js-Exploit-Tool", "https://github.com/assetnote/react2shell-scanner", "https://github.com/jf0x3a/CVE-2025-55182-exploit", "https://github.com/harness-security-labs/CVE-2025-55182-checker", "https://github.com/dissy123/cve-2025-55182", "https://github.com/dwisiswant0/CVE-2025-55182", "https://github.com/Chelsea486MHz/CVE-2025-55182-test", "https://github.com/oways/React2shell-CVE-2025-55182-checker", "https://github.com/msanft/CVE-2025-55182", "https://github.com/ivaavimusic/React19-fix-vibecoders", "https://github.com/carlosaruy/CVE-2025-55182", "https://github.com/Security-Phoenix-demo/react2shell-scanner-rce-react-next-CVE-2025-55182-CVE-2025-66478", "https://github.com/c0rydoras/CVE-2025-55182", "https://github.com/CymulateResearch/React2Shell-Scanner", "https://github.com/0xPThree/cve-2025-55182", "https://github.com/acheong08/CVE-2025-55182-poc", "https://github.com/jctommasi/react2shellVulnApp", "https://github.com/shamo0/react2shell-PoC", "https://github.com/EynaExp/CVE-2025-55182-POC", "https://github.com/im-hanzou/CVE-2025-55182-POC-SCANNER", "https://github.com/klassiker/CVE-2025-55182", "https://github.com/Emiyelbarto/CVE-2025-55182-PoC", "https://github.com/MrR0b0t19/CVE-2025-55182-shellinteractive", "https://github.com/ps-interactive/cve-2025-55182", "https://github.com/tobiasGuta/Next.js-RSC-RCE-Scanner-Burp-Suite-Extension", "https://github.com/aquinn-r7/CVE-2025-55182-VulnCheckPOC", "https://github.com/MedusaSH/POC-CVE-2025-55182", "https://github.com/nxgn-kd01/react2shell-scanner", "https://github.com/clevernyyyy/CVE-2025-55182-Dockerized", "https://github.com/Cillian-Collins/CVE-2025-55182", "https://github.com/ZihxS/check-react-rce-cve-2025-55182", "https://github.com/ZemarKhos/CVE-2025-55182-Exploit-PoC-Scanner", "https://github.com/sherlocksecurity/CVE-2025-55182-Exploit-scanner", "https://github.com/huangzccn/CVE-2025-55182", "https://github.com/Darker-Ink/react-ssr-vulnerability", "https://github.com/emadshanab/POC-for-CVE-2025-55182", "https://github.com/topstar88/CVE-2025-55182", "https://github.com/selectarget/CVE-2025-55182-Exploit", "https://github.com/pyroxenites/Nextjs_RCE_Exploit_Tool", "https://github.com/Chocapikk/CVE-2025-55182", "https://github.com/mrknow001/RSC_Detector", "https://github.com/Spritualkb/CVE-2025-55182-exp", "https://github.com/younesZdDz/CVE-2025-55182", "https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc", "https://github.com/hualy13/CVE-2025-55182", "https://github.com/RuoJi6/CVE-2025-55182-RCE-shell", "https://github.com/Saturate/CVE-2025-55182-react2shell", "https://github.com/hoosin/CVE-2025-55182", "https://github.com/Pizz33/CVE-2025-55182-burpscanner", "https://github.com/Y3B3L4Y3/CVE-2025-55182-test", "https://github.com/ngvcanh/CVE-2025-55182-Attack-Analysis", "https://github.com/aliclub0x00/CVE-2025-55182-POC-NEXTJS", "https://github.com/logesh-GIT001/CVE-2025-55182", "https://github.com/freeqaz/react2shell", "https://github.com/ABCFabian/React2Shell-CVE-2025-55182-Testing-Environment", "https://github.com/l4rm4nd/CVE-2025-55182", "https://github.com/Airis101/CVE-2025-55182-analysis", "https://github.com/GelukCrab/React-Server-Components-RCE", "https://github.com/Golden-Secure/CVE-2025-55182", "https://github.com/grp-ops/react2shell", "https://github.com/alexandre-briongos-wavestone/react-cve-2025-55182-lab", "https://github.com/Rat5ak/CVE-2025-55182-React2Shell-RCE-POC", "https://github.com/imbas007/POC-CVE-2025-55182", "https://github.com/RajChowdhury240/React2Shell-CVE-2025-55182", "https://github.com/nehkark/CVE-2025-55182", "https://github.com/prestonhashworth/cve-2025-55182", "https://github.com/nomorebreach/POC-CVE-2025-55182", "https://github.com/nerium-security/CVE-2025-55182", "https://github.com/zzhorc/CVE-2025-55182", "https://github.com/Atlantis02-sec/Vulnerability-assessment", "https://github.com/rl0x01/CVE-2025-55182_PoC", "https://github.com/subzer0x0/React2Shell", "https://github.com/f0xyx/CVE-2025-55182-Scanner", "https://github.com/Cr4at0r/Next.js-RCE-Scanner-BurpSuite-Extension-", "https://github.com/ceortiz33/CVE-2025-55182", "https://github.com/xkey8/react2shell", "https://github.com/zessu/CVE-2025-55182-Typescript", "https://github.com/mxm0z/r2s", "https://github.com/NathanJ60/react2shell-interactive", "https://github.com/GarethMSheldon/React2Shell-CVE-2025-55182-Detector", "https://github.com/kindone09/CVE-2025-55182", "https://github.com/alsaut1/react2shell-lab", "https://github.com/pax-k/react2shell-CVE-2025-55182-full-rce-script", "https://github.com/kOaDT/poc-cve-2025-55182", "https://github.com/mohit121312/CVE-2025-55182_full_exploit", "https://github.com/ejpir/CVE-2025-55182-bypass", "https://github.com/StealthMoud/CVE-2025-55182-Scanner", "https://github.com/yanoshercohen/React2Shell_CVE-2025-55182", "https://github.com/emredavut/CVE-2025-55182", "https://github.com/rapticore/ore_react2shell_scanner", "https://github.com/fankh/cve-2025-55182-test-lab-windows", "https://github.com/cypholab/evilact", "https://github.com/greenheadHQ/CVE-2025-55182", "https://github.com/sumanrox/rschunter", "https://github.com/I3r1h0n/React2Shell", "https://github.com/zorejt/Rust_CVE-2025-55182", "https://github.com/Archerkong/CVE-2025-55182", "https://github.com/philparzer/nextjs-react2shell-detect", "https://github.com/yunaranyancat/CVE-2025-55182-NSE", "https://github.com/MrSol0/CVE-2025-55182-Terminal", "https://github.com/fullhunt/react2shell-test-server", "https://github.com/zack0x01/vuln-app-CVE-2025-55182", "https://github.com/zack0x01/CVE-2025-55182-advanced-scanner-", "https://github.com/rocklambros/React2Shell_Hunter", "https://github.com/alessiodos/react2shell-scanner", "https://github.com/Bashamega/react-CVE-2025-55182-fixer", "https://github.com/orgito1015/CVE-2025-55182-RCE-Exploit", "https://github.com/keklick1337/CVE-2025-55182-golang-PoC", "https://github.com/rubensuxo-eh/react2shell-exploit", "https://github.com/CirqueiraDev/MassExploit-CVE-2025-55182", "https://github.com/aastikgakhar/CVE-2025-55182-react2shell", "https://github.com/zamdevio/r2s", "https://github.com/AdityaBhatt3010/React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web", "https://github.com/0xN7y/CVE-2025-55182", "https://github.com/MuhammadWaseem29/React2Shell_Rce-cve-2025-55182", "https://github.com/l0n3m4n/CVE-2025-55182-Waf", "https://github.com/ynsmroztas/NextRce", "https://github.com/shreyas-malhotra/React2Shell-CVE-2025-55182", "https://github.com/sohaibeb/CVE-2025-55182", "https://github.com/vyvivekyadav04/RSC-Infra-Scanner", "https://github.com/MikeTheHash/CVE-2025-55182", "https://github.com/Qixinlee/CVE-2025-55182-Scanner", "https://github.com/DelvyGonzalez/react2shell-security-toolkit", "https://github.com/ahmedshamsddin/CVE-2025-55182", "https://github.com/LemonTeatw1/CVE-2025-55182-exploit", "https://github.com/ethicalrohitt/React2Shell_cve-2025-55182", "https://github.com/ihhgimhana/React2Shell-CVE-2025-55182-PoC-Reverse-Shell", "https://github.com/shakilkhatri/scanner-for-CVE-2025-55182-vulnerability", "https://github.com/UmmItKin/CVE-2025-55182-PoC", "https://github.com/robbin0919/CVE-2025-55182", "https://github.com/zxz3650/CVE-2025-55182-POC", "https://github.com/AliHzSec/CVE-2025-55182", "https://github.com/zr0n/react2shell", "https://github.com/hunter24x24/CVE-2025-55182-mass", "https://github.com/andressuarezmonk/CVE-2025-55182", "https://github.com/cybertechajju/R2C-CVE-2025-55182-66478", "https://github.com/Dh4v4l8/CVE-2025-55182-poc-tool", "https://github.com/M4xSec/CVE-2025-55182-React2Shell-RCE-Shell", "https://github.com/SainiONHacks/CVE-2025-55182-Scanner", "https://github.com/umairahmadh/react-vuln-scanner", "https://github.com/ToritoIO/Torito-R2S", "https://github.com/surajhacx/react2shellpoc", "https://github.com/kavienanj/CVE-2025-55182", "https://github.com/websecuritylabs/React2Shell-Library", "https://github.com/cyberleelawat/CVE-2025-55182", "https://github.com/satriarizka/CVE-2025-55182-Simple-Scanner", "https://github.com/xcanwin/CVE-2025-55182-React-RCE", "https://github.com/DoobTheGoober/CVE-2025-55182-Test-Server", "https://github.com/timsonner/React2Shell-CVE-2025-55182", "https://github.com/theman001/CVE-2025-55182", "https://github.com/lalaterry/CVE-2025-55182-React2Shell-lab", "https://github.com/arashiyans/CVE-2025-55182-CVE-2025-66478", "https://github.com/faizdotid/rust-cve-2025-55182", "https://github.com/muthaiyanmani/react2shell-checker", "https://github.com/LucasPDiniz/CVE-2025-55182", "https://github.com/wangzhengquan/CVE-2025-55182", "https://github.com/TH-SecForge/CVE-2025-55182", "https://github.com/chitoz1300/React2Shell-CVE-2025-55182", "https://github.com/Night-have-dreams/CVE-2025-55182-PoC", "https://github.com/thekamran/CVE-2025-55182-Proof-of-Concept", "https://github.com/Syrins/CVE-2025-55182-React2Shell-RCE", "https://github.com/0xsj/CVE-2025-55182", "https://github.com/Security-Phoenix-demo/react2shell-scanner-CVE-2025-55182", "https://github.com/Benrich127N/react2shell_analyzer", "https://github.com/randarts/react-rce", "https://github.com/hamm0nz/react2shell-audit", "https://github.com/0xSalm0n/CVE-2025-55182", "https://github.com/Macaroniwdcheese/CVE-2025-55182-Lab", "https://github.com/LvMalware/CVE-2025-55182", "https://github.com/HUAHUAI23/CVE-2025-55182-POC", "https://github.com/cahyod/react2shell", "https://github.com/yaupunal/CVE-2025-55182-scanner", "https://github.com/jandelima/cve-2025-55182-poc-test", "https://github.com/im-ezboy/CVE-2025-55182-zoomeye", "https://github.com/FurkanKAYAPINAR/React-Next-Scanner", "https://github.com/lowercasenumbers/CVE-2025-55182", "https://github.com/AggressiveUser/React2Hell", "https://github.com/racall/cve-2025-55182-node", "https://github.com/FurkanKAYAPINAR/ReactNext2Shell", "https://github.com/LQTjim/next-bug-CVE-2025-55182", "https://github.com/AliAbdollahiii/react2shell_detector", "https://github.com/jan0x190/CVE-2025-55182-Simple-Scanner-main", "https://github.com/xiaopeng-ye/react2shell-detector", "https://github.com/vulncheck-oss/cve-2025-55182", "https://github.com/Shield-Cyber/react2shell-scanner", "https://github.com/sun977/CVE-2025-55182", "https://github.com/garux-sec/PoC-react2shell-CVE-2025-55182", "https://github.com/ancs21/react2shell-scanner-rust", "https://github.com/MoisesTapia/http-react2shell", "https://github.com/solidevil14/Suricata-Rule-for-Detecting-CVE-2025-55182", "https://github.com/techgaun/cve-2025-55182-scanner", "https://github.com/rsch-io/CVE-2025-55182-React2Shell", "https://github.com/ilixm/PoC-RCE-CVE-2025-55182", "https://github.com/iamblacksolo2-BugBounty/POC-CVE-2025-55182", "https://github.com/joelvaiju/react2shell-CVE-2025-55182-poc", "https://github.com/DevVaibhav07/POC-CVE-2025-55182", "https://github.com/liamromanis101/cve-2025-55182", "https://github.com/ysfcndgr/React2Shell-CVE-2025-55182-Advanced-Scanner", "https://github.com/alfazhossain/CVE-2025-55182-Exploiter", "https://github.com/keshavyaduvans/cve-2025-55182", "https://github.com/byte16384/CVE-2025-55182", "https://github.com/kondukto-io/vulnerable-next-js-poc", "https://github.com/eytannatye/R2S_CVE-2025-55182", "https://github.com/Jaycelation/CVE-2025-55182", "https://github.com/shyambhanushali/React2Shell", "https://github.com/amir-malek/react-cve-2025-55182", "https://github.com/Yyax13/CVE-2025-55182", "https://github.com/Ankitspandey07/React2Shell", "https://github.com/Stonelinks/react-cve-2025-55182", "https://github.com/ihsansencan/React2Shell-CVE-2025-55182", "https://github.com/dr4xp/react2shell", "https://github.com/trax69/cve-2025-55182-poc", "https://github.com/osman-butt/CVE-2025-55182-demo", "https://github.com/theori-io/reactguard", "https://github.com/iamblacksolo2-BugBounty/POC2-CVE-2025-55182", "https://github.com/bakhod1r/CVE-2025-55182", "https://github.com/theman001/CVE-2025-55182_PoC-Test-Server", "https://github.com/gunyakit/CVE-2025-55182-PoC-exploit", "https://github.com/rix4uni/CVE-2025-55182", "https://github.com/gonaumov/cve-2025-55182-checker", "https://github.com/BeichenDream/CVE-2025-55182-GodzillaMemoryShell", "https://github.com/Legus-Yeung/CVE-2025-55182-exploit", "https://github.com/DanielXavierJob/-CVE-2025-55182", "https://github.com/sponte/nextjs-cve-version-confusion", "https://github.com/CrazyloveforWeb/Golang-CVE-2025-55182-POC", "https://github.com/JahazielLem/NSE_CVE-2025-55182", "https://github.com/CerberusMrXi/Cerberus-React2Shell-Scanner-Exploit", "https://github.com/VeilVulp/RscScan-cve-2025-55182", "https://github.com/yz9yt/React2Shell-CTF", "https://github.com/Gymnott1/CVE-2025-55182", "https://github.com/J4ck3LSyN-Gen2/CVE-2025-55182", "https://github.com/pkrasulia/CVE-2025-55182-NextJS-RCE-PoC", "https://github.com/min8282/CVE-2025-55182", "https://github.com/Machine-farmer/PunchingBag-for-React2Shell", "https://github.com/exrienz/CVE-2025-55182-NextJS-Scanner-React2Shell-PoC", "https://github.com/mrmtwoj/React2Shell-CVE-2025-55182", "https://github.com/LC-pro/CVE-2025-55182-EXP", "https://github.com/Tiger-Foxx/exploit-react-CVE-2025-55182", "https://github.com/VolksRat71/react2shellexploitvisualized", "https://github.com/anuththara2007-W/CVE-2025-55182-Exploit-extension", "https://github.com/Nkwenti-Severian-Ndongtsop/POC_react2shell_CVE-2025-55182", "https://github.com/aseemyash/krle", "https://github.com/4nuxd/React2Shell", "https://github.com/j0lt-github/react2shell-burp", "https://github.com/IrsyadSEC/CVE-2025-55182-MassPayloadAttack", "https://github.com/Shadowroot97/React2Shell-CVE-2025-55182", "https://github.com/yuta3003/CVE-2025-55182", "https://github.com/rahul-securify/React2Shell-CVE-2025-55182", "https://github.com/raivenLockdown/WEB-CLI_RCE_React2Shell", "https://github.com/oguri-souhei/CVE-2025-55182", "https://github.com/xalgord/React2Shell", "https://github.com/ryanhafid/PoC_CVE-2025-55182", "https://github.com/ryanhafid/Scan_CVE-2025-55182", "https://github.com/gagaltotal/tot-react-rce-CVE-2025-55182", "https://github.com/sho-luv/React2Shell", "https://github.com/h0tak88r/next88", "https://github.com/TheStingR/ReactOOPS-WriteUp", "https://github.com/mantvmass/react2shell", "https://github.com/MoLeft/React2Shell-Toolbox", "https://github.com/Ya0h4cker/CVE-2025-55182", "https://github.com/Kugelbyte/React2Shell-Analysis", "https://github.com/dhananjayakumarn/CVE-2025-55182-Lab", "https://github.com/sangleshubham/React-Security-CVE-2025-55182-Exploit", "https://github.com/TrixSec/CVE-2025-55182-Scanner", "https://github.com/mounta11n/CHECK-CVE-2025-55182-AND-CVE-2025-66478", "https://github.com/grejh0t/CVE-2025-55182", "https://github.com/hidden-investigations/react2shell-vulnlab", "https://github.com/MammaniNelsonD/React2P4IM0Nshell", "https://github.com/tinashelorenzi/CVE-2025-55182", "https://github.com/ProwlSec/React2Shell", "https://github.com/VVVI5HNU/CVE-2025-55182", "https://github.com/CyberPrince-hub/React2shell-ultimate-scanner", "https://github.com/hidden-investigations/react2shell-scanner", "https://github.com/mivmi/CVE-2025-55182", "https://github.com/subhdotsol/CVE-2025-55182", "https://github.com/Call123X/-cve-2025-55182", "https://github.com/hulh122/CVE-2025-55182", "https://github.com/simantchaudhari/CVE-2025-55182", "https://github.com/premdanav/react2shelldemo", "https://github.com/S-Mughal/NextJS-app-CVE-2025-55182", "https://github.com/itumo-arigatone/study-CVE-2025-55182", "https://github.com/EQSTLab/CVE-2025-55182", "https://github.com/scumfrog/FiberBreak", "https://github.com/d0cnull/nextjs-CVE-2025-55182", "https://github.com/Mustafa1p/Next.js-RCE-Scanner---CVE-2025-55182-CVE-2025-66478", "https://github.com/M4rgs/CVE-2025-55182-React2Shell-Exploit", "https://github.com/nulltrace1336/CVE-2025-55182-Metasploit-exploit-skeleton-real-flow-", "https://github.com/pwnxpl0it/react2shell-lab", "https://github.com/ceh-aditya-raj/CVE-2025-55182", "https://github.com/r4j3sh-com/CVE-2025-55182", "https://github.com/degenwithheart/React2Shell-Vulnerability-Verification-Script", "https://github.com/rashedhasan090/cve-2025-55182-mitigator", "https://github.com/RavinduRathnayaka/CVE-2025-55182-PoC", "https://github.com/open-flaw/CVE-2025-55182", "https://github.com/chrahman/react2shell-CVE-2025-55182-full-rce-script", "https://github.com/lamaper/CVE-2025-55182-Toolbox", "https://github.com/mahaveer-choudhary/CVE-2025-55182", "https://github.com/MeGaNeKoS/secure-by-default-rce-demo", "https://github.com/tamagorengs/react2shell-poc-CVE-2025-55182", "https://github.com/xxxTectationxxx/React2Shell-CVE-Lab", "https://github.com/vijay-shirhatti/RSC-Detect-CVE-2025-55182", "https://github.com/p3ta00/react2shell-poc", "https://github.com/vonuyvicoo/nextploiter", "https://github.com/niokagi/react-cve-2025-55182", "https://github.com/knightwolf01/React2Shell", "https://github.com/BlackTechX011/React2Shell", "https://github.com/S3cr3t-SDN/React4Shell", "https://github.com/ckex/test-vuln", "https://github.com/jensnesten/React2Shell-PoC", "https://github.com/Farhan9488/CVE-2025-55182-research", "https://github.com/bigbluewhale111/CVE-2025-55182-LAB", "https://github.com/guiimoraes/react2shell-evolved", "https://github.com/itsismarcos/Bot-exploit-CVE-2025-55182", "https://github.com/0xROI/CVE-2025-55182", "https://github.com/Updatelap/CVE-2025-55182", "https://github.com/kanyokoo/React-Server-Components-Remote-Code-Execution-CVE-2025-55182-", "https://github.com/KingHacker353/R2C-CVE-2025-55182-66478", "https://github.com/amirali-ramezani/react2shell-CVE-2025-55182-", "https://github.com/git0xLai/React2ShellPoC", "https://github.com/hndko/react2shell-rce-autobot", "https://github.com/Goultarde/CVE-2025-55182-React2Shell-Lab", "https://github.com/xiaoLvChen/CVE-2025-55182", "https://github.com/captain4554/CVE-2025-55182-Scanner", "https://github.com/captain4554/captain4554.github.io", "https://github.com/ghostn4444/CVE-2025-55182", "https://github.com/HackIndex-io/React2Shell-CVE-2025-55182", "https://github.com/rahuulmiishra/react2shell-CVE-2025-55182", "https://github.com/m3ngx1ng/CVE-2025-55182-GUI", "https://github.com/joaovicdev/EXPLOIT-CVE-2025-55182", "https://github.com/AdityaBhatt3010/React2Shell-CVE-2025-55182", "https://github.com/gahoole77/gahoole77.github.io", "https://github.com/lucyz1125/CVE-2025-55182-Next.js-RCE", "https://github.com/hyan0116/Next.js-RCE-CVE-2025-55182", "https://github.com/MyCompanyOrganization/React2Shell-Kingdom", "https://github.com/yannisduvignau/react2shell-exploit", "https://github.com/en0f/CVE-2025-55182-poc-json", "https://github.com/momika233/CVE-2025-55182-bypass", "https://github.com/mooowu/cve-2025-55182-poc", "https://github.com/Faithtiannn/CVE-2025-55182", "https://github.com/termireum/react2shell", "https://github.com/Least-Significant-Bit/CVE-2025-55182", "https://github.com/faisha1311/React2Shell-CVE-2025-55182-TryHackMe", "https://github.com/BBD-YZZ/CVE-2025-55182", "https://github.com/Vladjrfhfg/React-site-CVE-2025-55182", "https://github.com/Namsom007/CVE-2025-55182-Exploit", "https://github.com/MemerGamer/CVE-2025-55182", "https://github.com/Sairbo/Unihackers---CVE-2025-55182-", "https://github.com/AsadAhmad-1337/React-2-Shell", "https://github.com/deepankarkumar1/CVE-2025-55182_Vulnerable-Application", "https://github.com/wnaspy/CVE-2025-55182", "https://github.com/woorifisa-service-dev-6th/tech-seminar-React2Shell", "https://github.com/MuhammadUwais/React2Shell", "https://github.com/Evillm/CVE-2025-55182-PoC", "https://github.com/BrianLopezM99/react2shell-CVE-2025-55182", "https://github.com/George0Papasotiriou/CVE-2025-55182-React2Shell-CVSS-10.0-", "https://github.com/snipevx/React2Shell-POC", "https://github.com/BIG02-bot/React2Shell-CVE-2025-55182-An-lise-T-cnica", "https://github.com/Wyl-cmd/CVE-2025-55182", "https://github.com/H4R335HR/reactshell", "https://github.com/orgito1015/CVE-2025-55182-Researching-process", "https://github.com/0xBlackash/CVE-2025-55182", "https://github.com/alptexans/RSC-Detect-CVE-2025-55182", "https://github.com/MrMahile/MassScanning-CVE-2025-55182", "https://github.com/androidteacher/REACT-CVE-2025-55182-Lab", "https://github.com/InferiorAK/CVE-2025-55182-React2Shell-Async-Scanner", "https://github.com/luoqichen/CVE-2025-55182-POC", "https://github.com/lutraat/CVE-2025-55182-React-RSC-Exploit", "https://github.com/monarchfish/cve-2025-55182-poc", "https://github.com/nexxp90/CVE-2025-55182_RCE_Exploit", "https://github.com/luoluoqingge/CVE-2025-55182", "https://github.com/RyosukeDTomita/CVE-2025-55182", "https://github.com/eagle-nett/React2Shell-PoC-CVE-2025-55182", "https://github.com/devianntsec/CVE-2025-55182", "https://github.com/l0lsec/cve-2025-55182-lab", "https://github.com/0x0asif/CVE-2025-55182", "https://github.com/amikanev/CVE-2025-55182-LAB", "https://github.com/hujiaozhuzhu/CVE-2025-55182_liyon", "https://github.com/aliksir/nextjs-security-scanner", "https://github.com/porsellaj/cve-2025-55182-react2shell-analysis", "https://github.com/masterwok/PoC-CVE-2025-55182", "https://github.com/kaxm23/CVE-2025-55182-Auto-Scanner", "https://github.com/kaxm23/rust-cve-2025-55182-scanner", "https://github.com/RewantChaudhari/nextjs-rce-incident-response", "https://github.com/oscar-mine/R2SAE", "https://github.com/AbdullahMaqbool22/Explosive-As-Hell-MCS-Qualifer-Web-500", "https://github.com/DeDnY/CVE-2025-55182-poc-panel", "https://github.com/opsecramdan/react2shell-cve-2025-55182", "https://github.com/Mohamedniane/cve-2025-55182-analysis", "https://github.com/joaoreis13/flight-risk", "https://github.com/shibaaa204/React2Shell", "https://github.com/Cybersecurity-Enthusiasts-CE/CVE-2025-55182-Researching-process", "https://github.com/MuharremK0/Info-Sys-Security-CVE-2025-55182", "https://github.com/ycseo-git/CVE-2025-55182", "https://github.com/Industri4l-H3ll-Xpl0it3rs/CVE-2025-55182-React2Shell", "https://github.com/renewablehacking/CVE-2025-55182-React-19.2.0", "https://github.com/SpeatX/React2Shell-CVE-2025-55182", "https://github.com/w3nch/CVE-2025-55182-in-go", "https://github.com/Jenderal92/CVE-2025-55182-React2shell", "https://github.com/Jeanback1/react-rsc-cve-2025-55182-lab", "https://github.com/sonnycroco/HTB-Reactor-Linux-Machine-Walkthrough", "https://github.com/LuizHenz/PoC-CVE-2025-55182", "https://github.com/hakkuri01/r2rs", "https://github.com/tanvirahmedcs/CVE-2025-55182", "https://github.com/rvzsec/react2shell", "https://github.com/TechWithOrgito/CVE-2025-55182-Researching-process", "https://github.com/AkhmadKholmurodov/React2Shell_Exploit", "https://github.com/Alejandro609x/JEFAZO-CVE-2025-55182-Checker", "https://github.com/olezhaku/react2shell-toolkit", "https://github.com/cc3305/CVE-2025-55182", "https://github.com/SentinelXofficial/CVE-2025-55182", "https://github.com/Fomovet/cve-2025-55182", "https://github.com/avoidme12/CVE-2025-55182-POC", "https://github.com/litndat/React2Shell-PoC-CVE-2025-55182", "https://github.com/k1llmelira/react2shell-exploit", "https://github.com/Herick-Costa/CVE-2025-55182-React2Shell-RCE", "https://github.com/diamorphine666/React2shell-CVE-2025-55182-Exploit", "https://github.com/se1zer/Nextjs_Exploit_Tool", "https://github.com/6t2kydmp8k-jpg/CVE-2025-55182-Vulnerability-Proof-of-Concept-Group-Project-", "https://github.com/razureink/cve-2025-55182-react2shell_reproduction", "https://github.com/indra-031/React2Shell-Exploit-CVE-2025-55182", "https://github.com/Phucc29/CVE-2025-55182", "https://github.com/CerberusMrXi/CVE-2025-55182-Advanced-React-Server-Components-RCE-Exploit", "https://github.com/dotnetguard/CVE-2025-55182-Exploit", "https://github.com/aisha-jimoh/cve-2025-55182-react2shell-analysis", "https://github.com/balochkainat160-cyber/cs50-cybersecurity", "https://github.com/kevin9480/Security_incident_report", "https://github.com/PhanHoangKhang/React2Shell", "https://github.com/h3n1s3/React2shell-Research", "https://github.com/Mr-Destroyer/CVE-2025-55182", "https://github.com/UwUGreed/CVE-2025-55182-poc", "https://github.com/ChrisBarack/cve-2025-55182" ], "timeline": [ { "at": "2026-09-01T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-12-05", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2025-50455", "vendor": "Unknown vendor", "product": "Unknown product", "title": "EasyAppointments 1.5.1 - Blind SQL Injection", "summary": "EasyAppointments 1.5.1 - Blind SQL Injection", "updated_at": "2026-08-31T22:00:00Z", "published_at": "2026-08-31T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 16, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52667", "author": "Michael Chesang", "first_seen": "2026-09-01", "confidence": "High", "title": "EasyAppointments 1.5.1 - Blind SQL Injection", "summary": "EasyAppointments 1.5.1 - Blind SQL Injection", "url": "https://www.exploit-db.com/exploits/52667", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52667" ], "timeline": [ { "at": "2026-08-31T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52667" } ] }, { "id": "CVE-2025-32756", "vendor": "Fortinet", "product": "Multiple Products", "title": "Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability", "summary": "Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.", "updated_at": "2026-09-05T12:39:10Z", "published_at": "2026-09-05T12:39:10Z", "cvss": 9.8, "confidence": 90, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 3, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:39:10+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "cve-2025-32756 exploit", "summary": "Exploit for CVE-2025-32756. CVSS 9.8.", "cvss": 9.8, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SHAN0AR-CVE-2025-32756" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SHAN0AR-CVE-2025-32756" ], "timeline": [ { "at": "2026-09-05T12:39:10Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-05-14", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2025-31161", "vendor": "CrushFTP", "product": "CrushFTP", "title": "CrushFTP Authentication Bypass Vulnerability", "summary": "CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.", "updated_at": "2026-08-25T02:25:29Z", "published_at": "2026-08-25T02:25:29Z", "cvss": 9.8, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 38, "kev": true, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52295", "author": "İbrahimsql", "first_seen": "2025-05-18", "confidence": "High", "title": "CrushFTP 11.3.1 - Authentication Bypass", "summary": "CrushFTP 11.3.1 - Authentication Bypass", "url": "https://www.exploit-db.com/exploits/52295", "verification": "verified", "verified": true }, { "title": "Exploit for ludus_crushftp_cve-2025-31161_sim CVE-2025-31161", "summary": "Authentication bypass in CrushFTP 10.8.0 on Windows (CVE-2025-31161).", "what_happened": "Authentication bypass in CrushFTP 10.8.0 on Windows (CVE-2025-31161).", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RUFFLABS-LUDUS_CRUSHFTP_CVE-2025-31161_SIM", "https://kitploit.com/hi/tools/github/rufflabs/ludus_crushftp_cve-2025-31161_sim/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-08-25T04:25:29", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RUFFLABS-LUDUS_CRUSHFTP_CVE-2025-31161_SIM" }, { "title": "Exploit for ludus_crushftp_cve-2025-31161_sim CVE-2025-31161", "summary": "Authentication bypass in CrushFTP 10.8.0 on Windows (CVE-2025-31161).", "what_happened": "Authentication bypass in CrushFTP 10.8.0 on Windows (CVE-2025-31161).", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RUFFLABS-LUDUS_CRUSHFTP_CVE-2025-31161_SIM", "https://kitploit.com/hi/tools/github/rufflabs/ludus_crushftp_cve-2025-31161_sim/" ], "repository": "kitploit.com", "author": "hi", "first_seen": "2026-08-25T04:25:29", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/hi/tools/github/rufflabs/ludus_crushftp_cve-2025-31161_sim/" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/52295", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RUFFLABS-LUDUS_CRUSHFTP_CVE-2025-31161_SIM", "https://kitploit.com/hi/tools/github/rufflabs/ludus_crushftp_cve-2025-31161_sim/" ], "timeline": [ { "at": "2026-08-25T02:25:29Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-07", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-07", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-07", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-07", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-07", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-07", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2025-30208", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Vite 6.2.2 - Arbitrary File Read", "summary": "Vite 6.2.2 - Arbitrary File Read", "updated_at": "2026-09-03T10:01:14Z", "published_at": "2026-09-03T10:01:14Z", "cvss": 7.5, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 38, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "Arbitrary file read in Vite via @fs endpoint with raw or import&raw parameters.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52111", "author": "4m3rr0r", "first_seen": "2025-04-03", "confidence": "High", "title": "Vite 6.2.2 - Arbitrary File Read", "summary": "Vite 6.2.2 - Arbitrary File Read", "url": "https://www.exploit-db.com/exploits/52111", "verification": "verified", "verified": true }, { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T08:15:24+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2025-30208-ViteVulnScanner exploit", "summary": "Exploit for CVE-2025-30208. CVSS 7.5.", "cvss": 7.5, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-KEKLICK1337-CVE-2025-30208-VITEVULNSCANNER" }, { "title": "Exploit for CVE-2025-30208-ViteVulnScanner", "summary": "Arbitrary file read in Vite via @fs endpoint with raw or import&raw parameters.", "what_happened": "Arbitrary file read in Vite via @fs endpoint with raw or import&raw parameters.", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-KEKLICK1337-CVE-2025-30208-VITEVULNSCANNER", "https://kitploit.com/hi/tools/github/keklick1337/cve-2025-30208-vitevulnscanner/" ], "repository": "kitploit.com", "author": "hi", "first_seen": "2026-09-03T12:01:14", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/hi/tools/github/keklick1337/cve-2025-30208-vitevulnscanner/" } ], "references": [ "https://www.exploit-db.com/exploits/52111", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-KEKLICK1337-CVE-2025-30208-VITEVULNSCANNER", "https://kitploit.com/hi/tools/github/keklick1337/cve-2025-30208-vitevulnscanner/" ], "timeline": [ { "at": "2026-09-03T10:01:14Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52111" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "id": "CVE-2025-29927", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Next.js Middleware 15.2.2 - Authorization Bypass", "summary": "Next.js Middleware 15.2.2 - Authorization Bypass", "updated_at": "2026-09-05T12:41:19Z", "published_at": "2026-09-05T12:41:19Z", "cvss": 9.1, "confidence": 80, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 126, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52124", "author": "kOaDT", "first_seen": "2025-04-05", "confidence": "High", "title": "Next.js Middleware 15.2.2 - Authorization Bypass", "summary": "Next.js Middleware 15.2.2 - Authorization Bypass", "url": "https://www.exploit-db.com/exploits/52124", "verification": "verified", "verified": true }, { "repository": "PoC-in-GitHub · serhalp/test-cve-2025-29927", "author": "serhalp", "first_seen": "2025-03-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Verify Next.js CVE-2025-29927 on Netlify not vulnerable", "summary": "Verify Next.js CVE-2025-29927 on Netlify not vulnerable", "url": "https://github.com/serhalp/test-cve-2025-29927" }, { "repository": "PoC-in-GitHub · Ademking/CVE-2025-29927", "author": "Ademking", "first_seen": "2025-03-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "Next.js Middleware Authorization Bypass", "summary": "Next.js Middleware Authorization Bypass", "url": "https://github.com/Ademking/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · 6mile/nextjs-CVE-2025-29927", "author": "6mile", "first_seen": "2025-03-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 19, "title": "A Nuclei template to detect CVE-2025-29927 the Next.js authentication bypass vulnerability", "summary": "A Nuclei template to detect CVE-2025-29927 the Next.js authentication bypass vulnerability", "url": "https://github.com/6mile/nextjs-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · azu/nextjs-cve-2025-29927-poc", "author": "azu", "first_seen": "2025-03-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 15, "title": "Next.js PoC for CVE-2025-29927", "summary": "Next.js PoC for CVE-2025-29927", "url": "https://github.com/azu/nextjs-cve-2025-29927-poc" }, { "repository": "PoC-in-GitHub · lirantal/vulnerable-nextjs-14-CVE-2025-29927", "author": "lirantal", "first_seen": "2025-03-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 14, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · aydinnyunus/CVE-2025-29927", "author": "aydinnyunus", "first_seen": "2025-03-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 103, "title": "CVE-2025-29927 Proof of Concept", "summary": "CVE-2025-29927 Proof of Concept", "url": "https://github.com/aydinnyunus/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · ticofookfook/poc-nextjs-CVE-2025-29927", "author": "ticofookfook", "first_seen": "2025-03-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/ticofookfook/poc-nextjs-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · t3tra-dev/cve-2025-29927-demo", "author": "t3tra-dev", "first_seen": "2025-03-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "Next.js における認可バイパスの脆弱性 CVE-2025-29927 を再現するデモです。", "summary": "Next.js における認可バイパスの脆弱性 CVE-2025-29927 を再現するデモです。", "url": "https://github.com/t3tra-dev/cve-2025-29927-demo" }, { "repository": "PoC-in-GitHub · websecnl/CVE-2025-29927-PoC-Exploit", "author": "websecnl", "first_seen": "2025-03-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 20, "title": "Proof-of-Concept for Authorization Bypass in Next.js Middleware", "summary": "Proof-of-Concept for Authorization Bypass in Next.js Middleware", "url": "https://github.com/websecnl/CVE-2025-29927-PoC-Exploit" }, { "repository": "PoC-in-GitHub · MuhammadWaseem29/CVE-2025-29927-POC", "author": "MuhammadWaseem29", "first_seen": "2025-03-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 10, "title": "Authorization Bypass in Next.js Middleware", "summary": "Authorization Bypass in Next.js Middleware", "url": "https://github.com/MuhammadWaseem29/CVE-2025-29927-POC" }, { "repository": "PoC-in-GitHub · strobes-security/nextjs-vulnerable-app", "author": "strobes-security", "first_seen": "2025-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "CVE-2025-29927 lab", "summary": "CVE-2025-29927 lab", "url": "https://github.com/strobes-security/nextjs-vulnerable-app" }, { "repository": "PoC-in-GitHub · RoyCampos/CVE-2025-29927", "author": "RoyCampos", "first_seen": "2025-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-29927 Exploit Checker", "summary": "CVE-2025-29927 Exploit Checker", "url": "https://github.com/RoyCampos/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · fourcube/nextjs-middleware-bypass-demo", "author": "fourcube", "first_seen": "2025-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "Demo for Next.js middleware bypass - CVE-2025-29927", "summary": "Demo for Next.js middleware bypass - CVE-2025-29927", "url": "https://github.com/fourcube/nextjs-middleware-bypass-demo" }, { "repository": "PoC-in-GitHub · iSee857/CVE-2025-29927", "author": "iSee857", "first_seen": "2025-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Next.Js 权限绕过漏洞(CVE-2025-29927)", "summary": "Next.Js 权限绕过漏洞(CVE-2025-29927)", "url": "https://github.com/iSee857/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · Eve-SatOrU/POC-CVE-2025-29927", "author": "Eve-SatOrU", "first_seen": "2025-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "CVE-2025-29927 Proof of Concept", "summary": "CVE-2025-29927 Proof of Concept", "url": "https://github.com/Eve-SatOrU/POC-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · arvion-agent/next-CVE-2025-29927", "author": "arvion-agent", "first_seen": "2025-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-29927 Authorization Bypass in Next.js Middleware", "summary": "CVE-2025-29927 Authorization Bypass in Next.js Middleware", "url": "https://github.com/arvion-agent/next-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · Oyst3r1ng/CVE-2025-29927", "author": "Oyst3r1ng", "first_seen": "2025-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Next.js Middleware Auth Bypass", "summary": "Next.js Middleware Auth Bypass", "url": "https://github.com/Oyst3r1ng/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · lem0n817/CVE-2025-29927", "author": "lem0n817", "first_seen": "2025-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Next.js 中间件授权绕过漏洞测试环境 (CVE-2025-29927)", "summary": "Next.js 中间件授权绕过漏洞测试环境 (CVE-2025-29927)", "url": "https://github.com/lem0n817/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · kuzushiki/CVE-2025-29927-test", "author": "kuzushiki", "first_seen": "2025-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-29927の検証", "summary": "CVE-2025-29927の検証", "url": "https://github.com/kuzushiki/CVE-2025-29927-test" }, { "repository": "PoC-in-GitHub · ricsirigu/CVE-2025-29927", "author": "ricsirigu", "first_seen": "2025-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A deliberately Next.js app, vulnerable to CVE-2025-29927, Authorization Bypass", "summary": "A deliberately Next.js app, vulnerable to CVE-2025-29927, Authorization Bypass", "url": "https://github.com/ricsirigu/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · 0xWhoknows/CVE-2025-29927", "author": "0xWhoknows", "first_seen": "2025-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "Async Python scanner for Next.js CVE-2025-29927. Uses aiohttp & aiofiles to efficiently process large URL lists, detect vulnerabilities, and save results. Features connection pooling, caching, and chunked processing for fast performance", "summary": "Async Python scanner for Next.js CVE-2025-29927. Uses aiohttp & aiofiles to efficiently process large URL lists, detect vulnerabilities, and save results. Features connection pooling, caching, and chunked processing for fast performance", "url": "https://github.com/0xWhoknows/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · elshaheedy/CVE-2025-29927-Sigma-Rule", "author": "elshaheedy", "first_seen": "2025-03-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Sigma Rule for CVE-2025–29927 Detection", "summary": "Sigma Rule for CVE-2025–29927 Detection", "url": "https://github.com/elshaheedy/CVE-2025-29927-Sigma-Rule" }, { "repository": "PoC-in-GitHub · furmak331/CVE-2025-29927", "author": "furmak331", "first_seen": "2025-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Critical vulnerability in next.js : Bypass middleware authentication", "summary": "Critical vulnerability in next.js : Bypass middleware authentication", "url": "https://github.com/furmak331/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · phoscoder/ghost-route", "author": "phoscoder", "first_seen": "2025-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 9, "title": "Ghost Route detects if a Next JS site is vulnerable to the corrupt middleware bypass bug (CVE-2025-29927)", "summary": "Ghost Route detects if a Next JS site is vulnerable to the corrupt middleware bypass bug (CVE-2025-29927)", "url": "https://github.com/phoscoder/ghost-route" }, { "repository": "PoC-in-GitHub · 0xPb1/Next.js-CVE-2025-29927", "author": "0xPb1", "first_seen": "2025-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/0xPb1/Next.js-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · jeymo092/cve-2025-29927", "author": "jeymo092", "first_seen": "2025-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/jeymo092/cve-2025-29927" }, { "repository": "PoC-in-GitHub · alihussainzada/CVE-2025-29927-PoC", "author": "alihussainzada", "first_seen": "2025-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "PoC for CVE-2025-29927: Next.js Middleware Bypass Vulnerability. Demonstrates how x-middleware-subrequest can bypass authentication checks. Includes Docker setup for testing.", "summary": "PoC for CVE-2025-29927: Next.js Middleware Bypass Vulnerability. Demonstrates how x-middleware-subrequest can bypass authentication checks. Includes Docker setup for testing.", "url": "https://github.com/alihussainzada/CVE-2025-29927-PoC" }, { "repository": "PoC-in-GitHub · TheresAFewConors/CVE-2025-29927-Testing", "author": "TheresAFewConors", "first_seen": "2025-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "PowerShell script to test if a web app is vulnerable to CVE-2025-29927", "summary": "PowerShell script to test if a web app is vulnerable to CVE-2025-29927", "url": "https://github.com/TheresAFewConors/CVE-2025-29927-Testing" }, { "repository": "PoC-in-GitHub · 0xPThree/next.js_cve-2025-29927", "author": "0xPThree", "first_seen": "2025-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/0xPThree/next.js_cve-2025-29927" }, { "repository": "PoC-in-GitHub · 0xcucumbersalad/cve-2025-29927", "author": "0xcucumbersalad", "first_seen": "2025-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/0xcucumbersalad/cve-2025-29927" }, { "repository": "PoC-in-GitHub · c0dejump/CVE-2025-29927-check", "author": "c0dejump", "first_seen": "2025-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "script to check cve \"CVE-2025-29927\" while waiting to add it to HExHTTP", "summary": "script to check cve \"CVE-2025-29927\" while waiting to add it to HExHTTP", "url": "https://github.com/c0dejump/CVE-2025-29927-check" }, { "repository": "PoC-in-GitHub · maronnjapan/claude-create-CVE-2025-29927", "author": "maronnjapan", "first_seen": "2025-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/maronnjapan/claude-create-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · kOaDT/poc-cve-2025-29927", "author": "kOaDT", "first_seen": "2025-03-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "This repository contains a proof of concept (POC) and an exploit script for CVE-2025-29927, a critical vulnerability in Next.js that allows attackers to bypass authorization checks implemented in middleware.", "summary": "This repository contains a proof of concept (POC) and an exploit script for CVE-2025-29927, a critical vulnerability in Next.js that allows attackers to bypass authorization checks implemented in middleware.", "url": "https://github.com/kOaDT/poc-cve-2025-29927" }, { "repository": "PoC-in-GitHub · yugo-eliatrope/test-cve-2025-29927", "author": "yugo-eliatrope", "first_seen": "2025-03-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/yugo-eliatrope/test-cve-2025-29927" }, { "repository": "PoC-in-GitHub · emadshanab/CVE-2025-29927", "author": "emadshanab", "first_seen": "2025-03-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "New nuclei CVE", "summary": "New nuclei CVE", "url": "https://github.com/emadshanab/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · w3shinew/CVE-2025-29927", "author": "w3shinew", "first_seen": "2025-03-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A touch of security", "summary": "A touch of security", "url": "https://github.com/w3shinew/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · aleongx/CVE-2025-29927", "author": "aleongx", "first_seen": "2025-03-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Next.js Acceso no autorizado CVE-2025-29927", "summary": "Next.js Acceso no autorizado CVE-2025-29927", "url": "https://github.com/aleongx/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · nicknisi/next-attack", "author": "nicknisi", "first_seen": "2025-03-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "A demo of the CVE-2025-29927 vulnerability for a NebraskaJS lightning talk", "summary": "A demo of the CVE-2025-29927 vulnerability for a NebraskaJS lightning talk", "url": "https://github.com/nicknisi/next-attack" }, { "repository": "PoC-in-GitHub · jmbowes/NextSecureScan", "author": "jmbowes", "first_seen": "2025-03-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Next.js CVE-2025-29927 Vulnerability Scanner", "summary": "Next.js CVE-2025-29927 Vulnerability Scanner", "url": "https://github.com/jmbowes/NextSecureScan" }, { "repository": "PoC-in-GitHub · aleongx/CVE-2025-29927_Scanner", "author": "aleongx", "first_seen": "2025-03-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Este script verifica la vulnerabilidad CVE-2025-29927 en servidores Next.js, probando múltiples cargas en la cabecera x-middleware-subrequest para detectar accesos no autorizados.", "summary": "Este script verifica la vulnerabilidad CVE-2025-29927 en servidores Next.js, probando múltiples cargas en la cabecera x-middleware-subrequest para detectar accesos no autorizados.", "url": "https://github.com/aleongx/CVE-2025-29927_Scanner" }, { "repository": "PoC-in-GitHub · Nekicj/CVE-2025-29927-exploit", "author": "Nekicj", "first_seen": "2025-03-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "next.js CVE-2025-29927 vulnerability exploit", "summary": "next.js CVE-2025-29927 vulnerability exploit", "url": "https://github.com/Nekicj/CVE-2025-29927-exploit" }, { "repository": "PoC-in-GitHub · Heimd411/CVE-2025-29927-PoC", "author": "Heimd411", "first_seen": "2025-03-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/Heimd411/CVE-2025-29927-PoC" }, { "repository": "PoC-in-GitHub · m2hcz/PoC-for-Next.js-Middleware", "author": "m2hcz", "first_seen": "2025-03-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "> 🔓 Proof-of-Concept for a fictional Next.js middleware bypass (CVE-2025-29927) — craft sub-requests to test protected routes.", "summary": "> 🔓 Proof-of-Concept for a fictional Next.js middleware bypass (CVE-2025-29927) — craft sub-requests to test protected routes.", "url": "https://github.com/m2hcz/PoC-for-Next.js-Middleware" }, { "repository": "PoC-in-GitHub · nocomp/CVE-2025-29927-scanner", "author": "nocomp", "first_seen": "2025-03-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "python script for evaluate if you are vulnerable or not to next.js CVE-2025-29927", "summary": "python script for evaluate if you are vulnerable or not to next.js CVE-2025-29927", "url": "https://github.com/nocomp/CVE-2025-29927-scanner" }, { "repository": "PoC-in-GitHub · yuzu-juice/CVE-2025-29927_demo", "author": "yuzu-juice", "first_seen": "2025-03-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This repository is for educational and research purposes.", "summary": "This repository is for educational and research purposes.", "url": "https://github.com/yuzu-juice/CVE-2025-29927_demo" }, { "repository": "PoC-in-GitHub · AnonKryptiQuz/NextSploit", "author": "AnonKryptiQuz", "first_seen": "2025-03-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 92, "title": "NextSploit is a command-line tool designed to detect and exploit CVE-2025-29927, a security flaw in Next.js", "summary": "NextSploit is a command-line tool designed to detect and exploit CVE-2025-29927, a security flaw in Next.js", "url": "https://github.com/AnonKryptiQuz/NextSploit" }, { "repository": "PoC-in-GitHub · w2hcorp/CVE-2025-29927-PoC", "author": "w2hcorp", "first_seen": "2025-03-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Here is a simple but effective exploit for CVE-2025-29927.", "summary": "Here is a simple but effective exploit for CVE-2025-29927.", "url": "https://github.com/w2hcorp/CVE-2025-29927-PoC" }, { "repository": "PoC-in-GitHub · ferpalma21/Automated-Next.js-Security-Scanner-for-CVE-2025-29927", "author": "ferpalma21", "first_seen": "2025-03-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "This script scans a list of URLs to detect if they are using **Next.js** and determines whether they are vulnerable to **CVE-2025-29927**. It optionally attempts exploitation using a wordlist.", "summary": "This script scans a list of URLs to detect if they are using **Next.js** and determines whether they are vulnerable to **CVE-2025-29927**. It optionally attempts exploitation using a wordlist.", "url": "https://github.com/ferpalma21/Automated-Next.js-Security-Scanner-for-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · dante01yoon/CVE-2025-29927", "author": "dante01yoon", "first_seen": "2025-03-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Next.js CVE-2025-29927 demonstration", "summary": "Next.js CVE-2025-29927 demonstration", "url": "https://github.com/dante01yoon/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · ayato-shitomi/WebLab_CVE-2025-29927", "author": "ayato-shitomi", "first_seen": "2025-03-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Next.js Auth Bypass Lab ‐ CVE-2025-29927", "summary": "Next.js Auth Bypass Lab ‐ CVE-2025-29927", "url": "https://github.com/ayato-shitomi/WebLab_CVE-2025-29927" }, { "repository": "PoC-in-GitHub · Kamal-418/Vulnerable-Lab-NextJS-CVE-2025-29927", "author": "Kamal-418", "first_seen": "2025-03-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/Kamal-418/Vulnerable-Lab-NextJS-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · Ev3rPalestine/0xMiddleware", "author": "Ev3rPalestine", "first_seen": "2025-03-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927: Next.js Middleware Exploit", "summary": "CVE-2025-29927: Next.js Middleware Exploit", "url": "https://github.com/Ev3rPalestine/0xMiddleware" }, { "repository": "PoC-in-GitHub · dedibagus/cve-2025-29927-poc", "author": "dedibagus", "first_seen": "2025-04-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Authorization Bypass in Next.js Middleware", "summary": "Authorization Bypass in Next.js Middleware", "url": "https://github.com/dedibagus/cve-2025-29927-poc" }, { "repository": "PoC-in-GitHub · alastair66/CVE-2025-29927", "author": "alastair66", "first_seen": "2025-04-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Next.js Middleware Bypass Vulnerability", "summary": "Next.js Middleware Bypass Vulnerability", "url": "https://github.com/alastair66/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · 0xb1lal/CVE-2025-29927", "author": "0xb1lal", "first_seen": "2025-04-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Next.js CVE-2025-29927 güvenlik açığı hakkında", "summary": "Next.js CVE-2025-29927 güvenlik açığı hakkında", "url": "https://github.com/0xb1lal/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · JOOJIII/CVE-2025-29927", "author": "JOOJIII", "first_seen": "2025-04-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/JOOJIII/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · Naveen-005/Next.Js-middleware-bypass-vulnerability-CVE-2025-29927", "author": "Naveen-005", "first_seen": "2025-04-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A basic proof of concept of the CVE-2025-29927 vulnerability that allows to bypass the middleware scripts.", "summary": "A basic proof of concept of the CVE-2025-29927 vulnerability that allows to bypass the middleware scripts.", "url": "https://github.com/Naveen-005/Next.Js-middleware-bypass-vulnerability-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · Gokul-Krishnan-V-R/cve-2025-29927", "author": "Gokul-Krishnan-V-R", "first_seen": "2025-04-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Next.js and the corrupt middleware...TRY TO HACK IT..!", "summary": "Next.js and the corrupt middleware...TRY TO HACK IT..!", "url": "https://github.com/Gokul-Krishnan-V-R/cve-2025-29927" }, { "repository": "PoC-in-GitHub · fahimalshihab/NextBypass", "author": "fahimalshihab", "first_seen": "2025-04-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Next.js Middleware Authorization Bypass Tool (CVE-2025-29927)", "summary": "Next.js Middleware Authorization Bypass Tool (CVE-2025-29927)", "url": "https://github.com/fahimalshihab/NextBypass" }, { "repository": "PoC-in-GitHub · all3njk/NextJS_CVE-2025-29927", "author": "all3njk", "first_seen": "2025-04-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/all3njk/NextJS_CVE-2025-29927" }, { "repository": "PoC-in-GitHub · Balajih4kr/cve-2025-29927", "author": "Balajih4kr", "first_seen": "2025-04-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 is a critical vulnerability in Next.js, a popular React-based web framework. The flaw exists in how the middleware feature handles certain internal headers — specifically, the x-middleware-subrequest header", "summary": "CVE-2025-29927 is a critical vulnerability in Next.js, a popular React-based web framework. The flaw exists in how the middleware feature handles certain internal headers — specifically, the x-middleware-subrequest header", "url": "https://github.com/Balajih4kr/cve-2025-29927" }, { "repository": "PoC-in-GitHub · YEONDG/nextjs-cve-2025-29927", "author": "YEONDG", "first_seen": "2025-04-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "vulnerable-nextjs-14-CVE-2025-29927", "summary": "vulnerable-nextjs-14-CVE-2025-29927", "url": "https://github.com/YEONDG/nextjs-cve-2025-29927" }, { "repository": "PoC-in-GitHub · gotr00t0day/CVE-2025-29927", "author": "gotr00t0day", "first_seen": "2025-04-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "Next.js Middleware Bypass Scanne", "summary": "Next.js Middleware Bypass Scanne", "url": "https://github.com/gotr00t0day/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · pixilated730/NextJS-Exploit-", "author": "pixilated730", "first_seen": "2025-04-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-29927", "summary": "CVE-2025-29927", "url": "https://github.com/pixilated730/NextJS-Exploit-" }, { "repository": "PoC-in-GitHub · ValGrace/middleware-auth-bypass", "author": "ValGrace", "first_seen": "2025-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 ~ a poc of the next.js middleware authentication bypass", "summary": "CVE-2025-29927 ~ a poc of the next.js middleware authentication bypass", "url": "https://github.com/ValGrace/middleware-auth-bypass" }, { "repository": "PoC-in-GitHub · 0xnxt1me/CVE-2025-29927", "author": "0xnxt1me", "first_seen": "2025-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/0xnxt1me/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · pickovven/vulnerable-nextjs-14-CVE-2025-29927", "author": "pickovven", "first_seen": "2025-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/pickovven/vulnerable-nextjs-14-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · l1uk/nextjs-middleware-exploit", "author": "l1uk", "first_seen": "2025-04-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Research on Next.js middleware vulnerability (CVE-2025-29927) allowing authorization bypass and potential exploits.", "summary": "Research on Next.js middleware vulnerability (CVE-2025-29927) allowing authorization bypass and potential exploits.", "url": "https://github.com/l1uk/nextjs-middleware-exploit" }, { "repository": "PoC-in-GitHub · darklotuskdb/nextjs-CVE-2025-29927-hunter", "author": "darklotuskdb", "first_seen": "2025-04-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Next.js CVE-2025-29927 Hunter", "summary": "Next.js CVE-2025-29927 Hunter", "url": "https://github.com/darklotuskdb/nextjs-CVE-2025-29927-hunter" }, { "repository": "PoC-in-GitHub · ethanol1310/POC-CVE-2025-29927-", "author": "ethanol1310", "first_seen": "2025-04-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "POC CVE-2025-29927", "summary": "POC CVE-2025-29927", "url": "https://github.com/ethanol1310/POC-CVE-2025-29927-" }, { "repository": "PoC-in-GitHub · UNICORDev/exploit-CVE-2025-29927", "author": "UNICORDev", "first_seen": "2025-04-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 14, "title": "Exploit for CVE-2025-29927 (Next.js) - Authorization Bypass", "summary": "Exploit for CVE-2025-29927 (Next.js) - Authorization Bypass", "url": "https://github.com/UNICORDev/exploit-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · Knotsecurity/CVE-2025-29927-NextJs-Middleware-Simulation", "author": "Knotsecurity", "first_seen": "2025-04-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Simulates CVE-2025-29927, a critical Next.js vulnerability allowing attackers to bypass middleware authorization by exploiting the internal x-middleware-subrequest HTTP header. Demonstrates unauthorized access to protected routes and provides mitigation strategies.", "summary": "Simulates CVE-2025-29927, a critical Next.js vulnerability allowing attackers to bypass middleware authorization by exploiting the internal x-middleware-subrequest HTTP header. Demonstrates unauthorized access to protected routes and provides mitigation strategies.", "url": "https://github.com/Knotsecurity/CVE-2025-29927-NextJs-Middleware-Simulation" }, { "repository": "PoC-in-GitHub · mhamzakhattak/CVE-2025-29927", "author": "mhamzakhattak", "first_seen": "2025-04-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/mhamzakhattak/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · enochgitgamefied/NextJS-CVE-2025-29927", "author": "enochgitgamefied", "first_seen": "2025-04-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/enochgitgamefied/NextJS-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · Grand-Moomin/Vuln-Next.js-CVE-2025-29927", "author": "Grand-Moomin", "first_seen": "2025-04-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/Grand-Moomin/Vuln-Next.js-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · pouriam23/Next.js-Middleware-Bypass-CVE-2025-29927-", "author": "pouriam23", "first_seen": "2025-04-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/pouriam23/Next.js-Middleware-Bypass-CVE-2025-29927-" }, { "repository": "PoC-in-GitHub · kh4sh3i/CVE-2025-29927", "author": "kh4sh3i", "first_seen": "2025-04-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2025-29927: Next.js Middleware Bypass Vulnerability", "summary": "CVE-2025-29927: Next.js Middleware Bypass Vulnerability", "url": "https://github.com/kh4sh3i/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · EQSTLab/CVE-2025-29927", "author": "EQSTLab", "first_seen": "2025-04-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Next.js middleware bypass exploit", "summary": "Next.js middleware bypass exploit", "url": "https://github.com/EQSTLab/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · Hirainsingadia/CVE-2025-29927", "author": "Hirainsingadia", "first_seen": "2025-04-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Next js middlewareauth Bypass", "summary": "Next js middlewareauth Bypass", "url": "https://github.com/Hirainsingadia/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · HoumanPashaei/CVE-2025-29927", "author": "HoumanPashaei", "first_seen": "2025-04-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "This is a CVE-2025-29927 Scanner.", "summary": "This is a CVE-2025-29927 Scanner.", "url": "https://github.com/HoumanPashaei/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · rubbxalc/CVE-2025-29927", "author": "rubbxalc", "first_seen": "2025-04-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/rubbxalc/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · olimpiofreitas/CVE-2025-29927-scanner", "author": "olimpiofreitas", "first_seen": "2025-05-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/olimpiofreitas/CVE-2025-29927-scanner" }, { "repository": "PoC-in-GitHub · moften/CVE-2025-29927_Next.js_Auth_Bypass", "author": "moften", "first_seen": "2025-05-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Next.js Auth Bypass PoC Edge Runtime Env Leak via Middleware Bug", "summary": "Next.js Auth Bypass PoC Edge Runtime Env Leak via Middleware Bug", "url": "https://github.com/moften/CVE-2025-29927_Next.js_Auth_Bypass" }, { "repository": "PoC-in-GitHub · EarthAngel666/x-middleware-exploit", "author": "EarthAngel666", "first_seen": "2025-05-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "x-middleware exploit for next.js CVE-2023–46298 cache poisoning and CVE-2025-29927 bypass", "summary": "x-middleware exploit for next.js CVE-2023–46298 cache poisoning and CVE-2025-29927 bypass", "url": "https://github.com/EarthAngel666/x-middleware-exploit" }, { "repository": "PoC-in-GitHub · lstudlo/nextjs-cve-demo", "author": "lstudlo", "first_seen": "2025-05-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "演示 Next.js 中的 Middleware 授權繞過漏洞 (CVE-2025-29927) 允許未經授權的用戶存取受保護的資訊。", "summary": "演示 Next.js 中的 Middleware 授權繞過漏洞 (CVE-2025-29927) 允許未經授權的用戶存取受保護的資訊。", "url": "https://github.com/lstudlo/nextjs-cve-demo" }, { "repository": "PoC-in-GitHub · enochgitgamefied/NextJS-CVE-2025-29927-Docker-Lab", "author": "enochgitgamefied", "first_seen": "2025-05-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/enochgitgamefied/NextJS-CVE-2025-29927-Docker-Lab" }, { "repository": "PoC-in-GitHub · sagsooz/CVE-2025-29927", "author": "sagsooz", "first_seen": "2025-05-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "🔐 Python-based smart scanner for CVE-2025-29927 — Next.js middleware authentication bypass vulnerability. Detects meta refresh, keyword-based redirects, and more.", "summary": "🔐 Python-based smart scanner for CVE-2025-29927 — Next.js middleware authentication bypass vulnerability. Detects meta refresh, keyword-based redirects, and more.", "url": "https://github.com/sagsooz/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · SugiB3o/vulnerable-nextjs-14-CVE-2025-29927", "author": "SugiB3o", "first_seen": "2025-05-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "vulnerable-nextjs-14-CVE-2025-29927", "summary": "vulnerable-nextjs-14-CVE-2025-29927", "url": "https://github.com/SugiB3o/vulnerable-nextjs-14-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · amitlttwo/Next.JS-CVE-2025-29927", "author": "amitlttwo", "first_seen": "2025-06-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/amitlttwo/Next.JS-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · kazuya256/next-js-auth-bypass", "author": "kazuya256", "first_seen": "2025-07-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "🔓 Next.js Auth Bypass Demo - Educational application demonstrating CVE-2025-29927 middleware authentication bypass vulnerability . ⚠️ For educational use only.[Made using Ai]", "summary": "🔓 Next.js Auth Bypass Demo - Educational application demonstrating CVE-2025-29927 middleware authentication bypass vulnerability . ⚠️ For educational use only.[Made using Ai]", "url": "https://github.com/kazuya256/next-js-auth-bypass" }, { "repository": "PoC-in-GitHub · mickhacking/Thank-u-Next", "author": "mickhacking", "first_seen": "2025-07-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 PoC | Auth Bypass Exploit | Python Tool using httpx | Middleware Vulnerability | Ethical Hacking Toolkit", "summary": "CVE-2025-29927 PoC | Auth Bypass Exploit | Python Tool using httpx | Middleware Vulnerability | Ethical Hacking Toolkit", "url": "https://github.com/mickhacking/Thank-u-Next" }, { "repository": "PoC-in-GitHub · b4sh0xf/PoC-CVE-2025-29927", "author": "b4sh0xf", "first_seen": "2025-07-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "→ poc for CVE-2025-29927", "summary": "→ poc for CVE-2025-29927", "url": "https://github.com/b4sh0xf/PoC-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · rgvillanueva28/vulnbox-easy-CVE-2025-29927", "author": "rgvillanueva28", "first_seen": "2025-07-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/rgvillanueva28/vulnbox-easy-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · s11s11/CVE-2025-29927", "author": "s11s11", "first_seen": "2025-08-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Demo of CVE-2025-29927 for secure programming class", "summary": "Demo of CVE-2025-29927 for secure programming class", "url": "https://github.com/s11s11/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · R3verseIN/Nextjs-middleware-vulnerable-appdemo-CVE-2025-29927", "author": "R3verseIN", "first_seen": "2025-08-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/R3verseIN/Nextjs-middleware-vulnerable-appdemo-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · zs1n/CVE-2025-29927", "author": "zs1n", "first_seen": "2025-08-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PoC | NextJS Middleware 15.2.2 - Authorization Bypass", "summary": "PoC | NextJS Middleware 15.2.2 - Authorization Bypass", "url": "https://github.com/zs1n/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · MKIRAHMET/CVE-2025-29927-PoC", "author": "MKIRAHMET", "first_seen": "2025-09-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This repository contains **research and analysis** related to CVE-2025-29927. It demonstrates safe, controlled testing approaches for a path traversal/middleware misconfiguration vulnerability in web applications.", "summary": "This repository contains **research and analysis** related to CVE-2025-29927. It demonstrates safe, controlled testing approaches for a path traversal/middleware misconfiguration vulnerability in web applications.", "url": "https://github.com/MKIRAHMET/CVE-2025-29927-PoC" }, { "repository": "PoC-in-GitHub · adjscent/vulnerable-nextjs-14-CVE-2025-29927", "author": "adjscent", "first_seen": "2025-09-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "do not use. vulnerable", "summary": "do not use. vulnerable", "url": "https://github.com/adjscent/vulnerable-nextjs-14-CVE-2025-29927" }, { "repository": "PoC-in-GitHub · sdrtba/CVE-2025-29927", "author": "sdrtba", "first_seen": "2025-09-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/sdrtba/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · iteride/CVE-2025-29927", "author": "iteride", "first_seen": "2025-09-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/iteride/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · sermikr0/nextjs-middleware-auth-bypass", "author": "sermikr0", "first_seen": "2025-09-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-29927", "summary": "CVE-2025-29927", "url": "https://github.com/sermikr0/nextjs-middleware-auth-bypass" }, { "repository": "PoC-in-GitHub · amalpvatayam67/day10-nextjs-middleware-lab", "author": "amalpvatayam67", "first_seen": "2025-09-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Next.js middleware auth-bypass lab (CVE-2025-29927 simulation)", "summary": "Next.js middleware auth-bypass lab (CVE-2025-29927 simulation)", "url": "https://github.com/amalpvatayam67/day10-nextjs-middleware-lab" }, { "repository": "PoC-in-GitHub · diogolourencodev/middleforce", "author": "diogolourencodev", "first_seen": "2025-10-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Simple script to attempt a Bypass on a server possibly vulnerable to CVE-2025-29927 (Next.js Middleware)", "summary": "Simple script to attempt a Bypass on a server possibly vulnerable to CVE-2025-29927 (Next.js Middleware)", "url": "https://github.com/diogolourencodev/middleforce" }, { "repository": "PoC-in-GitHub · Bongni/CVE-2025-29927", "author": "Bongni", "first_seen": "2025-10-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Reproduction and fix of the CVE-2025-29927 vulnerability.", "summary": "Reproduction and fix of the CVE-2025-29927 vulnerability.", "url": "https://github.com/Bongni/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · NS-Projects-Unina/CTF_CVE_DSP_1", "author": "NS-Projects-Unina", "first_seen": "2025-10-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Una CTF, in formato DSP-compliant, basata sulla CVE-2025-29927 di nextjs.", "summary": "Una CTF, in formato DSP-compliant, basata sulla CVE-2025-29927 di nextjs.", "url": "https://github.com/NS-Projects-Unina/CTF_CVE_DSP_1" }, { "repository": "PoC-in-GitHub · lucaschanzx/CVE-2025-29927-PoC", "author": "lucaschanzx", "first_seen": "2025-10-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/lucaschanzx/CVE-2025-29927-PoC" }, { "repository": "PoC-in-GitHub · liamromanis101/CVE-2025-29927-NextJS", "author": "liamromanis101", "first_seen": "2025-12-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "PoC for testing CVE-2025-29927 for Next.js versions 11.x, 12.x <= 12.3.5, 13.x <= 13.5.9, 14.x <=14.2.25, 15.x <= 15.2.3", "summary": "PoC for testing CVE-2025-29927 for Next.js versions 11.x, 12.x <= 12.3.5, 13.x <= 13.5.9, 14.x <=14.2.25, 15.x <= 15.2.3", "url": "https://github.com/liamromanis101/CVE-2025-29927-NextJS" }, { "repository": "PoC-in-GitHub · DanielHallbro/CVE-2025-29927-Nextjs-Bypass-PoC", "author": "DanielHallbro", "first_seen": "2026-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A Proof of Concept for CVE-2025-29927 demonstrating a middleware bypass in Next.js versions prior to 13.5.9", "summary": "A Proof of Concept for CVE-2025-29927 demonstrating a middleware bypass in Next.js versions prior to 13.5.9", "url": "https://github.com/DanielHallbro/CVE-2025-29927-Nextjs-Bypass-PoC" }, { "repository": "PoC-in-GitHub · Si-Ni/CVE-2025-29927-Proof-of-Concept", "author": "Si-Ni", "first_seen": "2026-02-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Capture the Flag challenge: CVE-2025-29927 in combination with a command injection vulnerability", "summary": "Capture the Flag challenge: CVE-2025-29927 in combination with a command injection vulnerability", "url": "https://github.com/Si-Ni/CVE-2025-29927-Proof-of-Concept" }, { "repository": "PoC-in-GitHub · sangrok-jeon/CVE-2025-29927-Nextjs-Analysis", "author": "sangrok-jeon", "first_seen": "2026-03-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2025-29927-Nextjs 분석 보고서", "summary": "CVE-2025-29927-Nextjs 분석 보고서", "url": "https://github.com/sangrok-jeon/CVE-2025-29927-Nextjs-Analysis" }, { "repository": "PoC-in-GitHub · Toddkk02/CVE-2025-29927", "author": "Toddkk02", "first_seen": "2026-03-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/Toddkk02/CVE-2025-29927" }, { "repository": "PoC-in-GitHub · hujiaozhuzhu/CVE-2025-29927__Next.js", "author": "hujiaozhuzhu", "first_seen": "2026-04-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 - Next.js漏洞测试工具", "summary": "CVE-2025-29927 - Next.js漏洞测试工具", "url": "https://github.com/hujiaozhuzhu/CVE-2025-29927__Next.js" }, { "repository": "PoC-in-GitHub · metasploit403/cve-2025-29927-lab", "author": "metasploit403", "first_seen": "2026-04-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Deliberately vulnerable Next.js application demonstrating CVE-2025-29927 (middleware-based auth bypass) for learning and bug bounty practice.", "summary": "Deliberately vulnerable Next.js application demonstrating CVE-2025-29927 (middleware-based auth bypass) for learning and bug bounty practice.", "url": "https://github.com/metasploit403/cve-2025-29927-lab" }, { "repository": "PoC-in-GitHub · shahin-shadow/nextjs-auth-bypass", "author": "shahin-shadow", "first_seen": "2026-04-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Analysis and exploitation of a Next.js authorization bypass vulnerability (CVE-2025-29927)", "summary": "Analysis and exploitation of a Next.js authorization bypass vulnerability (CVE-2025-29927)", "url": "https://github.com/shahin-shadow/nextjs-auth-bypass" }, { "repository": "PoC-in-GitHub · TheWaterbug/alpr-dashboard-patches", "author": "TheWaterbug", "first_seen": "2026-04-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Runtime patches for algertc/alpr-dashboard: async logger fix and CVE-2025-29927 nginx mitigation", "summary": "Runtime patches for algertc/alpr-dashboard: async logger fix and CVE-2025-29927 nginx mitigation", "url": "https://github.com/TheWaterbug/alpr-dashboard-patches" }, { "repository": "PoC-in-GitHub · Nayekah/Next.js-Proof-of-Concept", "author": "Nayekah", "first_seen": "2026-04-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Some Proof-of-Concept (POCs) for CVE-2025-29927, CVE-2026-27978, and CVE-2026-29057 in Next.js.", "summary": "Some Proof-of-Concept (POCs) for CVE-2025-29927, CVE-2026-27978, and CVE-2026-29057 in Next.js.", "url": "https://github.com/Nayekah/Next.js-Proof-of-Concept" }, { "repository": "PoC-in-GitHub · bk-security/auth-header-trust-rules", "author": "bk-security", "first_seen": "2026-05-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Semgrep rules that flag header-trust auth bypass patterns (CVE-2025-29927 class). Companion to bk-security.github.io.", "summary": "Semgrep rules that flag header-trust auth bypass patterns (CVE-2025-29927 class). Companion to bk-security.github.io.", "url": "https://github.com/bk-security/auth-header-trust-rules" }, { "repository": "PoC-in-GitHub · gitgudKrish/cve-2025-29927-nextjs", "author": "gitgudKrish", "first_seen": "2026-05-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/gitgudKrish/cve-2025-29927-nextjs" }, { "repository": "PoC-in-GitHub · SwapnilDeshpande/cve-2025-29927-lab", "author": "SwapnilDeshpande", "first_seen": "2026-06-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Reproduction lab for CVE-2025-29927 — Next.js middleware authorization bypass (CVSS 9.1)", "summary": "Reproduction lab for CVE-2025-29927 — Next.js middleware authorization bypass (CVSS 9.1)", "url": "https://github.com/SwapnilDeshpande/cve-2025-29927-lab" }, { "repository": "PoC-in-GitHub · Fomovet/cve-2025-29927", "author": "Fomovet", "first_seen": "2026-06-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "POC for CVE-2025-29927", "summary": "POC for CVE-2025-29927", "url": "https://github.com/Fomovet/cve-2025-29927" }, { "repository": "PoC-in-GitHub · berraesen/nextjs-middleware-auth-bypass-lab", "author": "berraesen", "first_seen": "2026-08-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Bu laboratuvar ortamını sıfırdan kendim oluşturdum. Next.js uygulaması içerisinde giriş, ana sayfa ve admin sayfalarını hazırladım. Middleware ile yetkilendirme mekanizmasını kurduktan sonra Burp Suite kullanarak CVE-2025-29927 zafiyetini kontrollü ortamda gösterdim.", "summary": "Bu laboratuvar ortamını sıfırdan kendim oluşturdum. Next.js uygulaması içerisinde giriş, ana sayfa ve admin sayfalarını hazırladım. Middleware ile yetkilendirme mekanizmasını kurduktan sonra Burp Suite kullanarak CVE-2025-29927 zafiyetini kontrollü ortamda gösterdim.", "url": "https://github.com/berraesen/nextjs-middleware-auth-bypass-lab" }, { "repository": "PoC-in-GitHub · kuyrathdaro/cve-2025-29927", "author": "kuyrathdaro", "first_seen": "2026-08-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/kuyrathdaro/cve-2025-29927" }, { "repository": "PoC-in-GitHub · Ritinify/CVE-2025-29927-PoC", "author": "Ritinify", "first_seen": "2026-09-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-29927 repository", "summary": "", "url": "https://github.com/Ritinify/CVE-2025-29927-PoC" }, { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:41:19+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "Exploit for Improper Authorization in Vercel Next.Js", "summary": "Proof-of-concept exploit for CVE-2025-29927. CVSS 9.1.", "cvss": 9.1, "url": "https://sploitus.com/exploit?id=DD629C00-2E2D-5D29-B5B7-1E74EAF37DBF" } ], "references": [ "https://www.exploit-db.com/exploits/52124", "https://github.com/serhalp/test-cve-2025-29927", "https://github.com/Ademking/CVE-2025-29927", "https://github.com/6mile/nextjs-CVE-2025-29927", "https://github.com/azu/nextjs-cve-2025-29927-poc", "https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927", "https://github.com/aydinnyunus/CVE-2025-29927", "https://github.com/ticofookfook/poc-nextjs-CVE-2025-29927", "https://github.com/t3tra-dev/cve-2025-29927-demo", "https://github.com/websecnl/CVE-2025-29927-PoC-Exploit", "https://github.com/MuhammadWaseem29/CVE-2025-29927-POC", "https://github.com/strobes-security/nextjs-vulnerable-app", "https://github.com/RoyCampos/CVE-2025-29927", "https://github.com/fourcube/nextjs-middleware-bypass-demo", "https://github.com/iSee857/CVE-2025-29927", "https://github.com/Eve-SatOrU/POC-CVE-2025-29927", "https://github.com/arvion-agent/next-CVE-2025-29927", "https://github.com/Oyst3r1ng/CVE-2025-29927", "https://github.com/lem0n817/CVE-2025-29927", "https://github.com/kuzushiki/CVE-2025-29927-test", "https://github.com/ricsirigu/CVE-2025-29927", "https://github.com/0xWhoknows/CVE-2025-29927", "https://github.com/elshaheedy/CVE-2025-29927-Sigma-Rule", "https://github.com/furmak331/CVE-2025-29927", "https://github.com/phoscoder/ghost-route", "https://github.com/0xPb1/Next.js-CVE-2025-29927", "https://github.com/jeymo092/cve-2025-29927", "https://github.com/alihussainzada/CVE-2025-29927-PoC", "https://github.com/TheresAFewConors/CVE-2025-29927-Testing", "https://github.com/0xPThree/next.js_cve-2025-29927", "https://github.com/0xcucumbersalad/cve-2025-29927", "https://github.com/c0dejump/CVE-2025-29927-check", "https://github.com/maronnjapan/claude-create-CVE-2025-29927", "https://github.com/kOaDT/poc-cve-2025-29927", "https://github.com/yugo-eliatrope/test-cve-2025-29927", "https://github.com/emadshanab/CVE-2025-29927", "https://github.com/w3shinew/CVE-2025-29927", "https://github.com/aleongx/CVE-2025-29927", "https://github.com/nicknisi/next-attack", "https://github.com/jmbowes/NextSecureScan", "https://github.com/aleongx/CVE-2025-29927_Scanner", "https://github.com/Nekicj/CVE-2025-29927-exploit", "https://github.com/Heimd411/CVE-2025-29927-PoC", "https://github.com/m2hcz/PoC-for-Next.js-Middleware", "https://github.com/nocomp/CVE-2025-29927-scanner", "https://github.com/yuzu-juice/CVE-2025-29927_demo", "https://github.com/AnonKryptiQuz/NextSploit", "https://github.com/w2hcorp/CVE-2025-29927-PoC", "https://github.com/ferpalma21/Automated-Next.js-Security-Scanner-for-CVE-2025-29927", "https://github.com/dante01yoon/CVE-2025-29927", "https://github.com/ayato-shitomi/WebLab_CVE-2025-29927", "https://github.com/Kamal-418/Vulnerable-Lab-NextJS-CVE-2025-29927", "https://github.com/Ev3rPalestine/0xMiddleware", "https://github.com/dedibagus/cve-2025-29927-poc", "https://github.com/alastair66/CVE-2025-29927", "https://github.com/0xb1lal/CVE-2025-29927", "https://github.com/JOOJIII/CVE-2025-29927", "https://github.com/Naveen-005/Next.Js-middleware-bypass-vulnerability-CVE-2025-29927", "https://github.com/Gokul-Krishnan-V-R/cve-2025-29927", "https://github.com/fahimalshihab/NextBypass", "https://github.com/all3njk/NextJS_CVE-2025-29927", "https://github.com/Balajih4kr/cve-2025-29927", "https://github.com/YEONDG/nextjs-cve-2025-29927", "https://github.com/gotr00t0day/CVE-2025-29927", "https://github.com/pixilated730/NextJS-Exploit-", "https://github.com/ValGrace/middleware-auth-bypass", "https://github.com/0xnxt1me/CVE-2025-29927", "https://github.com/pickovven/vulnerable-nextjs-14-CVE-2025-29927", "https://github.com/l1uk/nextjs-middleware-exploit", "https://github.com/darklotuskdb/nextjs-CVE-2025-29927-hunter", "https://github.com/ethanol1310/POC-CVE-2025-29927-", "https://github.com/UNICORDev/exploit-CVE-2025-29927", "https://github.com/Knotsecurity/CVE-2025-29927-NextJs-Middleware-Simulation", "https://github.com/mhamzakhattak/CVE-2025-29927", "https://github.com/enochgitgamefied/NextJS-CVE-2025-29927", "https://github.com/Grand-Moomin/Vuln-Next.js-CVE-2025-29927", "https://github.com/pouriam23/Next.js-Middleware-Bypass-CVE-2025-29927-", "https://github.com/kh4sh3i/CVE-2025-29927", "https://github.com/EQSTLab/CVE-2025-29927", "https://github.com/Hirainsingadia/CVE-2025-29927", "https://github.com/HoumanPashaei/CVE-2025-29927", "https://github.com/rubbxalc/CVE-2025-29927", "https://github.com/olimpiofreitas/CVE-2025-29927-scanner", "https://github.com/moften/CVE-2025-29927_Next.js_Auth_Bypass", "https://github.com/EarthAngel666/x-middleware-exploit", "https://github.com/lstudlo/nextjs-cve-demo", "https://github.com/enochgitgamefied/NextJS-CVE-2025-29927-Docker-Lab", "https://github.com/sagsooz/CVE-2025-29927", "https://github.com/SugiB3o/vulnerable-nextjs-14-CVE-2025-29927", "https://github.com/amitlttwo/Next.JS-CVE-2025-29927", "https://github.com/kazuya256/next-js-auth-bypass", "https://github.com/mickhacking/Thank-u-Next", "https://github.com/b4sh0xf/PoC-CVE-2025-29927", "https://github.com/rgvillanueva28/vulnbox-easy-CVE-2025-29927", "https://github.com/s11s11/CVE-2025-29927", "https://github.com/R3verseIN/Nextjs-middleware-vulnerable-appdemo-CVE-2025-29927", "https://github.com/zs1n/CVE-2025-29927", "https://github.com/MKIRAHMET/CVE-2025-29927-PoC", "https://github.com/adjscent/vulnerable-nextjs-14-CVE-2025-29927", "https://github.com/sdrtba/CVE-2025-29927", "https://github.com/iteride/CVE-2025-29927", "https://github.com/sermikr0/nextjs-middleware-auth-bypass", "https://github.com/amalpvatayam67/day10-nextjs-middleware-lab", "https://github.com/diogolourencodev/middleforce", "https://github.com/Bongni/CVE-2025-29927", "https://github.com/NS-Projects-Unina/CTF_CVE_DSP_1", "https://github.com/lucaschanzx/CVE-2025-29927-PoC", "https://github.com/liamromanis101/CVE-2025-29927-NextJS", "https://github.com/DanielHallbro/CVE-2025-29927-Nextjs-Bypass-PoC", "https://github.com/Si-Ni/CVE-2025-29927-Proof-of-Concept", "https://github.com/sangrok-jeon/CVE-2025-29927-Nextjs-Analysis", "https://github.com/Toddkk02/CVE-2025-29927", "https://github.com/hujiaozhuzhu/CVE-2025-29927__Next.js", "https://github.com/metasploit403/cve-2025-29927-lab", "https://github.com/shahin-shadow/nextjs-auth-bypass", "https://github.com/TheWaterbug/alpr-dashboard-patches", "https://github.com/Nayekah/Next.js-Proof-of-Concept", "https://github.com/bk-security/auth-header-trust-rules", "https://github.com/gitgudKrish/cve-2025-29927-nextjs", "https://github.com/SwapnilDeshpande/cve-2025-29927-lab", "https://github.com/Fomovet/cve-2025-29927", "https://github.com/berraesen/nextjs-middleware-auth-bypass-lab", "https://github.com/kuyrathdaro/cve-2025-29927", "https://github.com/Ritinify/CVE-2025-29927-PoC", "https://sploitus.com/exploit?id=DD629C00-2E2D-5D29-B5B7-1E74EAF37DBF" ], "timeline": [ { "at": "2026-09-05T12:41:19Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52124" } ] }, { "id": "CVE-2025-25257", "vendor": "Fortinet", "product": "FortiWeb", "title": "Fortinet FortiWeb SQL Injection Vulnerability", "summary": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.", "updated_at": "2026-09-04T06:47:50Z", "published_at": "2026-09-04T06:47:50Z", "cvss": 9.8, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 52, "kev": true, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52473", "author": "Milad Karimi (Ex3ptionaL)", "first_seen": "2026-02-04", "confidence": "High", "title": "FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution", "summary": "FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution", "url": "https://www.exploit-db.com/exploits/52473", "verification": "verified", "verified": true }, { "title": "Exploit for CVE-2025-25257", "summary": "Pre-auth SQL injection to RCE in FortiWeb Fabric Connector enabling arbitrary command execution.", "what_happened": "Pre-auth SQL injection to RCE in FortiWeb Fabric Connector enabling arbitrary command execution.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-THESTINGR-CVE-2025-25257", "https://kitploit.com/ja/tools/github/thestingr/cve-2025-25257/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-04T08:47:50", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-THESTINGR-CVE-2025-25257" }, { "title": "Exploit for CVE-2025-25257", "summary": "Pre-auth SQL injection to RCE in FortiWeb Fabric Connector enabling arbitrary command execution.", "what_happened": "Pre-auth SQL injection to RCE in FortiWeb Fabric Connector enabling arbitrary command execution.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-THESTINGR-CVE-2025-25257", "https://kitploit.com/ja/tools/github/thestingr/cve-2025-25257/" ], "repository": "kitploit.com", "author": "ja", "first_seen": "2026-09-04T08:47:50", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ja/tools/github/thestingr/cve-2025-25257/" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/52473", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-THESTINGR-CVE-2025-25257", "https://kitploit.com/ja/tools/github/thestingr/cve-2025-25257/" ], "timeline": [ { "at": "2026-09-04T06:47:50Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-07-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-07-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-07-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-07-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-07-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-07-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-07-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-07-18", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2025-24252", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for AirBorne-PoC CVE-2025-24132 CVE-2025-24252", "summary": "Apple AirPlay mDNS crash and heap overflow in AirPlayReceiver daemon enable DoS and RCE.", "updated_at": "2026-08-25T12:42:36Z", "published_at": "2026-08-25T12:42:36Z", "cvss": 8.8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 21, "kev": false, "attack_vector": "Adjacent", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "Apple AirPlay mDNS crash and heap overflow in AirPlayReceiver daemon enable DoS and RCE.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for AirBorne-PoC CVE-2025-24132 CVE-2025-24252", "summary": "Apple AirPlay mDNS crash and heap overflow in AirPlayReceiver daemon enable DoS and RCE.", "what_happened": "Apple AirPlay mDNS crash and heap overflow in AirPlayReceiver daemon enable DoS and RCE.", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Adjacent", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EKOMSSAVIOR-AIRBORNE-POC", "https://kitploit.com/ru/tools/github/ekomssavior/airborne-poc/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-08-25T14:42:36", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EKOMSSAVIOR-AIRBORNE-POC" }, { "title": "Exploit for AirBorne-PoC CVE-2025-24132 CVE-2025-24252", "summary": "Apple AirPlay mDNS crash and heap overflow in AirPlayReceiver daemon enable DoS and RCE.", "what_happened": "Apple AirPlay mDNS crash and heap overflow in AirPlayReceiver daemon enable DoS and RCE.", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Adjacent", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EKOMSSAVIOR-AIRBORNE-POC", "https://kitploit.com/ru/tools/github/ekomssavior/airborne-poc/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-08-25T14:42:36", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/ekomssavior/airborne-poc/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EKOMSSAVIOR-AIRBORNE-POC", "https://kitploit.com/ru/tools/github/ekomssavior/airborne-poc/" ], "timeline": [ { "at": "2026-08-25T12:42:36Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EKOMSSAVIOR-AIRBORNE-POC" } ], "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2025-24132", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for AirBorne-PoC CVE-2025-24132 CVE-2025-24252", "summary": "Apple AirPlay mDNS crash and heap overflow in AirPlayReceiver daemon enable DoS and RCE.", "updated_at": "2026-08-25T12:42:36Z", "published_at": "2026-08-25T12:42:36Z", "cvss": 8.8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 21, "kev": false, "attack_vector": "Adjacent", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "Apple AirPlay mDNS crash and heap overflow in AirPlayReceiver daemon enable DoS and RCE.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for AirBorne-PoC CVE-2025-24132 CVE-2025-24252", "summary": "Apple AirPlay mDNS crash and heap overflow in AirPlayReceiver daemon enable DoS and RCE.", "what_happened": "Apple AirPlay mDNS crash and heap overflow in AirPlayReceiver daemon enable DoS and RCE.", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Adjacent", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EKOMSSAVIOR-AIRBORNE-POC", "https://kitploit.com/ru/tools/github/ekomssavior/airborne-poc/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-08-25T14:42:36", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EKOMSSAVIOR-AIRBORNE-POC" }, { "title": "Exploit for AirBorne-PoC CVE-2025-24132 CVE-2025-24252", "summary": "Apple AirPlay mDNS crash and heap overflow in AirPlayReceiver daemon enable DoS and RCE.", "what_happened": "Apple AirPlay mDNS crash and heap overflow in AirPlayReceiver daemon enable DoS and RCE.", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Adjacent", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EKOMSSAVIOR-AIRBORNE-POC", "https://kitploit.com/ru/tools/github/ekomssavior/airborne-poc/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-08-25T14:42:36", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/ekomssavior/airborne-poc/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EKOMSSAVIOR-AIRBORNE-POC", "https://kitploit.com/ru/tools/github/ekomssavior/airborne-poc/" ], "timeline": [ { "at": "2026-08-25T12:42:36Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EKOMSSAVIOR-AIRBORNE-POC" } ], "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2025-24071", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Windows File Explorer Windows 10 Pro x64 - TAR Extraction", "summary": "Windows File Explorer Windows 10 Pro x64 - TAR Extraction", "updated_at": "2026-09-05T08:16:29Z", "published_at": "2026-09-05T08:16:29Z", "cvss": 6.5, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 121, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "NetNTLMv2 hash capture in Windows explorer.exe via crafted ZIP file extraction.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52325", "author": "Daniel Miranda", "first_seen": "2025-06-13", "confidence": "High", "title": "Windows File Explorer Windows 10 Pro x64 - TAR Extraction", "summary": "Windows File Explorer Windows 10 Pro x64 - TAR Extraction", "url": "https://www.exploit-db.com/exploits/52325", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 52310", "author": "Mohammed Idrees Banyamer", "first_seen": "2025-05-29", "confidence": "High", "title": "Windows File Explorer Windows 11 (23H2) - NTLM Hash Disclosure", "summary": "Windows File Explorer Windows 11 (23H2) - NTLM Hash Disclosure", "url": "https://www.exploit-db.com/exploits/52310", "verification": "verified", "verified": true }, { "title": "Exploit for CVE-2025-24071_PoC CVE-2025-24054 CVE-2025-24071", "summary": "NetNTLMv2 hash capture in Windows explorer.exe via crafted ZIP file extraction.", "what_happened": "NetNTLMv2 hash capture in Windows explorer.exe via crafted ZIP file extraction.", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-MARCEJR117-CVE-2025-24071_POC", "https://kitploit.com/ru/tools/github/marcejr117/cve-2025-24071_poc/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-04T11:03:12", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-MARCEJR117-CVE-2025-24071_POC" }, { "repository": "Fomovet/cve-2025-24071", "author": "Fomovet", "first_seen": "2026-06-21", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "POC for CVE-2025-24071", "summary": "POC for CVE-2025-24071", "url": "https://github.com/Fomovet/cve-2025-24071" }, { "repository": "buffertrychar/CVE-2025-24071-POC", "author": "buffertrychar", "first_seen": "2026-05-20", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2025-24071 repository", "summary": "", "url": "https://github.com/buffertrychar/CVE-2025-24071-POC" }, { "repository": "SecurityLayer404/CVE-2025-24054-24071---Metasploit-Module", "author": "SecurityLayer404", "first_seen": "2026-04-01", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "Módulo de Metasploit para explotar CVE-2025-24054 (ex 24071). Exploit de filtración NTLM integrado en Metasploit para vectores de ataque basados en bibliotecas de Windows.", "summary": "Módulo de Metasploit para explotar CVE-2025-24054 (ex 24071). Exploit de filtración NTLM integrado en Metasploit para vectores de ataque basados en bibliotecas de Windows.", "url": "https://github.com/SecurityLayer404/CVE-2025-24054-24071---Metasploit-Module" }, { "repository": "Abdelrahman0Sayed/CVE-2025-24071", "author": "Abdelrahman0Sayed", "first_seen": "2025-12-16", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "This is a python PoC scripts for CVE-2025-24071 which is a vulnerability in Windows File Explorer that allows unauthorized access to sensitive information like NTLM Exposure.", "summary": "This is a python PoC scripts for CVE-2025-24071 which is a vulnerability in Windows File Explorer that allows unauthorized access to sensitive information like NTLM Exposure.", "url": "https://github.com/Abdelrahman0Sayed/CVE-2025-24071" }, { "repository": "Wind010/CVE-2025-24054_PoC", "author": "Wind010", "first_seen": "2025-11-09", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "A proof of concept for CVE-2025-24054/CVE-2025-24071", "summary": "A proof of concept for CVE-2025-24054/CVE-2025-24071", "url": "https://github.com/Wind010/CVE-2025-24054_PoC" }, { "repository": "helidem/CVE-2025-24054_CVE-2025-24071-PoC", "author": "helidem", "first_seen": "2025-04-22", "confidence": "High", "verification": "verified", "verified": true, "stars": 21, "title": "Proof of Concept for the NTLM Hash Leak via .library-ms CVE-2025-24054 / CVE-2025-24071", "summary": "Proof of Concept for the NTLM Hash Leak via .library-ms CVE-2025-24054 / CVE-2025-24071", "url": "https://github.com/helidem/CVE-2025-24054_CVE-2025-24071-PoC" }, { "repository": "AC8999/CVE-2025-24071", "author": "AC8999", "first_seen": "2025-09-05", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Python script to execute CVE-2025-24071", "summary": "Python script to execute CVE-2025-24071", "url": "https://github.com/AC8999/CVE-2025-24071" }, { "repository": "ctabango/CVE-2025-24071_PoCExtra", "author": "ctabango", "first_seen": "2025-03-19", "confidence": "High", "verification": "verified", "verified": true, "stars": 2, "title": "Alternativa CVE-2025-24071_PoC", "summary": "Alternativa CVE-2025-24071_PoC", "url": "https://github.com/ctabango/CVE-2025-24071_PoCExtra" }, { "repository": "Royall-Researchers/CVE-2025-24071", "author": "Royall-Researchers", "first_seen": "2025-07-05", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2025-24071 repository", "summary": "", "url": "https://github.com/Royall-Researchers/CVE-2025-24071" }, { "repository": "f4dee-backup/CVE-2025-24071", "author": "f4dee-backup", "first_seen": "2025-05-26", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Windows File Explorer Spoofing Vulnerability - CVE-2025-24071", "summary": "Windows File Explorer Spoofing Vulnerability - CVE-2025-24071", "url": "https://github.com/f4dee-backup/CVE-2025-24071" }, { "title": "Exploit for CVE-2025-24071_PoC CVE-2025-24054 CVE-2025-24071", "summary": "NetNTLMv2 hash capture in Windows explorer.exe via crafted ZIP file extraction.", "what_happened": "NetNTLMv2 hash capture in Windows explorer.exe via crafted ZIP file extraction.", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-MARCEJR117-CVE-2025-24071_POC", "https://kitploit.com/ru/tools/github/marcejr117/cve-2025-24071_poc/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-04T11:03:12", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/marcejr117/cve-2025-24071_poc/" } ], "references": [ "https://www.exploit-db.com/exploits/52325", "https://www.exploit-db.com/exploits/52310", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-MARCEJR117-CVE-2025-24071_POC", "https://github.com/Fomovet/cve-2025-24071", "https://github.com/buffertrychar/CVE-2025-24071-POC", "https://github.com/SecurityLayer404/CVE-2025-24054-24071---Metasploit-Module", "https://github.com/Abdelrahman0Sayed/CVE-2025-24071", "https://github.com/Wind010/CVE-2025-24054_PoC", "https://github.com/helidem/CVE-2025-24054_CVE-2025-24071-PoC", "https://github.com/AC8999/CVE-2025-24071", "https://github.com/ctabango/CVE-2025-24071_PoCExtra", "https://github.com/Royall-Researchers/CVE-2025-24071", "https://github.com/f4dee-backup/CVE-2025-24071", "https://kitploit.com/ru/tools/github/marcejr117/cve-2025-24071_poc/" ], "timeline": [ { "at": "2026-09-05T08:16:29Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52325" } ] }, { "id": "CVE-2025-24054", "vendor": "Microsoft", "product": "Windows", "title": "Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability", "summary": "Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.", "updated_at": "2026-09-05T08:16:29Z", "published_at": "2026-09-05T08:16:29Z", "cvss": 6.5, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 141, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52280", "author": "hyp3rlinx", "first_seen": "2025-05-01", "confidence": "High", "title": "Microsoft - NTLM Hash Disclosure Spoofing (library-ms)", "summary": "Microsoft - NTLM Hash Disclosure Spoofing (library-ms)", "url": "https://www.exploit-db.com/exploits/52280", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 52480", "author": "beatrizfn", "first_seen": "2026-02-11", "confidence": "High", "title": "Windows 10.0.17763.7009 - spoofing vulnerability", "summary": "Windows 10.0.17763.7009 - spoofing vulnerability", "url": "https://www.exploit-db.com/exploits/52480", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 52478", "author": "beatrizfn", "first_seen": "2026-02-04", "confidence": "High", "title": "windows 10/11 - NTLM Hash Disclosure Spoofing", "summary": "windows 10/11 - NTLM Hash Disclosure Spoofing", "url": "https://www.exploit-db.com/exploits/52478", "verification": "verified", "verified": true }, { "title": "Exploit for CVE-2025-24071_PoC CVE-2025-24054 CVE-2025-24071", "summary": "NetNTLMv2 hash capture in Windows explorer.exe via crafted ZIP file extraction.", "what_happened": "NetNTLMv2 hash capture in Windows explorer.exe via crafted ZIP file extraction.", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-MARCEJR117-CVE-2025-24071_POC", "https://kitploit.com/ru/tools/github/marcejr117/cve-2025-24071_poc/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-04T11:03:12", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-MARCEJR117-CVE-2025-24071_POC" }, { "repository": "T0tooro/cve-2025-24054-lab", "author": "T0tooro", "first_seen": "2026-07-01", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Blue-team lab: detecting & mitigating CVE-2025-24054 (Windows NTLM hash disclosure) with Sysmon, Wazuh SIEM, and Group Policy", "summary": "Blue-team lab: detecting & mitigating CVE-2025-24054 (Windows NTLM hash disclosure) with Sysmon, Wazuh SIEM, and Group Policy", "url": "https://github.com/T0tooro/cve-2025-24054-lab" }, { "repository": "Fomovet/cve-2025-24054", "author": "Fomovet", "first_seen": "2026-06-21", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "POC for CVE-2025-24054", "summary": "POC for CVE-2025-24054", "url": "https://github.com/Fomovet/cve-2025-24054" }, { "repository": "simantchaudhari/CVE-2025-24054-PoC", "author": "simantchaudhari", "first_seen": "2026-05-01", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2025-24054 repository", "summary": "", "url": "https://github.com/simantchaudhari/CVE-2025-24054-PoC" }, { "repository": "kaleth4/CVE--2025-24054", "author": "kaleth4", "first_seen": "2026-04-03", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "CVE-2025-24054 repository", "summary": "", "url": "https://github.com/kaleth4/CVE--2025-24054" }, { "repository": "SecurityLayer404/CVE-2025-24054-24071---Metasploit-Module", "author": "SecurityLayer404", "first_seen": "2026-04-01", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Módulo de Metasploit para explotar CVE-2025-24054 (ex 24071). Exploit de filtración NTLM integrado en Metasploit para vectores de ataque basados en bibliotecas de Windows.", "summary": "Módulo de Metasploit para explotar CVE-2025-24054 (ex 24071). Exploit de filtración NTLM integrado en Metasploit para vectores de ataque basados en bibliotecas de Windows.", "url": "https://github.com/SecurityLayer404/CVE-2025-24054-24071---Metasploit-Module" }, { "repository": "Untouchable17/CVE-2025-24054", "author": "Untouchable17", "first_seen": "2025-11-23", "confidence": "High", "verification": "verified", "verified": true, "stars": 2, "title": "Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure", "summary": "Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure", "url": "https://github.com/Untouchable17/CVE-2025-24054" }, { "repository": "Wind010/CVE-2025-24054_PoC", "author": "Wind010", "first_seen": "2025-11-09", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "A proof of concept for CVE-2025-24054/CVE-2025-24071", "summary": "A proof of concept for CVE-2025-24054/CVE-2025-24071", "url": "https://github.com/Wind010/CVE-2025-24054_PoC" }, { "repository": "helidem/CVE-2025-24054_CVE-2025-24071-PoC", "author": "helidem", "first_seen": "2025-04-22", "confidence": "High", "verification": "verified", "verified": true, "stars": 21, "title": "Proof of Concept for the NTLM Hash Leak via .library-ms CVE-2025-24054 / CVE-2025-24071", "summary": "Proof of Concept for the NTLM Hash Leak via .library-ms CVE-2025-24054 / CVE-2025-24071", "url": "https://github.com/helidem/CVE-2025-24054_CVE-2025-24071-PoC" }, { "repository": "rubenformation/CVE-2025-50154", "author": "rubenformation", "first_seen": "2025-08-13", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 55, "title": "POCs for CVE-2025-50154 and CVE-2025-59214, zero day vulnerabilities on windows file explorer disclosing NTLMv2-SSP without user interaction. It is a bypass for the CVE-2025-24054 Security Patch", "summary": "POCs for CVE-2025-50154 and CVE-2025-59214, zero day vulnerabilities on windows file explorer disclosing NTLMv2-SSP without user interaction. It is a bypass for the CVE-2025-24054 Security Patch", "url": "https://github.com/rubenformation/CVE-2025-50154" }, { "repository": "moften/CVE-2025-24054", "author": "moften", "first_seen": "2025-05-19", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "Vulnerabilidad NTLM (CVE-2025-24054) explotada para robo de hashes", "summary": "Vulnerabilidad NTLM (CVE-2025-24054) explotada para robo de hashes", "url": "https://github.com/moften/CVE-2025-24054" }, { "title": "Exploit for CVE-2025-24071_PoC CVE-2025-24054 CVE-2025-24071", "summary": "NetNTLMv2 hash capture in Windows explorer.exe via crafted ZIP file extraction.", "what_happened": "NetNTLMv2 hash capture in Windows explorer.exe via crafted ZIP file extraction.", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-MARCEJR117-CVE-2025-24071_POC", "https://kitploit.com/ru/tools/github/marcejr117/cve-2025-24071_poc/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-04T11:03:12", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/marcejr117/cve-2025-24071_poc/" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/52280", "https://www.exploit-db.com/exploits/52480", "https://www.exploit-db.com/exploits/52478", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-MARCEJR117-CVE-2025-24071_POC", "https://github.com/T0tooro/cve-2025-24054-lab", "https://github.com/Fomovet/cve-2025-24054", "https://github.com/simantchaudhari/CVE-2025-24054-PoC", "https://github.com/kaleth4/CVE--2025-24054", "https://github.com/SecurityLayer404/CVE-2025-24054-24071---Metasploit-Module", "https://github.com/Untouchable17/CVE-2025-24054", "https://github.com/Wind010/CVE-2025-24054_PoC", "https://github.com/helidem/CVE-2025-24054_CVE-2025-24071-PoC", "https://github.com/rubenformation/CVE-2025-50154", "https://github.com/moften/CVE-2025-24054", "https://kitploit.com/ru/tools/github/marcejr117/cve-2025-24071_poc/" ], "timeline": [ { "at": "2026-09-05T08:16:29Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-17", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-17", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-17", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-17", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-17", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-17", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-04-17", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2025-20260", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2025-20260-POC exploit", "summary": "Exploit for CVE-2025-20260. CVSS 9.8.", "updated_at": "2026-09-05T12:45:16Z", "published_at": "2026-09-05T12:45:16Z", "cvss": 9.8, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:45:16+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2025-20260-POC exploit", "summary": "Exploit for CVE-2025-20260. CVSS 9.8.", "cvss": 9.8, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ALEX-ACERO-SECURITY-CVE-2025-20260-POC" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ALEX-ACERO-SECURITY-CVE-2025-20260-POC" ], "timeline": [ { "at": "2026-09-05T12:45:16Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ALEX-ACERO-SECURITY-CVE-2025-20260-POC" } ] }, { "id": "CVE-2025-15694", "vendor": "Unknown", "product": "Joli Table Of Contents", "title": "Joli Table Of Contents vulnerability", "summary": "The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.", "updated_at": "2026-09-05T07:17:10.447", "published_at": "2026-09-05T07:17:10.447", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "2.0.0 through before 2.8.1 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/9ebaf1aa-eb8b-4c62-bbd0-07918503fbf1/" ], "timeline": [ { "at": "2026-09-05T07:17:10.447", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15694" } ] }, { "id": "CVE-2025-15693", "vendor": "Unknown", "product": "JCH Optimize", "title": "JCH Optimize vulnerability", "summary": "The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.", "updated_at": "2026-09-05T07:17:10.343", "published_at": "2026-09-05T07:17:10.343", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "4.2.1 through before 5.0.1 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/73e664a8-9075-4fe6-9af4-b6f5d2ccfe3c/" ], "timeline": [ { "at": "2026-09-05T07:17:10.343", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15693" } ] }, { "id": "CVE-2025-15647", "vendor": "artem-ogre", "product": "CDT", "title": "CDT vulnerability", "summary": "CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are computed in floating point and round outside adjacent triangles. Attackers can supply nearly-degenerate constraint edges through geometry data to trigger an out-of-bounds array access that crashes the calling process.", "updated_at": "2026-09-05T12:16:46.490", "published_at": "2026-09-05T12:16:46.490", "cvss": 6.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 1.4.5 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are computed in floating point and round outside adjacent triangles. Attackers can supply nearly-degenerate constraint edges through geometry data to trigger an out-of-bounds array access that crashes the calling process.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/artem-ogre/CDT", "https://github.com/artem-ogre/CDT/blob/1.4.4/CDT/include/CDTUtils.hpp#L175", "https://github.com/artem-ogre/CDT/commit/bf0d11ebfe3da0da72aed91816f665aef1b447cc", "https://github.com/artem-ogre/CDT/issues/212", "https://github.com/artem-ogre/CDT/releases/tag/1.4.5", "https://www.vulncheck.com/advisories/cdt-before-1.4.5-out-of-bounds-read-via-opposedvertexind" ], "timeline": [ { "at": "2026-09-05T12:16:46.490", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15647" } ] }, { "id": "CVE-2025-15614", "vendor": "Genivia", "product": "ugrep", "title": "ugrep vulnerability", "summary": "ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.", "updated_at": "2026-09-05T12:16:45.450", "published_at": "2026-09-05T12:16:45.450", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 7.6.0 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Genivia/ugrep", "https://github.com/Genivia/ugrep/blob/v7.5.0/src/zopen.c#L673", "https://github.com/Genivia/ugrep/commit/c12849a11264e2c81c860bf78ee9039772f307a4", "https://github.com/Genivia/ugrep/issues/511", "https://github.com/Genivia/ugrep/releases/tag/v7.6.0", "https://www.vulncheck.com/advisories/ugrep-before-7.6.0-heap-buffer-over-read-via-z-decompression" ], "timeline": [ { "at": "2026-09-05T12:16:45.450", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15614" } ] }, { "id": "CVE-2025-14945", "vendor": "netweblogic", "product": "Events Manager – Calendar, Bookings, Tickets, and more!", "title": "Events Manager – Calendar, Bookings, Tickets, and more! vulnerability", "summary": "The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.", "updated_at": "2026-09-05T06:17:09.017", "published_at": "2026-09-05T06:17:09.017", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 7.3.3 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-79", "what_happened": "The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/events-manager/trunk/classes/em-event.php#L1206", "https://plugins.trac.wordpress.org/browser/events-manager/trunk/classes/em-event.php#L2608", "https://plugins.trac.wordpress.org/changeset/3567065/", "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1985eb5-bfb5-4220-a4f8-fcfa84beae6a?source=cve" ], "timeline": [ { "at": "2026-09-05T06:17:09.017", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14945" } ] }, { "id": "CVE-2025-9049", "vendor": "scriptsbundle", "product": "Nokri – Job Board WordPress Theme", "title": "Nokri – Job Board WordPress Theme vulnerability", "summary": "The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.", "updated_at": "2026-09-05T12:16:46.653", "published_at": "2026-09-05T12:16:46.653", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.6.4 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://themeforest.net/item/nokri-job-board-wordpress-theme/22677241#item-description__nokri-theme-change-logs", "https://www.wordfence.com/threat-intel/vulnerabilities/id/e079e886-70a5-4188-ad99-96fc37651ed0?source=cve" ], "timeline": [ { "at": "2026-09-05T12:16:46.653", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9049" } ] }, { "id": "CVE-2025-6220", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2025-6220 exploit", "summary": "Exploit for CVE-2025-6220. CVSS 7.2.", "updated_at": "2026-09-05T12:44:52Z", "published_at": "2026-09-05T12:44:52Z", "cvss": 7.2, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:44:52+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2025-6220 exploit", "summary": "Exploit for CVE-2025-6220. CVSS 7.2.", "cvss": 7.2, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-D0N601-CVE-2025-6220" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-D0N601-CVE-2025-6220" ], "timeline": [ { "at": "2026-09-05T12:44:52Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-D0N601-CVE-2025-6220" } ] }, { "id": "CVE-2025-4871", "vendor": "Unknown vendor", "product": "Unknown product", "title": "PCMan 2.0.7 - Buffer Overflow", "summary": "PCMan 2.0.7 - Buffer Overflow", "updated_at": "2026-08-20T22:00:00Z", "published_at": "2026-08-20T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 23, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "PCMan 2.0.7 Buffer Overflow", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52657", "author": "Thiago Cunha", "first_seen": "2026-08-18", "confidence": "High", "title": "PCMan 2.0.7 - Buffer Overflow", "summary": "PCMan 2.0.7 - Buffer Overflow", "url": "https://www.exploit-db.com/exploits/52657", "verification": "verified", "verified": true }, { "repository": "CXSecurity WLB-2026080010", "author": "Thiago Cunha", "first_seen": "2026-08-21", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "PCMan 2.0.7 Buffer Overflow", "summary": "PCMan 2.0.7 Buffer Overflow", "what_happened": "PCMan 2.0.7 Buffer Overflow", "cvss": 0, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "url": "https://cxsecurity.com/issue/WLB-2026080010", "cwe": "Unknown" } ], "references": [ "https://www.exploit-db.com/exploits/52657", "https://cxsecurity.com/issue/WLB-2026080010" ], "timeline": [ { "at": "2026-08-20T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52657" } ] }, { "id": "CVE-2025-2825", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for ludus_crushftp_cve-2025-31161_sim CVE-2025-31161", "summary": "Authentication bypass in CrushFTP 10.8.0 on Windows (CVE-2025-31161).", "updated_at": "2026-08-25T02:25:29Z", "published_at": "2026-08-25T02:25:29Z", "cvss": 9.8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 21, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "Authentication bypass in CrushFTP 10.8.0 on Windows (CVE-2025-31161).", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for ludus_crushftp_cve-2025-31161_sim CVE-2025-31161", "summary": "Authentication bypass in CrushFTP 10.8.0 on Windows (CVE-2025-31161).", "what_happened": "Authentication bypass in CrushFTP 10.8.0 on Windows (CVE-2025-31161).", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RUFFLABS-LUDUS_CRUSHFTP_CVE-2025-31161_SIM", "https://kitploit.com/hi/tools/github/rufflabs/ludus_crushftp_cve-2025-31161_sim/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-08-25T04:25:29", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RUFFLABS-LUDUS_CRUSHFTP_CVE-2025-31161_SIM" }, { "title": "Exploit for ludus_crushftp_cve-2025-31161_sim CVE-2025-31161", "summary": "Authentication bypass in CrushFTP 10.8.0 on Windows (CVE-2025-31161).", "what_happened": "Authentication bypass in CrushFTP 10.8.0 on Windows (CVE-2025-31161).", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RUFFLABS-LUDUS_CRUSHFTP_CVE-2025-31161_SIM", "https://kitploit.com/hi/tools/github/rufflabs/ludus_crushftp_cve-2025-31161_sim/" ], "repository": "kitploit.com", "author": "hi", "first_seen": "2026-08-25T04:25:29", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/hi/tools/github/rufflabs/ludus_crushftp_cve-2025-31161_sim/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RUFFLABS-LUDUS_CRUSHFTP_CVE-2025-31161_SIM", "https://kitploit.com/hi/tools/github/rufflabs/ludus_crushftp_cve-2025-31161_sim/" ], "timeline": [ { "at": "2026-08-25T02:25:29Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RUFFLABS-LUDUS_CRUSHFTP_CVE-2025-31161_SIM" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2024-52940", "vendor": "Unknown vendor", "product": "Unknown product", "title": "abdal-anydesk-remote-ip-detector exploit", "summary": "Exploit for CVE-2024-52940. CVSS 7.5.", "updated_at": "2026-09-05T12:44:01Z", "published_at": "2026-09-05T12:44:01Z", "cvss": 7.5, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:44:01+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "abdal-anydesk-remote-ip-detector exploit", "summary": "Exploit for CVE-2024-52940. CVSS 7.5.", "cvss": 7.5, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EBRASHA-ABDAL-ANYDESK-REMOTE-IP-DETECTOR" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EBRASHA-ABDAL-ANYDESK-REMOTE-IP-DETECTOR" ], "timeline": [ { "at": "2026-09-05T12:44:01Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EBRASHA-ABDAL-ANYDESK-REMOTE-IP-DETECTOR" } ] }, { "id": "CVE-2024-52510", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2024-52510 exploit", "summary": "Exploit for CVE-2024-52510. CVSS 7.5.", "updated_at": "2026-09-05T08:10:11Z", "published_at": "2026-09-05T08:10:11Z", "cvss": 7.5, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 15, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T08:10:11+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2024-52510 exploit", "summary": "Exploit for CVE-2024-52510. CVSS 7.5.", "cvss": 7.5, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-D-XUAN-CVE-2024-52510" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-D-XUAN-CVE-2024-52510" ], "timeline": [ { "at": "2026-09-05T08:10:11Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-D-XUAN-CVE-2024-52510" } ] }, { "id": "CVE-2024-50475", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2024-50475 exploit", "summary": "Exploit for CVE-2024-50475. CVSS 9.8.", "updated_at": "2026-09-05T12:40:41Z", "published_at": "2026-09-05T12:40:41Z", "cvss": 9.8, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:40:41+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2024-50475 exploit", "summary": "Exploit for CVE-2024-50475. CVSS 9.8.", "cvss": 9.8, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RANDOMROBBIEBF-CVE-2024-50475" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RANDOMROBBIEBF-CVE-2024-50475" ], "timeline": [ { "at": "2026-09-05T12:40:41Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RANDOMROBBIEBF-CVE-2024-50475" } ] }, { "id": "CVE-2024-26304", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2024-26304-RCE-exploit", "summary": "Exploit for CVE-2024-26304. CVSS 9.8.", "updated_at": "2026-09-05T08:11:50Z", "published_at": "2026-09-05T08:11:50Z", "cvss": 9.8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 29, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Buffer overflow in ArubaOS L2/L3 Management service via PAPI UDP port 8211 enables RCE.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "CVE-2024-26304-RCE-exploit", "summary": "Buffer overflow in ArubaOS L2/L3 Management service via PAPI UDP port 8211 enables RCE.", "what_happened": "Buffer overflow in ArubaOS L2/L3 Management service via PAPI UDP port 8211 enables RCE.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-X-PROJETION-CVE-2024-26304-RCE-EXPLOIT", "https://kitploit.com/ja/tools/github/x-projetion/cve-2024-26304-rce-exploit/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-02T05:05:55", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-X-PROJETION-CVE-2024-26304-RCE-EXPLOIT" }, { "title": "CVE-2024-26304-RCE-exploit", "summary": "Buffer overflow in ArubaOS L2/L3 Management service via PAPI UDP port 8211 enables RCE.", "what_happened": "Buffer overflow in ArubaOS L2/L3 Management service via PAPI UDP port 8211 enables RCE.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-X-PROJETION-CVE-2024-26304-RCE-EXPLOIT", "https://kitploit.com/ja/tools/github/x-projetion/cve-2024-26304-rce-exploit/" ], "repository": "kitploit.com", "author": "ja", "first_seen": "2026-09-02T05:05:55", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ja/tools/github/x-projetion/cve-2024-26304-rce-exploit/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-X-PROJETION-CVE-2024-26304-RCE-EXPLOIT", "https://kitploit.com/ja/tools/github/x-projetion/cve-2024-26304-rce-exploit/" ], "timeline": [ { "at": "2026-09-05T08:11:50Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-X-PROJETION-CVE-2024-26304-RCE-EXPLOIT" } ] }, { "id": "CVE-2024-12381", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2024-12381-PoC", "summary": "Proof of concept repository for CVE-2024-12381 containing exploit tools.", "updated_at": "2026-08-29T06:34:26Z", "published_at": "2026-08-29T06:34:26Z", "cvss": 8.8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 25, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "Proof of concept repository for CVE-2024-12381 containing exploit tools.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2024-12381-PoC", "summary": "Proof of concept repository for CVE-2024-12381 containing exploit tools.", "what_happened": "Proof of concept repository for CVE-2024-12381 containing exploit tools.", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FATFISHIO-CVE-2024-12381-POC", "https://kitploit.com/it/tools/github/fatfishio/cve-2024-12381-poc/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-08-29T08:34:26", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FATFISHIO-CVE-2024-12381-POC" }, { "title": "Exploit for CVE-2024-12381-PoC", "summary": "Proof of concept repository for CVE-2024-12381 containing exploit tools.", "what_happened": "Proof of concept repository for CVE-2024-12381 containing exploit tools.", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FATFISHIO-CVE-2024-12381-POC", "https://kitploit.com/it/tools/github/fatfishio/cve-2024-12381-poc/" ], "repository": "kitploit.com", "author": "it", "first_seen": "2026-08-29T08:34:26", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/it/tools/github/fatfishio/cve-2024-12381-poc/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FATFISHIO-CVE-2024-12381-POC", "https://kitploit.com/it/tools/github/fatfishio/cve-2024-12381-poc/" ], "timeline": [ { "at": "2026-08-29T06:34:26Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FATFISHIO-CVE-2024-12381-POC" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "id": "CVE-2024-11080", "vendor": "pickplugins", "product": "Post Grid", "title": "Post Grid vulnerability", "summary": "The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.", "updated_at": "2026-09-05T09:16:48.880", "published_at": "2026-09-05T09:16:48.880", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "2.2.85 through 2.3.32 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-94", "what_happened": "The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/post-grid/trunk/includes/blocks/form-wrap/functions.php#L116", "https://plugins.trac.wordpress.org/browser/post-grid/trunk/includes/blocks/form-wrap/functions.php#L262", "https://plugins.trac.wordpress.org/browser/post-grid/trunk/includes/blocks/form-wrap/functions.php#L3249", "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec8666d4-042e-4cf4-86f5-474a69d90ff6?source=cve" ], "timeline": [ { "at": "2026-09-05T09:16:48.880", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11080" } ] }, { "id": "CVE-2024-10914", "vendor": "Unknown vendor", "product": "Unknown product", "title": "D-Link DNS_340L - OS Command Injection", "summary": "D-Link DNS_340L - OS Command Injection", "updated_at": "2026-08-16T22:00:00Z", "published_at": "2026-08-16T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52643", "author": "Jared Brits", "first_seen": "2026-08-17", "confidence": "High", "title": "D-Link DNS_340L - OS Command Injection", "summary": "D-Link DNS_340L - OS Command Injection", "url": "https://www.exploit-db.com/exploits/52643", "verification": "verified", "verified": true } ], "references": [ "https://www.exploit-db.com/exploits/52643" ], "timeline": [ { "at": "2026-08-16T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52643" } ] }, { "id": "CVE-2024-0015", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2024-0015 exploit", "summary": "Exploit for CVE-2024-0015. CVSS 7.8.", "updated_at": "2026-09-05T08:12:58Z", "published_at": "2026-09-05T08:12:58Z", "cvss": 7.8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 29, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "PoC and EXP demonstration of CVE-2024-0015 for tools by DubheCTF.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2024-0015", "summary": "PoC and EXP demonstration of CVE-2024-0015 for tools by DubheCTF.", "what_happened": "PoC and EXP demonstration of CVE-2024-0015 for tools by DubheCTF.", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-UMVFX1BVAW50-CVE-2024-0015", "https://kitploit.com/ru/tools/github/umvfx1bvaw50/cve-2024-0015/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-04T10:58:07", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-UMVFX1BVAW50-CVE-2024-0015" }, { "title": "Exploit for CVE-2024-0015", "summary": "PoC and EXP demonstration of CVE-2024-0015 for tools by DubheCTF.", "what_happened": "PoC and EXP demonstration of CVE-2024-0015 for tools by DubheCTF.", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-UMVFX1BVAW50-CVE-2024-0015", "https://kitploit.com/ru/tools/github/umvfx1bvaw50/cve-2024-0015/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-04T10:58:07", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/umvfx1bvaw50/cve-2024-0015/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-UMVFX1BVAW50-CVE-2024-0015", "https://kitploit.com/ru/tools/github/umvfx1bvaw50/cve-2024-0015/" ], "timeline": [ { "at": "2026-09-05T08:12:58Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-UMVFX1BVAW50-CVE-2024-0015" } ] }, { "id": "CVE-2023-49105", "vendor": "ownCloud", "product": "ownCloud", "title": "ownCloud Improper Authentication Vulnerability", "summary": "ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.", "updated_at": "2026-08-26T22:00:00Z", "published_at": "2026-08-26T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-26T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2023-42793", "vendor": "JetBrains", "product": "TeamCity", "title": "JetBrains TeamCity Authentication Bypass Vulnerability", "summary": "JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.", "updated_at": "2026-09-04T22:00:00Z", "published_at": "2026-09-04T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 262, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 51884", "author": "ByteHunter", "first_seen": "2024-03-14", "confidence": "High", "title": "JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE)", "summary": "JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE)", "url": "https://www.exploit-db.com/exploits/51884", "verification": "verified", "verified": true }, { "repository": "PoC-in-GitHub · H454NSec/CVE-2023-42793", "author": "H454NSec", "first_seen": "2023-09-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 45, "title": "JetBrains TeamCity Authentication Bypass CVE-2023-42793 Exploit", "summary": "JetBrains TeamCity Authentication Bypass CVE-2023-42793 Exploit", "url": "https://github.com/H454NSec/CVE-2023-42793" }, { "repository": "PoC-in-GitHub · whoamins/CVE-2023-42793", "author": "whoamins", "first_seen": "2023-10-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2023-42793 repository", "summary": "", "url": "https://github.com/whoamins/CVE-2023-42793" }, { "repository": "PoC-in-GitHub · Zenmovie/CVE-2023-42793", "author": "Zenmovie", "first_seen": "2023-10-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 9, "title": "PoC of CVE-2023-42793", "summary": "PoC of CVE-2023-42793", "url": "https://github.com/Zenmovie/CVE-2023-42793" }, { "repository": "PoC-in-GitHub · johnossawy/CVE-2023-42793_POC", "author": "johnossawy", "first_seen": "2024-01-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2023-42793 repository", "summary": "", "url": "https://github.com/johnossawy/CVE-2023-42793_POC" }, { "repository": "PoC-in-GitHub · StanleyJobsonAU/GhostTown", "author": "StanleyJobsonAU", "first_seen": "2024-01-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Proof of Concept script to exploit CVE-2023-42793 (TeamCity)", "summary": "Proof of Concept script to exploit CVE-2023-42793 (TeamCity)", "url": "https://github.com/StanleyJobsonAU/GhostTown" }, { "repository": "PoC-in-GitHub · hotplugin0x01/CVE-2023-42793", "author": "hotplugin0x01", "first_seen": "2024-04-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "JetBrains TeamCity Unauthenticated Remote Code Execution - Python3 Implementation", "summary": "JetBrains TeamCity Unauthenticated Remote Code Execution - Python3 Implementation", "url": "https://github.com/hotplugin0x01/CVE-2023-42793" }, { "repository": "PoC-in-GitHub · B4l3rI0n/CVE-2023-42793", "author": "B4l3rI0n", "first_seen": "2024-04-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 11, "title": "JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE), CVE-2023-42793", "summary": "JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE), CVE-2023-42793", "url": "https://github.com/B4l3rI0n/CVE-2023-42793" }, { "repository": "PoC-in-GitHub · junnythemarksman/CVE-2023-42793", "author": "junnythemarksman", "first_seen": "2024-05-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "TeamCity CVE-2023-42793 exploit written in Rust", "summary": "TeamCity CVE-2023-42793 exploit written in Rust", "url": "https://github.com/junnythemarksman/CVE-2023-42793" }, { "repository": "PoC-in-GitHub · HusenjanDev/CVE-2023-42793", "author": "HusenjanDev", "first_seen": "2024-07-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "TeamCity RCE for Linux (CVE-2023-42793)", "summary": "TeamCity RCE for Linux (CVE-2023-42793)", "url": "https://github.com/HusenjanDev/CVE-2023-42793" }, { "repository": "PoC-in-GitHub · FlojBoj/CVE-2023-42793", "author": "FlojBoj", "first_seen": "2024-08-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "TeamCity CVE-2023-42793 RCE (Remote Code Execution)", "summary": "TeamCity CVE-2023-42793 RCE (Remote Code Execution)", "url": "https://github.com/FlojBoj/CVE-2023-42793" }, { "repository": "PoC-in-GitHub · SwiftSecur/teamcity-exploit-cve-2023-42793", "author": "SwiftSecur", "first_seen": "2024-09-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "teamcity-exploit-cve-2023-42793", "summary": "teamcity-exploit-cve-2023-42793", "url": "https://github.com/SwiftSecur/teamcity-exploit-cve-2023-42793" }, { "repository": "PoC-in-GitHub · becrevex/CVE-2023-42793", "author": "becrevex", "first_seen": "2024-10-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "TeamCity server scanner to detect CVE-2023-42793", "summary": "TeamCity server scanner to detect CVE-2023-42793", "url": "https://github.com/becrevex/CVE-2023-42793" }, { "repository": "PoC-in-GitHub · jakehomb/cve-2023-42793", "author": "jakehomb", "first_seen": "2025-04-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2023-42793 repository", "summary": "", "url": "https://github.com/jakehomb/cve-2023-42793" }, { "repository": "PoC-in-GitHub · syaifulandy/Nuclei-Template-CVE-2023-42793.yaml", "author": "syaifulandy", "first_seen": "2025-05-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Windows & linux support", "summary": "Windows & linux support", "url": "https://github.com/syaifulandy/Nuclei-Template-CVE-2023-42793.yaml" }, { "repository": "PoC-in-GitHub · cxdxnt/CVE-2023-42793", "author": "cxdxnt", "first_seen": "2025-11-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "TeamCity 2023.05.3 - CVE-2023-42793 - Create username administrator.", "summary": "TeamCity 2023.05.3 - CVE-2023-42793 - Create username administrator.", "url": "https://github.com/cxdxnt/CVE-2023-42793" }, { "repository": "PoC-in-GitHub · DDestinys/CVE-2023-42793", "author": "DDestinys", "first_seen": "2026-01-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2023-42793 repository", "summary": "", "url": "https://github.com/DDestinys/CVE-2023-42793" }, { "repository": "PoC-in-GitHub · burakacar6/CVE-2023-42793-TeamCity-Unauthenticated-RCE", "author": "burakacar6", "first_seen": "2026-09-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A PoC and automated version detection/exploit tool for JetBrains TeamCity Authentication Bypass & RCE (CVE-2023-42793).", "summary": "A PoC and automated version detection/exploit tool for JetBrains TeamCity Authentication Bypass & RCE (CVE-2023-42793).", "url": "https://github.com/burakacar6/CVE-2023-42793-TeamCity-Unauthenticated-RCE" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/51884", "https://github.com/H454NSec/CVE-2023-42793", "https://github.com/whoamins/CVE-2023-42793", "https://github.com/Zenmovie/CVE-2023-42793", "https://github.com/johnossawy/CVE-2023-42793_POC", "https://github.com/StanleyJobsonAU/GhostTown", "https://github.com/hotplugin0x01/CVE-2023-42793", "https://github.com/B4l3rI0n/CVE-2023-42793", "https://github.com/junnythemarksman/CVE-2023-42793", "https://github.com/HusenjanDev/CVE-2023-42793", "https://github.com/FlojBoj/CVE-2023-42793", "https://github.com/SwiftSecur/teamcity-exploit-cve-2023-42793", "https://github.com/becrevex/CVE-2023-42793", "https://github.com/jakehomb/cve-2023-42793", "https://github.com/syaifulandy/Nuclei-Template-CVE-2023-42793.yaml", "https://github.com/cxdxnt/CVE-2023-42793", "https://github.com/DDestinys/CVE-2023-42793", "https://github.com/burakacar6/CVE-2023-42793-TeamCity-Unauthenticated-RCE" ], "timeline": [ { "at": "2026-09-04T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2023-10-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2023-10-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2023-10-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2023-10-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2023-10-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2023-10-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2023-10-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2023-10-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2023-32233", "vendor": "Unknown vendor", "product": "Unknown product", "title": "自用，poc作者为Piotr Krysiuk，在使用前请先阅读README.md", "summary": "自用，poc作者为Piotr Krysiuk，在使用前请先阅读README.md", "updated_at": "2026-08-07T22:00:00Z", "published_at": "2026-08-07T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 65, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "PoC-in-GitHub · PIDAN-HEIDASHUAI/CVE-2023-32233", "author": "PIDAN-HEIDASHUAI", "first_seen": "2023-05-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "自用，poc作者为Piotr Krysiuk，在使用前请先阅读README.md", "summary": "自用，poc作者为Piotr Krysiuk，在使用前请先阅读README.md", "url": "https://github.com/PIDAN-HEIDASHUAI/CVE-2023-32233" }, { "repository": "PoC-in-GitHub · Liuk3r/CVE-2023-32233", "author": "Liuk3r", "first_seen": "2023-05-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 383, "title": "CVE-2023-32233: Linux内核中的安全漏洞", "summary": "CVE-2023-32233: Linux内核中的安全漏洞", "url": "https://github.com/Liuk3r/CVE-2023-32233" }, { "repository": "PoC-in-GitHub · oferchen/POC-CVE-2023-32233", "author": "oferchen", "first_seen": "2023-05-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 53, "title": "Use-After-Free in Netfilter nf_tables when processing batch requests CVE-2023-32233", "summary": "Use-After-Free in Netfilter nf_tables when processing batch requests CVE-2023-32233", "url": "https://github.com/oferchen/POC-CVE-2023-32233" }, { "repository": "PoC-in-GitHub · RogelioPumajulca/TEST-CVE-2023-32233", "author": "RogelioPumajulca", "first_seen": "2024-02-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2023-32233", "summary": "CVE-2023-32233", "url": "https://github.com/RogelioPumajulca/TEST-CVE-2023-32233" }, { "repository": "PoC-in-GitHub · void0red/CVE-2023-32233", "author": "void0red", "first_seen": "2024-04-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2023-32233 repository", "summary": "", "url": "https://github.com/void0red/CVE-2023-32233" }, { "repository": "PoC-in-GitHub · Destawell/gemini-2.5-pro-nf-tables-red-teaming", "author": "Destawell", "first_seen": "2026-05-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Gemini 2.5 Pro nf_tables Red Teaming Case Study (CVE-2023-32233) — LLM Safety Alignment & Responsible Disclosure", "summary": "Gemini 2.5 Pro nf_tables Red Teaming Case Study (CVE-2023-32233) — LLM Safety Alignment & Responsible Disclosure", "url": "https://github.com/Destawell/gemini-2.5-pro-nf-tables-red-teaming" }, { "repository": "PoC-in-GitHub · Destawell/gemini-2.5-pro-nf-tables-red-teamin", "author": "Destawell", "first_seen": "2026-05-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A technical case study and timeline dataset documenting Google Gemini 2.5 Pro's safety alignment policies, guardrails, and refusal behavior evolution regarding legacy Linux kernel vulnerability primitives (CVE-2023-32233).", "summary": "A technical case study and timeline dataset documenting Google Gemini 2.5 Pro's safety alignment policies, guardrails, and refusal behavior evolution regarding legacy Linux kernel vulnerability primitives (CVE-2023-32233).", "url": "https://github.com/Destawell/gemini-2.5-pro-nf-tables-red-teamin" }, { "repository": "PoC-in-GitHub · BurnSkyup/CVE-2023-32233-reproduction", "author": "BurnSkyup", "first_seen": "2026-08-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A Linux-related vulnerability", "summary": "A Linux-related vulnerability", "url": "https://github.com/BurnSkyup/CVE-2023-32233-reproduction" } ], "references": [ "https://github.com/PIDAN-HEIDASHUAI/CVE-2023-32233", "https://github.com/Liuk3r/CVE-2023-32233", "https://github.com/oferchen/POC-CVE-2023-32233", "https://github.com/RogelioPumajulca/TEST-CVE-2023-32233", "https://github.com/void0red/CVE-2023-32233", "https://github.com/Destawell/gemini-2.5-pro-nf-tables-red-teaming", "https://github.com/Destawell/gemini-2.5-pro-nf-tables-red-teamin", "https://github.com/BurnSkyup/CVE-2023-32233-reproduction" ], "timeline": [ { "at": "2026-08-07T22:00:00Z", "label": "Discovered through PoC-in-GitHub", "url": "https://github.com/PIDAN-HEIDASHUAI/CVE-2023-32233" } ] }, { "id": "CVE-2023-30765", "vendor": "Delta Electronics", "product": "Infrasuite Device Master", "title": "Exploit for CVE-2023-30765", "summary": "​Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain improper access controls that could allow an attacker to alter privilege management configurations, resulting in privilege escalation.", "updated_at": "2026-06-17T05:55:37.460", "published_at": "2023-07-10T20:15:15.237", "cvss": 8.8, "confidence": 55, "confidence_label": "review", "affected": "before v1.0.7 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-269", "what_happened": "​Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain improper access controls that could allow an attacker to alter privilege management configurations, resulting in privilege escalation.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2023-30765", "summary": "Privilege escalation in Delta Electronics Infrasuite Device Master adds user to admins group.", "what_happened": "Privilege escalation in Delta Electronics Infrasuite Device Master adds user to admins group.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-0XFML-CVE-2023-30765", "https://kitploit.com/ru/tools/github/0xfml/cve-2023-30765/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-05T12:46:17", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-0XFML-CVE-2023-30765" }, { "title": "Exploit for CVE-2023-30765", "summary": "Privilege escalation in Delta Electronics Infrasuite Device Master adds user to admins group.", "what_happened": "Privilege escalation in Delta Electronics Infrasuite Device Master adds user to admins group.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-0XFML-CVE-2023-30765", "https://kitploit.com/ru/tools/github/0xfml/cve-2023-30765/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-05T12:46:17", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/0xfml/cve-2023-30765/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-0XFML-CVE-2023-30765", "https://kitploit.com/ru/tools/github/0xfml/cve-2023-30765/", "https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-01" ], "timeline": [ { "at": "2026-09-05T10:46:17Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-0XFML-CVE-2023-30765" }, { "at": "2023-07-10T20:15:15.237", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30765" } ], "enrichment_checked_at": "2026-09-05T16:05:29Z", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2023-5070", "vendor": "inisev", "product": "Social Media Share Buttons & Social Sharing Icons", "title": "Exploit for CVE-2023-5070", "summary": "The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords.", "updated_at": "2026-06-17T06:47:28.367", "published_at": "2023-10-20T08:15:12.993", "cvss": 6.5, "confidence": 55, "confidence_label": "review", "affected": "0 through 2.8.5 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-200", "what_happened": "The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2023-5070", "summary": "Information exposure in Social Media Share Buttons up to 2.8.5 via sfsi_save_export leaks tokens.", "what_happened": "Information exposure in Social Media Share Buttons up to 2.8.5 via sfsi_save_export leaks tokens.", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RANDOMROBBIEBF-CVE-2023-5070", "https://kitploit.com/ru/tools/github/randomrobbiebf/cve-2023-5070/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-05T12:46:08", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RANDOMROBBIEBF-CVE-2023-5070" }, { "title": "Exploit for CVE-2023-5070", "summary": "Information exposure in Social Media Share Buttons up to 2.8.5 via sfsi_save_export leaks tokens.", "what_happened": "Information exposure in Social Media Share Buttons up to 2.8.5 via sfsi_save_export leaks tokens.", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RANDOMROBBIEBF-CVE-2023-5070", "https://kitploit.com/ru/tools/github/randomrobbiebf/cve-2023-5070/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-05T12:46:08", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/randomrobbiebf/cve-2023-5070/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RANDOMROBBIEBF-CVE-2023-5070", "https://kitploit.com/ru/tools/github/randomrobbiebf/cve-2023-5070/", "https://plugins.trac.wordpress.org/changeset/2975574/ultimate-social-media-icons/tags/2.8.6/libs/controllers/sfsi_buttons_controller.php?old=2956446&old_path=ultimate-social-media-icons%2Ftags%2F2.8.5%2Flibs%2Fcontrollers%2Fsfsi_buttons_controller.php", "https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e43c5b-a094-44ab-a8a3-52d437f0e00d?source=cve" ], "timeline": [ { "at": "2026-09-05T10:46:08Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RANDOMROBBIEBF-CVE-2023-5070" }, { "at": "2023-10-20T08:15:12.993", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5070" } ], "enrichment_checked_at": "2026-09-05T16:05:29Z", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "id": "CVE-2022-26134", "vendor": "Atlassian", "product": "Confluence Server/Data Center", "title": "Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability", "summary": "Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.", "updated_at": "2026-09-05T12:45:24Z", "published_at": "2026-09-05T12:45:24Z", "cvss": 9.8, "confidence": 90, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 4, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 50952", "author": "Fellipe Oliveira", "first_seen": "2022-06-10", "confidence": "High", "title": "Confluence Data Center 7.18.0 - Remote Code Execution (RCE)", "summary": "Confluence Data Center 7.18.0 - Remote Code Execution (RCE)", "url": "https://www.exploit-db.com/exploits/50952", "verification": "verified", "verified": true }, { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:45:24+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2022-26134-OGNL-Injection exploit", "summary": "Exploit for CVE-2022-26134. CVSS 9.8.", "cvss": 9.8, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ROODHELIOS-CVE-2022-26134-OGNL-INJECTION" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/50952", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ROODHELIOS-CVE-2022-26134-OGNL-INJECTION" ], "timeline": [ { "at": "2026-09-05T12:45:24Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-06-02", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2022-23773", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2022-23773-Reproduce exploit", "summary": "Exploit for CVE-2022-23773. CVSS 7.5.", "updated_at": "2026-09-05T12:41:23Z", "published_at": "2026-09-05T12:41:23Z", "cvss": 7.5, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:41:23+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2022-23773-Reproduce exploit", "summary": "Exploit for CVE-2022-23773. CVSS 7.5.", "cvss": 7.5, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-YOUSHENGLIU-CVE-2022-23773-REPRODUCE" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-YOUSHENGLIU-CVE-2022-23773-REPRODUCE" ], "timeline": [ { "at": "2026-09-05T12:41:23Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-YOUSHENGLIU-CVE-2022-23773-REPRODUCE" } ] }, { "id": "CVE-2022-21907", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution", "summary": "Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution", "updated_at": "2026-09-05T08:10:53Z", "published_at": "2026-09-05T08:10:53Z", "cvss": 10, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 37, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "CVE-2022-21907: RCE in Windows http.sys IIS module causing DoS via payload upload.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 51575", "author": "nu11secur1ty", "first_seen": "2023-07-07", "confidence": "High", "title": "Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution", "summary": "Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution", "url": "https://www.exploit-db.com/exploits/51575", "verification": "verified", "verified": true }, { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T08:10:53+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "nmap-CVE-2022-21907 exploit", "summary": "Exploit for CVE-2022-21907. CVSS 10.", "cvss": 10, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-GPIECHNIK2-NMAP-CVE-2022-21907" }, { "title": "Exploit for nmap-CVE-2022-21907", "summary": "CVE-2022-21907: RCE in Windows http.sys IIS module causing DoS via payload upload.", "what_happened": "CVE-2022-21907: RCE in Windows http.sys IIS module causing DoS via payload upload.", "cvss": 10, "cvss_vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "attack_vector": "Network", "authentication": "Unknown", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-GPIECHNIK2-NMAP-CVE-2022-21907", "https://kitploit.com/ru/tools/github/gpiechnik2/nmap-cve-2022-21907/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-04T08:49:02", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/gpiechnik2/nmap-cve-2022-21907/" } ], "references": [ "https://www.exploit-db.com/exploits/51575", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-GPIECHNIK2-NMAP-CVE-2022-21907", "https://kitploit.com/ru/tools/github/gpiechnik2/nmap-cve-2022-21907/" ], "timeline": [ { "at": "2026-09-05T08:10:53Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/51575" } ] }, { "id": "CVE-2022-0995", "vendor": "Linux", "product": "Kernel", "title": "Linux Kernel Out-of-Bounds Write Vulnerability", "summary": "Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.", "updated_at": "2026-08-25T22:00:00Z", "published_at": "2026-08-25T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-25T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2021-42756", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2021-42756 exploit", "summary": "Exploit for CVE-2021-42756. CVSS 9.8.", "updated_at": "2026-09-05T12:44:57Z", "published_at": "2026-09-05T12:44:57Z", "cvss": 9.8, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:44:57+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2021-42756 exploit", "summary": "Exploit for CVE-2021-42756. CVSS 9.8.", "cvss": 9.8, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-3NDORPH1N-CVE-2021-42756" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-3NDORPH1N-CVE-2021-42756" ], "timeline": [ { "at": "2026-09-05T12:44:57Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-3NDORPH1N-CVE-2021-42756" } ] }, { "id": "CVE-2021-40906", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2021-40906", "summary": "Reflected XSS in CheckMK Management Web Console 1.5.0 to 1.5.0p25 in unauthenticated zone.", "updated_at": "2026-09-04T06:29:50Z", "published_at": "2026-09-04T06:29:50Z", "cvss": 6.1, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 36, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "Reflected XSS in CheckMK Management Web Console 1.5.0 to 1.5.0p25 in unauthenticated zone.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2021-40906", "summary": "Reflected XSS in CheckMK Management Web Console 1.5.0 to 1.5.0p25 in unauthenticated zone.", "what_happened": "Reflected XSS in CheckMK Management Web Console 1.5.0 to 1.5.0p25 in unauthenticated zone.", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EDGARLOYOLA-CVE-2021-40906", "https://kitploit.com/ru/tools/github/edgarloyola/cve-2021-40906/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-04T08:29:50", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EDGARLOYOLA-CVE-2021-40906" }, { "title": "Exploit for CVE-2021-40906", "summary": "Reflected XSS in CheckMK Management Web Console 1.5.0 to 1.5.0p25 in unauthenticated zone.", "what_happened": "Reflected XSS in CheckMK Management Web Console 1.5.0 to 1.5.0p25 in unauthenticated zone.", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EDGARLOYOLA-CVE-2021-40906", "https://kitploit.com/ru/tools/github/edgarloyola/cve-2021-40906/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-04T08:29:50", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/edgarloyola/cve-2021-40906/" }, { "repository": "Edgarloyola/CVE-2021-40906", "author": "Edgarloyola", "first_seen": "2021-10-12", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "CVE-2021-40906 repository", "summary": "", "url": "https://github.com/Edgarloyola/CVE-2021-40906" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EDGARLOYOLA-CVE-2021-40906", "https://kitploit.com/ru/tools/github/edgarloyola/cve-2021-40906/", "https://github.com/Edgarloyola/CVE-2021-40906" ], "timeline": [ { "at": "2026-09-04T06:29:50Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EDGARLOYOLA-CVE-2021-40906" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "id": "CVE-2021-23758", "vendor": "Ajax.NET Professional", "product": "Ajax.NET Professional", "title": "Ajax.NET Professional Deserialization of Untrusted Data Vulnerability", "summary": "Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.", "updated_at": "2026-08-25T22:00:00Z", "published_at": "2026-08-25T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-25T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2021-21973", "vendor": "VMware", "product": "vCenter Server and Cloud Foundation", "title": "VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability", "summary": "VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.", "updated_at": "2026-09-05T12:42:33Z", "published_at": "2026-09-05T12:42:33Z", "cvss": 5.3, "confidence": 90, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 3, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:42:33+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2021-21973-Automateme exploit", "summary": "Exploit for CVE-2021-21973. CVSS 5.3.", "cvss": 5.3, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FREAKANONYMOUS-CVE-2021-21973-AUTOMATEME" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FREAKANONYMOUS-CVE-2021-21973-AUTOMATEME" ], "timeline": [ { "at": "2026-09-05T12:42:33Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-03-07", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2021-4034", "vendor": "Red Hat", "product": "Polkit", "title": "Red Hat Polkit Out-of-Bounds Read and Write Vulnerability", "summary": "The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.", "updated_at": "2026-08-14T22:00:00Z", "published_at": "2026-08-14T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 1463, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 50689", "author": "Lance Biggerstaff", "first_seen": "2022-01-27", "confidence": "High", "title": "PolicyKit-1 0.105-31 - Privilege Escalation", "summary": "PolicyKit-1 0.105-31 - Privilege Escalation", "url": "https://www.exploit-db.com/exploits/50689", "verification": "verified", "verified": true }, { "repository": "PoC-in-GitHub · ryaagard/CVE-2021-4034", "author": "ryaagard", "first_seen": "2022-01-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 74, "title": "Local Privilege Escalation in polkit's pkexec", "summary": "Local Privilege Escalation in polkit's pkexec", "url": "https://github.com/ryaagard/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · berdav/CVE-2021-4034", "author": "berdav", "first_seen": "2022-01-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2048, "title": "CVE-2021-4034 1day", "summary": "CVE-2021-4034 1day", "url": "https://github.com/berdav/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · clubby789/CVE-2021-4034", "author": "clubby789", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/clubby789/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · gbrsh/CVE-2021-4034", "author": "gbrsh", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/gbrsh/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · arthepsy/CVE-2021-4034", "author": "arthepsy", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1162, "title": "PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)", "summary": "PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)", "url": "https://github.com/arthepsy/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Audiobahn/CVE-2021-4034", "author": "Audiobahn", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "CVE-2021-4034 🎧", "summary": "CVE-2021-4034 🎧", "url": "https://github.com/Audiobahn/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · dzonerzy/poc-cve-2021-4034", "author": "dzonerzy", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 114, "title": "PoC for CVE-2021-4034 dubbed pwnkit", "summary": "PoC for CVE-2021-4034 dubbed pwnkit", "url": "https://github.com/dzonerzy/poc-cve-2021-4034" }, { "repository": "PoC-in-GitHub · nikaiw/CVE-2021-4034", "author": "nikaiw", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 59, "title": "PoC for CVE-2021-4034", "summary": "PoC for CVE-2021-4034", "url": "https://github.com/nikaiw/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · mebeim/CVE-2021-4034", "author": "mebeim", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 36, "title": "CVE-2021-4034: Local Privilege Escalation in polkit's pkexec proof of concept", "summary": "CVE-2021-4034: Local Privilege Escalation in polkit's pkexec proof of concept", "url": "https://github.com/mebeim/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Ayrx/CVE-2021-4034", "author": "Ayrx", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 91, "title": "Exploit for CVE-2021-4034", "summary": "Exploit for CVE-2021-4034", "url": "https://github.com/Ayrx/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Y3A/CVE-2021-4034", "author": "Y3A", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/Y3A/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · An00bRektn/CVE-2021-4034", "author": "An00bRektn", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 11, "title": "A Golang implementation of clubby789's implementation of CVE-2021-4034", "summary": "A Golang implementation of clubby789's implementation of CVE-2021-4034", "url": "https://github.com/An00bRektn/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · ayypril/CVE-2021-4034", "author": "ayypril", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/ayypril/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · wongwaituck/CVE-2021-4034", "author": "wongwaituck", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/wongwaituck/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · 0x05a/my-cve-2021-4034-poc", "author": "0x05a", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "my PoC", "summary": "my PoC", "url": "https://github.com/0x05a/my-cve-2021-4034-poc" }, { "repository": "PoC-in-GitHub · silocityit/cve-2021-4034-playground", "author": "silocityit", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "impromptu pwn chal", "summary": "impromptu pwn chal", "url": "https://github.com/silocityit/cve-2021-4034-playground" }, { "repository": "PoC-in-GitHub · zhzyker/CVE-2021-4034", "author": "zhzyker", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 45, "title": "polkit pkexec Local Privilege Vulnerability to Add custom commands", "summary": "polkit pkexec Local Privilege Vulnerability to Add custom commands", "url": "https://github.com/zhzyker/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Immersive-Labs-Sec/CVE-2021-4034", "author": "Immersive-Labs-Sec", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Proof of Concept for CVE-2021-4034 Polkit Privilege Escalation", "summary": "Proof of Concept for CVE-2021-4034 Polkit Privilege Escalation", "url": "https://github.com/Immersive-Labs-Sec/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · kimusan/pkwner", "author": "kimusan", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 23, "title": "A python3 and bash PoC for CVE-2021-4034 by Kim Schulz", "summary": "A python3 and bash PoC for CVE-2021-4034 by Kim Schulz", "url": "https://github.com/kimusan/pkwner" }, { "repository": "PoC-in-GitHub · N1et/CVE-2021-4034", "author": "N1et", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Just a sh script file to CVE-2021-4034", "summary": "Just a sh script file to CVE-2021-4034", "url": "https://github.com/N1et/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Nero22k/CVE-2021-4034", "author": "Nero22k", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Dirty PoC for CVE-2021-4034 (Pwnkit)", "summary": "Dirty PoC for CVE-2021-4034 (Pwnkit)", "url": "https://github.com/Nero22k/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · LukeGix/CVE-2021-4034", "author": "LukeGix", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A stupid poc for CVE-2021-4034", "summary": "A stupid poc for CVE-2021-4034", "url": "https://github.com/LukeGix/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · aus-mate/CVE-2021-4034-POC", "author": "aus-mate", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/aus-mate/CVE-2021-4034-POC" }, { "repository": "PoC-in-GitHub · chenaotian/CVE-2021-4034", "author": "chenaotian", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 12, "title": "CVE-2021-4034 POC and Docker and Analysis write up", "summary": "CVE-2021-4034 POC and Docker and Analysis write up", "url": "https://github.com/chenaotian/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · moldabekov/CVE-2021-4034", "author": "moldabekov", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Pseudopatch for CVE-2021-4034", "summary": "Pseudopatch for CVE-2021-4034", "url": "https://github.com/moldabekov/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · jostmart/-CVE-2021-4034", "author": "jostmart", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/jostmart/-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · c3l3si4n/pwnkit", "author": "c3l3si4n", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 24, "title": "PoC for the CVE-2021-4034 vulnerability, affecting polkit < 0.120.", "summary": "PoC for the CVE-2021-4034 vulnerability, affecting polkit < 0.120.", "url": "https://github.com/c3l3si4n/pwnkit" }, { "repository": "PoC-in-GitHub · h3x0v3rl0rd/CVE-2021-4034", "author": "h3x0v3rl0rd", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/h3x0v3rl0rd/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · ly4k/PwnKit", "author": "ly4k", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1329, "title": "Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation", "summary": "Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation", "url": "https://github.com/ly4k/PwnKit" }, { "repository": "PoC-in-GitHub · san3ncrypt3d/CVE-2021-4034-POC", "author": "san3ncrypt3d", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/san3ncrypt3d/CVE-2021-4034-POC" }, { "repository": "PoC-in-GitHub · fdellwing/CVE-2021-4034", "author": "fdellwing", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/fdellwing/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · xcanwin/CVE-2021-4034-UniontechOS", "author": "xcanwin", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "统信UOS 桌面操作系统，存在CVE-2021-4034漏洞（Linux Polkit本地权限提升漏洞）。", "summary": "统信UOS 桌面操作系统，存在CVE-2021-4034漏洞（Linux Polkit本地权限提升漏洞）。", "url": "https://github.com/xcanwin/CVE-2021-4034-UniontechOS" }, { "repository": "PoC-in-GitHub · azminawwar/CVE-2021-4034", "author": "azminawwar", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 in Bash Script", "summary": "CVE-2021-4034 in Bash Script", "url": "https://github.com/azminawwar/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · PeterGottesman/pwnkit-exploit", "author": "PeterGottesman", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 38, "title": "CVE-2021-4034 POC exploit", "summary": "CVE-2021-4034 POC exploit", "url": "https://github.com/PeterGottesman/pwnkit-exploit" }, { "repository": "PoC-in-GitHub · sunny0day/CVE-2021-4034", "author": "sunny0day", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/sunny0day/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · artemis-mike/cve-2021-4034", "author": "artemis-mike", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "PoC for cve-2021-4034", "summary": "PoC for cve-2021-4034", "url": "https://github.com/artemis-mike/cve-2021-4034" }, { "repository": "PoC-in-GitHub · whokilleddb/CVE-2021-4034", "author": "whokilleddb", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "An exploit for CVE-2021-4034 aka Pwnkit: Local Privilege Escalation in polkit's pkexec", "summary": "An exploit for CVE-2021-4034 aka Pwnkit: Local Privilege Escalation in polkit's pkexec", "url": "https://github.com/whokilleddb/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · dadvlingd/CVE-2021-4034", "author": "dadvlingd", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 20, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/dadvlingd/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · zcrosman/cve-2021-4034", "author": "zcrosman", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/zcrosman/cve-2021-4034" }, { "repository": "PoC-in-GitHub · robemmerson/CVE-2021-4034", "author": "robemmerson", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/robemmerson/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · joeammond/CVE-2021-4034", "author": "joeammond", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 180, "title": "Python exploit code for CVE-2021-4034 (pwnkit)", "summary": "Python exploit code for CVE-2021-4034 (pwnkit)", "url": "https://github.com/joeammond/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · luijait/PwnKit-Exploit", "author": "luijait", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 98, "title": "Proof of Concept (PoC) CVE-2021-4034", "summary": "Proof of Concept (PoC) CVE-2021-4034", "url": "https://github.com/luijait/PwnKit-Exploit" }, { "repository": "PoC-in-GitHub · Anonymous-Family/CVE-2021-4034", "author": "Anonymous-Family", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Linux system service bug gives root on all major distros, exploit published A vulnerability in the pkexec component of Polkit identified as CVE-2021-4034 PwnKit is present in the default configuration of all major Linux distributions and can be exploited to gain privileges over the compj researchers.", "summary": "Linux system service bug gives root on all major distros, exploit published A vulnerability in the pkexec component of Polkit identified as CVE-2021-4034 PwnKit is present in the default configuration of all major Linux distributions and can be exploited to gain privileges over the compj researchers.", "url": "https://github.com/Anonymous-Family/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · phvilasboas/CVE-2021-4034", "author": "phvilasboas", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/phvilasboas/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · vilasboasph/CVE-2021-4034", "author": "vilasboasph", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/vilasboasph/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · callrbx/pkexec-lpe-poc", "author": "callrbx", "first_seen": "2022-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "POC for CVE-2021-4034", "summary": "POC for CVE-2021-4034", "url": "https://github.com/callrbx/pkexec-lpe-poc" }, { "repository": "PoC-in-GitHub · cd80-ctf/CVE-2021-4034", "author": "cd80-ctf", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "A simple proof-of-concept for CVE-2021-4034 (pkexec local privilege escalation)", "summary": "A simple proof-of-concept for CVE-2021-4034 (pkexec local privilege escalation)", "url": "https://github.com/cd80-ctf/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Al1ex/CVE-2021-4034", "author": "Al1ex", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)", "summary": "Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)", "url": "https://github.com/Al1ex/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · ashutoshrohilla/CVE-2021-4034", "author": "ashutoshrohilla", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This repository contains the exploit for vulnerability CVE-2021-4034 .", "summary": "This repository contains the exploit for vulnerability CVE-2021-4034 .", "url": "https://github.com/ashutoshrohilla/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · nikip72/CVE-2021-4034", "author": "nikip72", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/nikip72/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · NiS3x/CVE-2021-4034", "author": "NiS3x", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "PoC CVE 2021-4034 PwnKit: Local Privilege Escalation Vulnerability Discovered in polkit’s pkexec", "summary": "PoC CVE 2021-4034 PwnKit: Local Privilege Escalation Vulnerability Discovered in polkit’s pkexec", "url": "https://github.com/NiS3x/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · thatstraw/CVE-2021-4034", "author": "thatstraw", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/thatstraw/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · luckythandel/CVE-2021-4034", "author": "luckythandel", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This is a POC for the vulnerability found in polkit's pkexec binary which is used to run programs as another users.", "summary": "This is a POC for the vulnerability found in polkit's pkexec binary which is used to run programs as another users.", "url": "https://github.com/luckythandel/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Plethore/CVE-2021-4034", "author": "Plethore", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Python exploit for CVE-2021-4034", "summary": "Python exploit for CVE-2021-4034", "url": "https://github.com/Plethore/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · evdenis/lsm_bpf_check_argc0", "author": "evdenis", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 21, "title": "LSM BPF module to block pwnkit (CVE-2021-4034) like exploits", "summary": "LSM BPF module to block pwnkit (CVE-2021-4034) like exploits", "url": "https://github.com/evdenis/lsm_bpf_check_argc0" }, { "repository": "PoC-in-GitHub · tahaafarooq/poppy", "author": "tahaafarooq", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "CVE-2021-4034 PoC , polkit < 0.131", "summary": "CVE-2021-4034 PoC , polkit < 0.131", "url": "https://github.com/tahaafarooq/poppy" }, { "repository": "PoC-in-GitHub · DosAmp/pkwned", "author": "DosAmp", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Proof of Concept for CVE-2021-4034 (with experimental traceless exploitation)", "summary": "Proof of Concept for CVE-2021-4034 (with experimental traceless exploitation)", "url": "https://github.com/DosAmp/pkwned" }, { "repository": "PoC-in-GitHub · PwnFunction/CVE-2021-4034", "author": "PwnFunction", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 351, "title": "Proof of concept for pwnkit vulnerability", "summary": "Proof of concept for pwnkit vulnerability", "url": "https://github.com/PwnFunction/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · NULL0B/CVE-2021-4034", "author": "NULL0B", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/NULL0B/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · locksec/CVE-2021-4034", "author": "locksec", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Exploit PoC for the polkit pkexec (PWNKIT) vulnerability", "summary": "Exploit PoC for the polkit pkexec (PWNKIT) vulnerability", "url": "https://github.com/locksec/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · deoxykev/CVE-2021-4034-Rust", "author": "deoxykev", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Linux LPE using polkit-1 written in Rust.", "summary": "Linux LPE using polkit-1 written in Rust.", "url": "https://github.com/deoxykev/CVE-2021-4034-Rust" }, { "repository": "PoC-in-GitHub · c3c/CVE-2021-4034", "author": "c3c", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 28, "title": "Pre-compiled builds for CVE-2021-4034", "summary": "Pre-compiled builds for CVE-2021-4034", "url": "https://github.com/c3c/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Fato07/Pwnkit-exploit", "author": "Fato07", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Exploit for pkexec (CVE-2021-4034)", "summary": "Exploit for pkexec (CVE-2021-4034)", "url": "https://github.com/Fato07/Pwnkit-exploit" }, { "repository": "PoC-in-GitHub · EstamelGG/CVE-2021-4034-NoGCC", "author": "EstamelGG", "first_seen": "2022-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 79, "title": "CVE-2021-4034简单优化，以应对没有安装gcc和make的目标环境", "summary": "CVE-2021-4034简单优化，以应对没有安装gcc和make的目标环境", "url": "https://github.com/EstamelGG/CVE-2021-4034-NoGCC" }, { "repository": "PoC-in-GitHub · pengalaman-1t/CVE-2021-4034", "author": "pengalaman-1t", "first_seen": "2022-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/pengalaman-1t/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · jpmcb/pwnkit-go", "author": "jpmcb", "first_seen": "2022-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "Exploit for the PwnKit vulnerability, CVE-2021-4034, written in Go", "summary": "Exploit for the PwnKit vulnerability, CVE-2021-4034, written in Go", "url": "https://github.com/jpmcb/pwnkit-go" }, { "repository": "PoC-in-GitHub · JoyGhoshs/CVE-2021-4034", "author": "JoyGhoshs", "first_seen": "2022-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Exploit for Local Privilege Escalation Vulnerability in polkit’s pkexec", "summary": "Exploit for Local Privilege Escalation Vulnerability in polkit’s pkexec", "url": "https://github.com/JoyGhoshs/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · galoget/PwnKit-CVE-2021-4034", "author": "galoget", "first_seen": "2022-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/galoget/PwnKit-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Yakumwamba/POC-CVE-2021-4034", "author": "Yakumwamba", "first_seen": "2022-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/Yakumwamba/POC-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · ayoub-elbouzi/CVE-2021-4034-Pwnkit", "author": "ayoub-elbouzi", "first_seen": "2022-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)", "summary": "PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)", "url": "https://github.com/ayoub-elbouzi/CVE-2021-4034-Pwnkit" }, { "repository": "PoC-in-GitHub · oreosec/pwnkit", "author": "oreosec", "first_seen": "2022-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-4034", "summary": "CVE-2021-4034", "url": "https://github.com/oreosec/pwnkit" }, { "repository": "PoC-in-GitHub · CYB3RK1D/CVE-2021-4034-POC", "author": "CYB3RK1D", "first_seen": "2022-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "pwnkit", "summary": "pwnkit", "url": "https://github.com/CYB3RK1D/CVE-2021-4034-POC" }, { "repository": "PoC-in-GitHub · Rvn0xsy/CVE-2021-4034", "author": "Rvn0xsy", "first_seen": "2022-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 97, "title": "CVE-2021-4034 Add Root User - Pkexec Local Privilege Escalation", "summary": "CVE-2021-4034 Add Root User - Pkexec Local Privilege Escalation", "url": "https://github.com/Rvn0xsy/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Kirill89/CVE-2021-4034", "author": "Kirill89", "first_seen": "2022-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "pkexec (Polkit) exploit of Privilege Escalation vulnerability CVE-2021-4034", "summary": "pkexec (Polkit) exploit of Privilege Escalation vulnerability CVE-2021-4034", "url": "https://github.com/Kirill89/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · NeonWhiteRabbit/CVE-2021-4034", "author": "NeonWhiteRabbit", "first_seen": "2022-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 17, "title": "Pwnkit Exploit (CVE-2021-4034), no download capabilty? Copy and paste it!", "summary": "Pwnkit Exploit (CVE-2021-4034), no download capabilty? Copy and paste it!", "url": "https://github.com/NeonWhiteRabbit/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · sofire/polkit-0.96-CVE-2021-4034", "author": "sofire", "first_seen": "2022-01-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "centos 6.10 rpm for fix polkit CVE-2021-4034; centos 6.10的rpm包，修复CVE-2021-4034 漏洞", "summary": "centos 6.10 rpm for fix polkit CVE-2021-4034; centos 6.10的rpm包，修复CVE-2021-4034 漏洞", "url": "https://github.com/sofire/polkit-0.96-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · codiobert/pwnkit-scanner", "author": "codiobert", "first_seen": "2022-01-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Check CVE-2021-4034 vulnerability", "summary": "Check CVE-2021-4034 vulnerability", "url": "https://github.com/codiobert/pwnkit-scanner" }, { "repository": "PoC-in-GitHub · v-rzh/CVE-2021-4034", "author": "v-rzh", "first_seen": "2022-01-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Exploit for the PwnKit Vulnerability", "summary": "Exploit for the PwnKit Vulnerability", "url": "https://github.com/v-rzh/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · TW-D/PwnKit-Vulnerability_CVE-2021-4034", "author": "TW-D", "first_seen": "2022-01-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PwnKit - Local Privilege Escalation Vulnerability Discovered in polkit’s pkexec (CVE-2021-4034)", "summary": "PwnKit - Local Privilege Escalation Vulnerability Discovered in polkit’s pkexec (CVE-2021-4034)", "url": "https://github.com/TW-D/PwnKit-Vulnerability_CVE-2021-4034" }, { "repository": "PoC-in-GitHub · OXDBXKXO/ez-pwnkit", "author": "OXDBXKXO", "first_seen": "2022-01-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 9, "title": "Go implementation of the PwnKit Linux Local Privilege Escalation exploit (CVE-2021-4034)", "summary": "Go implementation of the PwnKit Linux Local Privilege Escalation exploit (CVE-2021-4034)", "url": "https://github.com/OXDBXKXO/ez-pwnkit" }, { "repository": "PoC-in-GitHub · milot/dissecting-pkexec-cve-2021-4034", "author": "milot", "first_seen": "2022-01-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/milot/dissecting-pkexec-cve-2021-4034" }, { "repository": "PoC-in-GitHub · 0x01-sec/CVE-2021-4034-", "author": "0x01-sec", "first_seen": "2022-01-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)", "summary": "PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)", "url": "https://github.com/0x01-sec/CVE-2021-4034-" }, { "repository": "PoC-in-GitHub · navisec/CVE-2021-4034-PwnKit", "author": "navisec", "first_seen": "2022-01-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "PwnKit PoC for Polkit pkexec CVE-2021-4034", "summary": "PwnKit PoC for Polkit pkexec CVE-2021-4034", "url": "https://github.com/navisec/CVE-2021-4034-PwnKit" }, { "repository": "PoC-in-GitHub · Almorabea/pkexec-exploit", "author": "Almorabea", "first_seen": "2022-01-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 25, "title": "pwnkit: Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)", "summary": "pwnkit: Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)", "url": "https://github.com/Almorabea/pkexec-exploit" }, { "repository": "PoC-in-GitHub · teelrabbit/Polkit-pkexec-exploit-for-Linux", "author": "teelrabbit", "first_seen": "2022-01-31", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034", "summary": "CVE-2021-4034", "url": "https://github.com/teelrabbit/Polkit-pkexec-exploit-for-Linux" }, { "repository": "PoC-in-GitHub · scent2d/PoC-CVE-2021-4034", "author": "scent2d", "first_seen": "2022-02-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Pwnkit CVE-2021-4034", "summary": "Pwnkit CVE-2021-4034", "url": "https://github.com/scent2d/PoC-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · HrishitJoshi/CVE-2021-4034", "author": "HrishitJoshi", "first_seen": "2022-02-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "PWNKIT - Local Privilege Escalation Vulnerability on Linux (Polkit)", "summary": "PWNKIT - Local Privilege Escalation Vulnerability on Linux (Polkit)", "url": "https://github.com/HrishitJoshi/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Ankit-Ojha16/CVE-2021-4034", "author": "Ankit-Ojha16", "first_seen": "2022-02-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/Ankit-Ojha16/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · G01d3nW01f/CVE-2021-4034", "author": "G01d3nW01f", "first_seen": "2022-02-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PwnKit auto generate and Serve", "summary": "PwnKit auto generate and Serve", "url": "https://github.com/G01d3nW01f/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · drapl0n/pwnKit", "author": "drapl0n", "first_seen": "2022-02-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 11, "title": "pwnKit: Privilege Escalation USB-Rubber-Ducky payload, which exploits CVE-2021-4034 in less than 10sec's and spawns root shell for you.", "summary": "pwnKit: Privilege Escalation USB-Rubber-Ducky payload, which exploits CVE-2021-4034 in less than 10sec's and spawns root shell for you.", "url": "https://github.com/drapl0n/pwnKit" }, { "repository": "PoC-in-GitHub · rvzsec/CVE-2021-4034", "author": "rvzsec", "first_seen": "2022-02-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec in Python", "summary": "PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec in Python", "url": "https://github.com/rvzsec/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Joffr3y/Polkit-CVE-2021-4034-HLP", "author": "Joffr3y", "first_seen": "2022-02-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Polkit CVE-2021-4034 exploitation in High-Level Programming Language", "summary": "Polkit CVE-2021-4034 exploitation in High-Level Programming Language", "url": "https://github.com/Joffr3y/Polkit-CVE-2021-4034-HLP" }, { "repository": "PoC-in-GitHub · ziadsaleemi/polkit_CVE-2021-4034", "author": "ziadsaleemi", "first_seen": "2022-02-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Ansible role to patch RHSB-2022-001 Polkit Privilege Escalation - (CVE-2021-4034)", "summary": "Ansible role to patch RHSB-2022-001 Polkit Privilege Escalation - (CVE-2021-4034)", "url": "https://github.com/ziadsaleemi/polkit_CVE-2021-4034" }, { "repository": "PoC-in-GitHub · FDlucifer/Pwnkit-go", "author": "FDlucifer", "first_seen": "2022-02-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "A golang based exp for CVE-2021-4034 dubbed pwnkit (more features added......)", "summary": "A golang based exp for CVE-2021-4034 dubbed pwnkit (more features added......)", "url": "https://github.com/FDlucifer/Pwnkit-go" }, { "repository": "PoC-in-GitHub · pombredanne/CVE-2021-4034", "author": "pombredanne", "first_seen": "2022-02-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Polkit pkexec CVE-2021-4034 Proof Of Concept and Patching", "summary": "Polkit pkexec CVE-2021-4034 Proof Of Concept and Patching", "url": "https://github.com/pombredanne/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · cspshivam/cve-2021-4034", "author": "cspshivam", "first_seen": "2022-02-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "pwnkit exploit", "summary": "pwnkit exploit", "url": "https://github.com/cspshivam/cve-2021-4034" }, { "repository": "PoC-in-GitHub · an0n7os/CVE-2021-4034", "author": "an0n7os", "first_seen": "2022-02-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/an0n7os/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · DanaEpp/pwncat_pwnkit", "author": "DanaEpp", "first_seen": "2022-02-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 32, "title": "pwncat module that automatically exploits CVE-2021-4034 (pwnkit)", "summary": "pwncat module that automatically exploits CVE-2021-4034 (pwnkit)", "url": "https://github.com/DanaEpp/pwncat_pwnkit" }, { "repository": "PoC-in-GitHub · x04000/CVE-2021-4034", "author": "x04000", "first_seen": "2022-02-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "A simple PWNKIT file to convert you to root", "summary": "A simple PWNKIT file to convert you to root", "url": "https://github.com/x04000/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · x04000/AutoPwnkit", "author": "x04000", "first_seen": "2022-02-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "A tool to automate the exploit PWNKIT (CVE-2021-4034)", "summary": "A tool to automate the exploit PWNKIT (CVE-2021-4034)", "url": "https://github.com/x04000/AutoPwnkit" }, { "repository": "PoC-in-GitHub · hohn/codeql-sample-polkit", "author": "hohn", "first_seen": "2022-02-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "All stages of exploring the polkit CVE-2021-4034 using codeql", "summary": "All stages of exploring the polkit CVE-2021-4034 using codeql", "url": "https://github.com/hohn/codeql-sample-polkit" }, { "repository": "PoC-in-GitHub · ck00004/CVE-2021-4034", "author": "ck00004", "first_seen": "2022-02-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 28, "title": "CVE-2021-4034 centos8可用版本", "summary": "CVE-2021-4034 centos8可用版本", "url": "https://github.com/ck00004/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · LJP-TW/CVE-2021-4034", "author": "LJP-TW", "first_seen": "2022-02-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "pkexec EoP exploit", "summary": "pkexec EoP exploit", "url": "https://github.com/LJP-TW/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · fnknda/CVE-2021-4034_POC", "author": "fnknda", "first_seen": "2022-02-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Proof Of Concept for the 2021's pkexec vulnerability CVE-2021-4034", "summary": "Proof Of Concept for the 2021's pkexec vulnerability CVE-2021-4034", "url": "https://github.com/fnknda/CVE-2021-4034_POC" }, { "repository": "PoC-in-GitHub · Tanmay-N/CVE-2021-4034", "author": "Tanmay-N", "first_seen": "2022-02-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/Tanmay-N/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · hahaleyile/CVE-2021-4034", "author": "hahaleyile", "first_seen": "2022-02-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/hahaleyile/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · movvamrocks/PwnKit-CVE-2021-4034", "author": "movvamrocks", "first_seen": "2022-02-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/movvamrocks/PwnKit-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Squirre17/CVE-2021-4034", "author": "Squirre17", "first_seen": "2022-03-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "polkit-pkexec local privilege escalation vulnerability", "summary": "polkit-pkexec local privilege escalation vulnerability", "url": "https://github.com/Squirre17/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Jesrat/make_me_root", "author": "Jesrat", "first_seen": "2022-03-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034", "summary": "CVE-2021-4034", "url": "https://github.com/Jesrat/make_me_root" }, { "repository": "PoC-in-GitHub · defhacks/cve-2021-4034", "author": "defhacks", "first_seen": "2022-03-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "port of CVE-2021-4034 exploit to Rust/cargo for my own edification", "summary": "port of CVE-2021-4034 exploit to Rust/cargo for my own edification", "url": "https://github.com/defhacks/cve-2021-4034" }, { "repository": "PoC-in-GitHub · ITMarcin2211/Polkit-s-Pkexec-CVE-2021-4034", "author": "ITMarcin2211", "first_seen": "2022-03-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Polkit's Pkexec CVE-2021-4034 Proof Of Concept and Patching", "summary": "Polkit's Pkexec CVE-2021-4034 Proof Of Concept and Patching", "url": "https://github.com/ITMarcin2211/Polkit-s-Pkexec-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · edsonjt81/CVE-2021-4034-Linux", "author": "edsonjt81", "first_seen": "2022-03-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/edsonjt81/CVE-2021-4034-Linux" }, { "repository": "PoC-in-GitHub · nel0x/pwnkit-vulnerability", "author": "nel0x", "first_seen": "2022-03-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 (PWNKIT).", "summary": "CVE-2021-4034 (PWNKIT).", "url": "https://github.com/nel0x/pwnkit-vulnerability" }, { "repository": "PoC-in-GitHub · TomSgn/CVE-2021-4034", "author": "TomSgn", "first_seen": "2022-03-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "pkexec --> privilege escalation", "summary": "pkexec --> privilege escalation", "url": "https://github.com/TomSgn/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · TheJoyOfHacking/berdav-CVE-2021-4034", "author": "TheJoyOfHacking", "first_seen": "2022-03-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/TheJoyOfHacking/berdav-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · tzwlhack/CVE-2021-4034", "author": "tzwlhack", "first_seen": "2022-03-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/tzwlhack/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · jcatala/f_poc_cve-2021-4034", "author": "jcatala", "first_seen": "2022-03-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/jcatala/f_poc_cve-2021-4034" }, { "repository": "PoC-in-GitHub · Nosferatuvjr/PwnKit", "author": "Nosferatuvjr", "first_seen": "2022-04-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "Prova de conceito para a vulnerabilidade Polkit Pkexec: CVE-2021-4034(Pkexec Local Privilege Escalation)", "summary": "Prova de conceito para a vulnerabilidade Polkit Pkexec: CVE-2021-4034(Pkexec Local Privilege Escalation)", "url": "https://github.com/Nosferatuvjr/PwnKit" }, { "repository": "PoC-in-GitHub · TotallyNotAHaxxer/CVE-2021-4034", "author": "TotallyNotAHaxxer", "first_seen": "2022-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "POC for the priv esc exploit in PKEXEC [ CVE -2021-4034 ] ( needs fixing, not the best) Converted into go", "summary": "POC for the priv esc exploit in PKEXEC [ CVE -2021-4034 ] ( needs fixing, not the best) Converted into go", "url": "https://github.com/TotallyNotAHaxxer/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · 0x4ndy/CVE-2021-4034-PoC", "author": "0x4ndy", "first_seen": "2022-04-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 PoC", "summary": "CVE-2021-4034 PoC", "url": "https://github.com/0x4ndy/CVE-2021-4034-PoC" }, { "repository": "PoC-in-GitHub · antoinenguyen-09/CVE-2021-4034", "author": "antoinenguyen-09", "first_seen": "2022-04-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "My research about CVE-2021-4034", "summary": "My research about CVE-2021-4034", "url": "https://github.com/antoinenguyen-09/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · wudicainiao/cve-2021-4034", "author": "wudicainiao", "first_seen": "2022-05-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 10, "title": "CVE-2021-4034 for single commcand", "summary": "CVE-2021-4034 for single commcand", "url": "https://github.com/wudicainiao/cve-2021-4034" }, { "repository": "PoC-in-GitHub · TanmoyG1800/CVE-2021-4034", "author": "TanmoyG1800", "first_seen": "2022-06-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/TanmoyG1800/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · CronoX1/CVE-2021-4034", "author": "CronoX1", "first_seen": "2022-06-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Exploit modificado para el tito Eu", "summary": "Exploit modificado para el tito Eu", "url": "https://github.com/CronoX1/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · supportingmx/cve-2021-4034", "author": "supportingmx", "first_seen": "2022-07-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/supportingmx/cve-2021-4034" }, { "repository": "PoC-in-GitHub · A1vinSmith/CVE-2021-4034", "author": "A1vinSmith", "first_seen": "2022-08-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Script en python sobre la vulnerabilidad CVE-2021-4034", "summary": "Script en python sobre la vulnerabilidad CVE-2021-4034", "url": "https://github.com/A1vinSmith/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · HellGateCorp/pwnkit", "author": "HellGateCorp", "first_seen": "2022-08-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PoC for CVE-2021-4034.", "summary": "PoC for CVE-2021-4034.", "url": "https://github.com/HellGateCorp/pwnkit" }, { "repository": "PoC-in-GitHub · Silencecyber/cve-2021-4034", "author": "Silencecyber", "first_seen": "2022-08-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/Silencecyber/cve-2021-4034" }, { "repository": "PoC-in-GitHub · Geni0r/cve-2021-4034-poc", "author": "Geni0r", "first_seen": "2022-08-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/Geni0r/cve-2021-4034-poc" }, { "repository": "PoC-in-GitHub · RakhithJK/CVE-2021-4034-new", "author": "RakhithJK", "first_seen": "2022-08-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/RakhithJK/CVE-2021-4034-new" }, { "repository": "PoC-in-GitHub · Pixailz/CVE-2021-4034", "author": "Pixailz", "first_seen": "2022-10-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "polkit priv esc: pkexec out of boundary exploit", "summary": "polkit priv esc: pkexec out of boundary exploit", "url": "https://github.com/Pixailz/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · toecesws/CVE-2021-4034", "author": "toecesws", "first_seen": "2022-10-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Vulnerability to CVE-2021-4034 Pwnkit", "summary": "Vulnerability to CVE-2021-4034 Pwnkit", "url": "https://github.com/toecesws/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · tachote/CVE-2021-4034", "author": "tachote", "first_seen": "2022-11-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-4034, exploit para escalado de privilegios en SO Linux a root", "summary": "CVE-2021-4034, exploit para escalado de privilegios en SO Linux a root", "url": "https://github.com/tachote/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · fei9747/CVE-2021-4034", "author": "fei9747", "first_seen": "2022-11-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/fei9747/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · pyhrr0/pwnkit", "author": "pyhrr0", "first_seen": "2023-01-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 PoC", "summary": "CVE-2021-4034 PoC", "url": "https://github.com/pyhrr0/pwnkit" }, { "repository": "PoC-in-GitHub · mutur4/CVE-2021-4034", "author": "mutur4", "first_seen": "2023-01-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A pwnkit N-Day exploit", "summary": "A pwnkit N-Day exploit", "url": "https://github.com/mutur4/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · h3x0v3rl0rd/CVE-2021-4034_Python3", "author": "h3x0v3rl0rd", "first_seen": "2023-02-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/h3x0v3rl0rd/CVE-2021-4034_Python3" }, { "repository": "PoC-in-GitHub · ps-interactive/lab_cve-2021-4034-polkit-emulation-and-detection", "author": "ps-interactive", "first_seen": "2023-06-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/ps-interactive/lab_cve-2021-4034-polkit-emulation-and-detection" }, { "repository": "PoC-in-GitHub · asepsaepdin/CVE-2021-4034", "author": "asepsaepdin", "first_seen": "2023-07-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/asepsaepdin/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · JohnGilbert57/CVE-2021-4034-Capture-the-flag", "author": "JohnGilbert57", "first_seen": "2023-07-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/JohnGilbert57/CVE-2021-4034-Capture-the-flag" }, { "repository": "PoC-in-GitHub · Part01-Pai/Polkit-Permission-promotion-compiled", "author": "Part01-Pai", "first_seen": "2023-11-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Polkit提权包 CVE-2021-4034 （供需要的人方便使用", "summary": "Polkit提权包 CVE-2021-4034 （供需要的人方便使用", "url": "https://github.com/Part01-Pai/Polkit-Permission-promotion-compiled" }, { "repository": "PoC-in-GitHub · cdxiaodong/CVE-2021-4034-touch", "author": "cdxiaodong", "first_seen": "2024-01-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "touch 生成文件", "summary": "touch 生成文件", "url": "https://github.com/cdxiaodong/CVE-2021-4034-touch" }, { "repository": "PoC-in-GitHub · LucasPDiniz/CVE-2021-4034", "author": "LucasPDiniz", "first_seen": "2024-01-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Local Privilege Escalation (LPE) vulnerability in Polkit - Pwnkit", "summary": "Local Privilege Escalation (LPE) vulnerability in Polkit - Pwnkit", "url": "https://github.com/LucasPDiniz/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Pol-Ruiz/CVE-2021-4034", "author": "Pol-Ruiz", "first_seen": "2024-01-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/Pol-Ruiz/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · cerodah/CVE-2021-4034", "author": "cerodah", "first_seen": "2024-01-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PoC de Polkit", "summary": "PoC de Polkit", "url": "https://github.com/cerodah/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · FancySauce/PwnKit-CVE-2021-4034", "author": "FancySauce", "first_seen": "2024-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/FancySauce/PwnKit-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · wechicken456/CVE-2021-4034-CTF-writeup", "author": "wechicken456", "first_seen": "2024-02-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/wechicken456/CVE-2021-4034-CTF-writeup" }, { "repository": "PoC-in-GitHub · ASG-CASTLE/CVE-2021-4034", "author": "ASG-CASTLE", "first_seen": "2024-04-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/ASG-CASTLE/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · X-Projetion/Exploiting-PwnKit-CVE-2021-4034-", "author": "X-Projetion", "first_seen": "2024-05-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/X-Projetion/Exploiting-PwnKit-CVE-2021-4034-" }, { "repository": "PoC-in-GitHub · evkl1d/CVE-2021-4034", "author": "evkl1d", "first_seen": "2024-07-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "polkit", "summary": "polkit", "url": "https://github.com/evkl1d/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · zxybfq/CVE-2021-4034", "author": "zxybfq", "first_seen": "2024-08-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/zxybfq/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · EuJin03/CVE-2021-4034-PoC", "author": "EuJin03", "first_seen": "2024-10-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/EuJin03/CVE-2021-4034-PoC" }, { "repository": "PoC-in-GitHub · dh4r4/PwnKit-CVE-2021-4034-", "author": "dh4r4", "first_seen": "2025-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A rewrite of the Polkit vulnerability.", "summary": "A rewrite of the Polkit vulnerability.", "url": "https://github.com/dh4r4/PwnKit-CVE-2021-4034-" }, { "repository": "PoC-in-GitHub · 12bijaya/CVE-2021-4034-PwnKit-", "author": "12bijaya", "first_seen": "2025-02-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Code to exploit CVE-2021-4034", "summary": "Code to exploit CVE-2021-4034", "url": "https://github.com/12bijaya/CVE-2021-4034-PwnKit-" }, { "repository": "PoC-in-GitHub · nagorealbisu/CVE-2021-4034", "author": "nagorealbisu", "first_seen": "2025-04-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/nagorealbisu/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · igonzalez357/CVE-2021-4034-PwnKit-", "author": "igonzalez357", "first_seen": "2025-04-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Este repositorio muestra cómo explotar la vulnerabilidad CVE-2021-4034.", "summary": "Este repositorio muestra cómo explotar la vulnerabilidad CVE-2021-4034.", "url": "https://github.com/igonzalez357/CVE-2021-4034-PwnKit-" }, { "repository": "PoC-in-GitHub · marcosChoucino/CVE-2021-4034", "author": "marcosChoucino", "first_seen": "2025-04-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Exploit de la vulneravilidad CVE-2021-4034", "summary": "Exploit de la vulneravilidad CVE-2021-4034", "url": "https://github.com/marcosChoucino/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · ikerSandoval003/CVE-2021-4034", "author": "ikerSandoval003", "first_seen": "2025-04-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/ikerSandoval003/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · AsierEgana/cve-2021-4034", "author": "AsierEgana", "first_seen": "2025-04-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/AsierEgana/cve-2021-4034" }, { "repository": "PoC-in-GitHub · Z3R0space/CVE-2021-4034", "author": "Z3R0space", "first_seen": "2025-05-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This contains single-file exploit for cve-2021-4034 which is a Polkit Local Privilege Escalation. Use it wisely!", "summary": "This contains single-file exploit for cve-2021-4034 which is a Polkit Local Privilege Escalation. Use it wisely!", "url": "https://github.com/Z3R0space/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Milad-Rafie/PwnKit-Local-Privilege-Escalation-Vulnerability-Discovered-in-polkit-s-pkexec-CVE-2021-4034", "author": "Milad-Rafie", "first_seen": "2025-05-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Software Vulnerabilities and mitigation university course, to show exploitation and remediation caused by this vulnerability", "summary": "Software Vulnerabilities and mitigation university course, to show exploitation and remediation caused by this vulnerability", "url": "https://github.com/Milad-Rafie/PwnKit-Local-Privilege-Escalation-Vulnerability-Discovered-in-polkit-s-pkexec-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · kali-guru/Pwnkit-CVE-2021-4034", "author": "kali-guru", "first_seen": "2025-05-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Automation Exploit", "summary": "Automation Exploit", "url": "https://github.com/kali-guru/Pwnkit-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · jscamposx/hack", "author": "jscamposx", "first_seen": "2025-06-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Repositorio de investigación de seguridad que contiene una Prueba de Concepto (PoC) para la vulnerabilidad CVE-2021-4034 (PwnKit) y utilidades de scripting para la demostración de escalada de privilegios y ejecución remota en entornos Linux.", "summary": "Repositorio de investigación de seguridad que contiene una Prueba de Concepto (PoC) para la vulnerabilidad CVE-2021-4034 (PwnKit) y utilidades de scripting para la demostración de escalada de privilegios y ejecución remota en entornos Linux.", "url": "https://github.com/jscamposx/hack" }, { "repository": "PoC-in-GitHub · BugVex/Poison-HTB-Report", "author": "BugVex", "first_seen": "2025-06-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Privilege Escalation on HTB \"Poison\" using PwnKit (CVE-2021-4034)", "summary": "Privilege Escalation on HTB \"Poison\" using PwnKit (CVE-2021-4034)", "url": "https://github.com/BugVex/Poison-HTB-Report" }, { "repository": "PoC-in-GitHub · dr4xp/pwnkit-helper", "author": "dr4xp", "first_seen": "2025-09-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "For CTF's and Safe Environments.... CVE-2021-4034 Local PrivEsc.", "summary": "For CTF's and Safe Environments.... CVE-2021-4034 Local PrivEsc.", "url": "https://github.com/dr4xp/pwnkit-helper" }, { "repository": "PoC-in-GitHub · boro03/CVE-2021-4034", "author": "boro03", "first_seen": "2025-12-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/boro03/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · ramahmdr/PwnKit", "author": "ramahmdr", "first_seen": "2026-01-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation", "summary": "Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation", "url": "https://github.com/ramahmdr/PwnKit" }, { "repository": "PoC-in-GitHub · Abbykito/KERNELexploits", "author": "Abbykito", "first_seen": "2026-03-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation", "summary": "Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation", "url": "https://github.com/Abbykito/KERNELexploits" }, { "repository": "PoC-in-GitHub · Allu-mette/cve-2021-4034", "author": "Allu-mette", "first_seen": "2026-03-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PoC of CVE-2021-4034 (PwnKit) for personal training purposes.", "summary": "PoC of CVE-2021-4034 (PwnKit) for personal training purposes.", "url": "https://github.com/Allu-mette/cve-2021-4034" }, { "repository": "PoC-in-GitHub · devianntsec/CVE-2021-4034", "author": "devianntsec", "first_seen": "2026-03-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Advanced Linux Privilege Escalation research on CVE-2021-4034 (PwnKit). Features an optimized exploit with 7 polymorphic payload modes (Interactive Shell, Backdoor, User Creation, Reverse Shell, etc). Portfolio piece focused on memory corruption logic, environment variable manipulation, and anti-forensic techniques.", "summary": "Advanced Linux Privilege Escalation research on CVE-2021-4034 (PwnKit). Features an optimized exploit with 7 polymorphic payload modes (Interactive Shell, Backdoor, User Creation, Reverse Shell, etc). Portfolio piece focused on memory corruption logic, environment variable manipulation, and anti-forensic techniques.", "url": "https://github.com/devianntsec/CVE-2021-4034" }, { "repository": "PoC-in-GitHub · vaibhavkrishna12004/ubuntu-privesc-lab", "author": "vaibhavkrishna12004", "first_seen": "2026-04-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Full penetration testing workflow: credential brute force, SSH access and privilege escalation (CVE-2021-4034)", "summary": "Full penetration testing workflow: credential brute force, SSH access and privilege escalation (CVE-2021-4034)", "url": "https://github.com/vaibhavkrishna12004/ubuntu-privesc-lab" }, { "repository": "PoC-in-GitHub · Murguii/DEV-CVE-2021-4034", "author": "Murguii", "first_seen": "2026-04-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Repositorio para la práctica de DEV sobre la vulnerabilidad CVE-2021-4034. Realizada únicamente con fines académicos.", "summary": "Repositorio para la práctica de DEV sobre la vulnerabilidad CVE-2021-4034. Realizada únicamente con fines académicos.", "url": "https://github.com/Murguii/DEV-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · B1gN0Se/PwnKit_CVE-2021-4034", "author": "B1gN0Se", "first_seen": "2026-04-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/B1gN0Se/PwnKit_CVE-2021-4034" }, { "repository": "PoC-in-GitHub · usmansec/-CVE-2021-4034", "author": "usmansec", "first_seen": "2026-05-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/usmansec/-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · vorkampfer/pwnkit_safety_check", "author": "vorkampfer", "first_seen": "2026-05-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PwnKit (CVE-2021-4034) Safe Checker This tool performs read-only checks and does not attempt exploitation.", "summary": "PwnKit (CVE-2021-4034) Safe Checker This tool performs read-only checks and does not attempt exploitation.", "url": "https://github.com/vorkampfer/pwnkit_safety_check" }, { "repository": "PoC-in-GitHub · rusakalimantan/PwnKit-CVE-2021-4034", "author": "rusakalimantan", "first_seen": "2026-05-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PoC for PwnKit-CVE-2021-4034 - Pkexec Local Privilege Escalation", "summary": "PoC for PwnKit-CVE-2021-4034 - Pkexec Local Privilege Escalation", "url": "https://github.com/rusakalimantan/PwnKit-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · jayhutajulu1/PwnKit-CVE-2021-4034", "author": "jayhutajulu1", "first_seen": "2026-05-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "PoC for PwnKit / CVE-2021-4034 - Pkexec Local Privilege Escalation", "summary": "PoC for PwnKit / CVE-2021-4034 - Pkexec Local Privilege Escalation", "url": "https://github.com/jayhutajulu1/PwnKit-CVE-2021-4034" }, { "repository": "PoC-in-GitHub · Leemyunglyul/cve-2021-4034-mock", "author": "Leemyunglyul", "first_seen": "2026-05-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-4034 repository", "summary": "", "url": "https://github.com/Leemyunglyul/cve-2021-4034-mock" }, { "repository": "PoC-in-GitHub · mac3d0/CVE-2021-4034-pwnkit", "author": "mac3d0", "first_seen": "2026-06-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PoC educacional do CVE-2021-4034, o PwnKit, LPE via pkexec do polkit. Uso autorizado apenas.", "summary": "PoC educacional do CVE-2021-4034, o PwnKit, LPE via pkexec do polkit. Uso autorizado apenas.", "url": "https://github.com/mac3d0/CVE-2021-4034-pwnkit" }, { "repository": "PoC-in-GitHub · krleejihyeong/WHS4_CVE-2021-4034", "author": "krleejihyeong", "first_seen": "2026-07-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Whitehat School 4기 CVE-2021-4034 분석 및 POC 작성", "summary": "Whitehat School 4기 CVE-2021-4034 분석 및 POC 작성", "url": "https://github.com/krleejihyeong/WHS4_CVE-2021-4034" }, { "repository": "PoC-in-GitHub · nicoibarburu/CVE-2021-4034", "author": "nicoibarburu", "first_seen": "2026-08-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This is my simple implementation of an exploit for the PwnKit vulnerability.", "summary": "This is my simple implementation of an exploit for the PwnKit vulnerability.", "url": "https://github.com/nicoibarburu/CVE-2021-4034" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/50689", "https://github.com/ryaagard/CVE-2021-4034", "https://github.com/berdav/CVE-2021-4034", "https://github.com/clubby789/CVE-2021-4034", "https://github.com/gbrsh/CVE-2021-4034", "https://github.com/arthepsy/CVE-2021-4034", "https://github.com/Audiobahn/CVE-2021-4034", "https://github.com/dzonerzy/poc-cve-2021-4034", "https://github.com/nikaiw/CVE-2021-4034", "https://github.com/mebeim/CVE-2021-4034", "https://github.com/Ayrx/CVE-2021-4034", "https://github.com/Y3A/CVE-2021-4034", "https://github.com/An00bRektn/CVE-2021-4034", "https://github.com/ayypril/CVE-2021-4034", "https://github.com/wongwaituck/CVE-2021-4034", "https://github.com/0x05a/my-cve-2021-4034-poc", "https://github.com/silocityit/cve-2021-4034-playground", "https://github.com/zhzyker/CVE-2021-4034", "https://github.com/Immersive-Labs-Sec/CVE-2021-4034", "https://github.com/kimusan/pkwner", "https://github.com/N1et/CVE-2021-4034", "https://github.com/Nero22k/CVE-2021-4034", "https://github.com/LukeGix/CVE-2021-4034", "https://github.com/aus-mate/CVE-2021-4034-POC", "https://github.com/chenaotian/CVE-2021-4034", "https://github.com/moldabekov/CVE-2021-4034", "https://github.com/jostmart/-CVE-2021-4034", "https://github.com/c3l3si4n/pwnkit", "https://github.com/h3x0v3rl0rd/CVE-2021-4034", "https://github.com/ly4k/PwnKit", "https://github.com/san3ncrypt3d/CVE-2021-4034-POC", "https://github.com/fdellwing/CVE-2021-4034", "https://github.com/xcanwin/CVE-2021-4034-UniontechOS", "https://github.com/azminawwar/CVE-2021-4034", "https://github.com/PeterGottesman/pwnkit-exploit", "https://github.com/sunny0day/CVE-2021-4034", "https://github.com/artemis-mike/cve-2021-4034", "https://github.com/whokilleddb/CVE-2021-4034", "https://github.com/dadvlingd/CVE-2021-4034", "https://github.com/zcrosman/cve-2021-4034", "https://github.com/robemmerson/CVE-2021-4034", "https://github.com/joeammond/CVE-2021-4034", "https://github.com/luijait/PwnKit-Exploit", "https://github.com/Anonymous-Family/CVE-2021-4034", "https://github.com/phvilasboas/CVE-2021-4034", "https://github.com/vilasboasph/CVE-2021-4034", "https://github.com/callrbx/pkexec-lpe-poc", "https://github.com/cd80-ctf/CVE-2021-4034", "https://github.com/Al1ex/CVE-2021-4034", "https://github.com/ashutoshrohilla/CVE-2021-4034", "https://github.com/nikip72/CVE-2021-4034", "https://github.com/NiS3x/CVE-2021-4034", "https://github.com/thatstraw/CVE-2021-4034", "https://github.com/luckythandel/CVE-2021-4034", "https://github.com/Plethore/CVE-2021-4034", "https://github.com/evdenis/lsm_bpf_check_argc0", "https://github.com/tahaafarooq/poppy", "https://github.com/DosAmp/pkwned", "https://github.com/PwnFunction/CVE-2021-4034", "https://github.com/NULL0B/CVE-2021-4034", "https://github.com/locksec/CVE-2021-4034", "https://github.com/deoxykev/CVE-2021-4034-Rust", "https://github.com/c3c/CVE-2021-4034", "https://github.com/Fato07/Pwnkit-exploit", "https://github.com/EstamelGG/CVE-2021-4034-NoGCC", "https://github.com/pengalaman-1t/CVE-2021-4034", "https://github.com/jpmcb/pwnkit-go", "https://github.com/JoyGhoshs/CVE-2021-4034", "https://github.com/galoget/PwnKit-CVE-2021-4034", "https://github.com/Yakumwamba/POC-CVE-2021-4034", "https://github.com/ayoub-elbouzi/CVE-2021-4034-Pwnkit", "https://github.com/oreosec/pwnkit", "https://github.com/CYB3RK1D/CVE-2021-4034-POC", "https://github.com/Rvn0xsy/CVE-2021-4034", "https://github.com/Kirill89/CVE-2021-4034", "https://github.com/NeonWhiteRabbit/CVE-2021-4034", "https://github.com/sofire/polkit-0.96-CVE-2021-4034", "https://github.com/codiobert/pwnkit-scanner", "https://github.com/v-rzh/CVE-2021-4034", "https://github.com/TW-D/PwnKit-Vulnerability_CVE-2021-4034", "https://github.com/OXDBXKXO/ez-pwnkit", "https://github.com/milot/dissecting-pkexec-cve-2021-4034", "https://github.com/0x01-sec/CVE-2021-4034-", "https://github.com/navisec/CVE-2021-4034-PwnKit", "https://github.com/Almorabea/pkexec-exploit", "https://github.com/teelrabbit/Polkit-pkexec-exploit-for-Linux", "https://github.com/scent2d/PoC-CVE-2021-4034", "https://github.com/HrishitJoshi/CVE-2021-4034", "https://github.com/Ankit-Ojha16/CVE-2021-4034", "https://github.com/G01d3nW01f/CVE-2021-4034", "https://github.com/drapl0n/pwnKit", "https://github.com/rvzsec/CVE-2021-4034", "https://github.com/Joffr3y/Polkit-CVE-2021-4034-HLP", "https://github.com/ziadsaleemi/polkit_CVE-2021-4034", "https://github.com/FDlucifer/Pwnkit-go", "https://github.com/pombredanne/CVE-2021-4034", "https://github.com/cspshivam/cve-2021-4034", "https://github.com/an0n7os/CVE-2021-4034", "https://github.com/DanaEpp/pwncat_pwnkit", "https://github.com/x04000/CVE-2021-4034", "https://github.com/x04000/AutoPwnkit", "https://github.com/hohn/codeql-sample-polkit", "https://github.com/ck00004/CVE-2021-4034", "https://github.com/LJP-TW/CVE-2021-4034", "https://github.com/fnknda/CVE-2021-4034_POC", "https://github.com/Tanmay-N/CVE-2021-4034", "https://github.com/hahaleyile/CVE-2021-4034", "https://github.com/movvamrocks/PwnKit-CVE-2021-4034", "https://github.com/Squirre17/CVE-2021-4034", "https://github.com/Jesrat/make_me_root", "https://github.com/defhacks/cve-2021-4034", "https://github.com/ITMarcin2211/Polkit-s-Pkexec-CVE-2021-4034", "https://github.com/edsonjt81/CVE-2021-4034-Linux", "https://github.com/nel0x/pwnkit-vulnerability", "https://github.com/TomSgn/CVE-2021-4034", "https://github.com/TheJoyOfHacking/berdav-CVE-2021-4034", "https://github.com/tzwlhack/CVE-2021-4034", "https://github.com/jcatala/f_poc_cve-2021-4034", "https://github.com/Nosferatuvjr/PwnKit", "https://github.com/TotallyNotAHaxxer/CVE-2021-4034", "https://github.com/0x4ndy/CVE-2021-4034-PoC", "https://github.com/antoinenguyen-09/CVE-2021-4034", "https://github.com/wudicainiao/cve-2021-4034", "https://github.com/TanmoyG1800/CVE-2021-4034", "https://github.com/CronoX1/CVE-2021-4034", "https://github.com/supportingmx/cve-2021-4034", "https://github.com/A1vinSmith/CVE-2021-4034", "https://github.com/HellGateCorp/pwnkit", "https://github.com/Silencecyber/cve-2021-4034", "https://github.com/Geni0r/cve-2021-4034-poc", "https://github.com/RakhithJK/CVE-2021-4034-new", "https://github.com/Pixailz/CVE-2021-4034", "https://github.com/toecesws/CVE-2021-4034", "https://github.com/tachote/CVE-2021-4034", "https://github.com/fei9747/CVE-2021-4034", "https://github.com/pyhrr0/pwnkit", "https://github.com/mutur4/CVE-2021-4034", "https://github.com/h3x0v3rl0rd/CVE-2021-4034_Python3", "https://github.com/ps-interactive/lab_cve-2021-4034-polkit-emulation-and-detection", "https://github.com/asepsaepdin/CVE-2021-4034", "https://github.com/JohnGilbert57/CVE-2021-4034-Capture-the-flag", "https://github.com/Part01-Pai/Polkit-Permission-promotion-compiled", "https://github.com/cdxiaodong/CVE-2021-4034-touch", "https://github.com/LucasPDiniz/CVE-2021-4034", "https://github.com/Pol-Ruiz/CVE-2021-4034", "https://github.com/cerodah/CVE-2021-4034", "https://github.com/FancySauce/PwnKit-CVE-2021-4034", "https://github.com/wechicken456/CVE-2021-4034-CTF-writeup", "https://github.com/ASG-CASTLE/CVE-2021-4034", "https://github.com/X-Projetion/Exploiting-PwnKit-CVE-2021-4034-", "https://github.com/evkl1d/CVE-2021-4034", "https://github.com/zxybfq/CVE-2021-4034", "https://github.com/EuJin03/CVE-2021-4034-PoC", "https://github.com/dh4r4/PwnKit-CVE-2021-4034-", "https://github.com/12bijaya/CVE-2021-4034-PwnKit-", "https://github.com/nagorealbisu/CVE-2021-4034", "https://github.com/igonzalez357/CVE-2021-4034-PwnKit-", "https://github.com/marcosChoucino/CVE-2021-4034", "https://github.com/ikerSandoval003/CVE-2021-4034", "https://github.com/AsierEgana/cve-2021-4034", "https://github.com/Z3R0space/CVE-2021-4034", "https://github.com/Milad-Rafie/PwnKit-Local-Privilege-Escalation-Vulnerability-Discovered-in-polkit-s-pkexec-CVE-2021-4034", "https://github.com/kali-guru/Pwnkit-CVE-2021-4034", "https://github.com/jscamposx/hack", "https://github.com/BugVex/Poison-HTB-Report", "https://github.com/dr4xp/pwnkit-helper", "https://github.com/boro03/CVE-2021-4034", "https://github.com/ramahmdr/PwnKit", "https://github.com/Abbykito/KERNELexploits", "https://github.com/Allu-mette/cve-2021-4034", "https://github.com/devianntsec/CVE-2021-4034", "https://github.com/vaibhavkrishna12004/ubuntu-privesc-lab", "https://github.com/Murguii/DEV-CVE-2021-4034", "https://github.com/B1gN0Se/PwnKit_CVE-2021-4034", "https://github.com/usmansec/-CVE-2021-4034", "https://github.com/vorkampfer/pwnkit_safety_check", "https://github.com/rusakalimantan/PwnKit-CVE-2021-4034", "https://github.com/jayhutajulu1/PwnKit-CVE-2021-4034", "https://github.com/Leemyunglyul/cve-2021-4034-mock", "https://github.com/mac3d0/CVE-2021-4034-pwnkit", "https://github.com/krleejihyeong/WHS4_CVE-2021-4034", "https://github.com/nicoibarburu/CVE-2021-4034" ], "timeline": [ { "at": "2026-08-14T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-06-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-06-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-06-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-06-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-06-27", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2021-3156", "vendor": "Sudo", "product": "Sudo", "title": "Sudo Heap-Based Buffer Overflow Vulnerability", "summary": "Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.", "updated_at": "2026-08-06T22:00:00Z", "published_at": "2026-08-06T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 728, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 49521", "author": "West Shepherd", "first_seen": "2021-02-03", "confidence": "High", "title": "Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (1)", "summary": "Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (1)", "url": "https://www.exploit-db.com/exploits/49521", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 49522", "author": "nu11secur1ty", "first_seen": "2021-02-03", "confidence": "High", "title": "Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (2)", "summary": "Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (2)", "url": "https://www.exploit-db.com/exploits/49522", "verification": "verified", "verified": true }, { "repository": "PoC-in-GitHub · mr-r3b00t/CVE-2021-3156", "author": "mr-r3b00t", "first_seen": "2021-01-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 35, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/mr-r3b00t/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · nexcess/sudo_cve-2021-3156", "author": "nexcess", "first_seen": "2021-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/nexcess/sudo_cve-2021-3156" }, { "repository": "PoC-in-GitHub · reverse-ex/CVE-2021-3156", "author": "reverse-ex", "first_seen": "2021-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 112, "title": "CVE-2021-3156", "summary": "CVE-2021-3156", "url": "https://github.com/reverse-ex/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · unauth401/CVE-2021-3156", "author": "unauth401", "first_seen": "2021-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/unauth401/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · ymrsmns/CVE-2021-3156", "author": "ymrsmns", "first_seen": "2021-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156", "summary": "CVE-2021-3156", "url": "https://github.com/ymrsmns/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · elbee-cyber/CVE-2021-3156-PATCHER", "author": "elbee-cyber", "first_seen": "2021-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "This simple bash script will patch the recently discovered sudo heap overflow vulnerability.", "summary": "This simple bash script will patch the recently discovered sudo heap overflow vulnerability.", "url": "https://github.com/elbee-cyber/CVE-2021-3156-PATCHER" }, { "repository": "PoC-in-GitHub · kernelzeroday/CVE-2021-3156-Baron-Samedit", "author": "kernelzeroday", "first_seen": "2021-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 18, "title": "1day research effort", "summary": "1day research effort", "url": "https://github.com/kernelzeroday/CVE-2021-3156-Baron-Samedit" }, { "repository": "PoC-in-GitHub · yaunsky/cve-2021-3156", "author": "yaunsky", "first_seen": "2021-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "cve-2021-3156;sudo堆溢出漏洞；漏洞检测", "summary": "cve-2021-3156;sudo堆溢出漏洞；漏洞检测", "url": "https://github.com/yaunsky/cve-2021-3156" }, { "repository": "PoC-in-GitHub · baka9moe/CVE-2021-3156-Exp", "author": "baka9moe", "first_seen": "2021-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/baka9moe/CVE-2021-3156-Exp" }, { "repository": "PoC-in-GitHub · ph4ntonn/CVE-2021-3156", "author": "ph4ntonn", "first_seen": "2021-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "CVE-2021-3156", "summary": "CVE-2021-3156", "url": "https://github.com/ph4ntonn/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · binw2018/CVE-2021-3156-SCRIPT", "author": "binw2018", "first_seen": "2021-01-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/binw2018/CVE-2021-3156-SCRIPT" }, { "repository": "PoC-in-GitHub · freeFV/CVE-2021-3156", "author": "freeFV", "first_seen": "2021-01-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/freeFV/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · mbcrump/CVE-2021-3156", "author": "mbcrump", "first_seen": "2021-01-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 39, "title": "Notes regarding CVE-2021-3156: Heap-Based Buffer Overflow in Sudo", "summary": "Notes regarding CVE-2021-3156: Heap-Based Buffer Overflow in Sudo", "url": "https://github.com/mbcrump/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · stong/CVE-2021-3156", "author": "stong", "first_seen": "2021-01-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 429, "title": "PoC for CVE-2021-3156 (sudo heap overflow)", "summary": "PoC for CVE-2021-3156 (sudo heap overflow)", "url": "https://github.com/stong/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · nobodyatall648/CVE-2021-3156", "author": "nobodyatall648", "first_seen": "2021-01-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "checking CVE-2021-3156 vulnerability & patch script", "summary": "checking CVE-2021-3156 vulnerability & patch script", "url": "https://github.com/nobodyatall648/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · blasty/CVE-2021-3156", "author": "blasty", "first_seen": "2021-01-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1023, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/blasty/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · teamtopkarl/CVE-2021-3156", "author": "teamtopkarl", "first_seen": "2021-01-31", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/teamtopkarl/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · Q4n/CVE-2021-3156", "author": "Q4n", "first_seen": "2021-01-31", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "复现别人家的CVEs系列", "summary": "复现别人家的CVEs系列", "url": "https://github.com/Q4n/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · kal1gh0st/CVE-2021-3156", "author": "kal1gh0st", "first_seen": "2021-01-31", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "Description Sudo before 1.9.5p2 has a Heap-based Buffer Overflow, allowing privilege escalation to root via \"sudoedit -s\" and a command-line argument that ends with a single backslash character.", "summary": "Description Sudo before 1.9.5p2 has a Heap-based Buffer Overflow, allowing privilege escalation to root via \"sudoedit -s\" and a command-line argument that ends with a single backslash character.", "url": "https://github.com/kal1gh0st/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · apogiatzis/docker-CVE-2021-3156", "author": "apogiatzis", "first_seen": "2021-01-31", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "A docker environment to research CVE-2021-3156", "summary": "A docker environment to research CVE-2021-3156", "url": "https://github.com/apogiatzis/docker-CVE-2021-3156" }, { "repository": "PoC-in-GitHub · Ashish-dawani/CVE-2021-3156-Patch", "author": "Ashish-dawani", "first_seen": "2021-02-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Patch Script for CVE-2021-3156 Heap Overflow", "summary": "Patch Script for CVE-2021-3156 Heap Overflow", "url": "https://github.com/Ashish-dawani/CVE-2021-3156-Patch" }, { "repository": "PoC-in-GitHub · SantiagoSerrao/ScannerCVE-2021-3156", "author": "SantiagoSerrao", "first_seen": "2021-02-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/SantiagoSerrao/ScannerCVE-2021-3156" }, { "repository": "PoC-in-GitHub · DanielAzulayy/CTF-2021", "author": "DanielAzulayy", "first_seen": "2021-02-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CTF for HDE 64 students at See Security College. Exploit a JWT (web part) & CVE-2021-3156 (LPE part).", "summary": "CTF for HDE 64 students at See Security College. Exploit a JWT (web part) & CVE-2021-3156 (LPE part).", "url": "https://github.com/DanielAzulayy/CTF-2021" }, { "repository": "PoC-in-GitHub · dinhbaouit/CVE-2021-3156", "author": "dinhbaouit", "first_seen": "2021-02-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "CVE-2021-3156 Vagrant Lab", "summary": "CVE-2021-3156 Vagrant Lab", "url": "https://github.com/dinhbaouit/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · CptGibbon/CVE-2021-3156", "author": "CptGibbon", "first_seen": "2021-02-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 158, "title": "Root shell PoC for CVE-2021-3156", "summary": "Root shell PoC for CVE-2021-3156", "url": "https://github.com/CptGibbon/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · perlun/sudo-1.8.3p1-patched", "author": "perlun", "first_seen": "2021-02-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Custom version of sudo 1.8.3p1 with CVE-2021-3156 patches applied", "summary": "Custom version of sudo 1.8.3p1 with CVE-2021-3156 patches applied", "url": "https://github.com/perlun/sudo-1.8.3p1-patched" }, { "repository": "PoC-in-GitHub · 1N53C/CVE-2021-3156-PoC", "author": "1N53C", "first_seen": "2021-02-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/1N53C/CVE-2021-3156-PoC" }, { "repository": "PoC-in-GitHub · 0xdevil/CVE-2021-3156", "author": "0xdevil", "first_seen": "2021-02-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 51, "title": "CVE-2021-3156: Sudo heap overflow exploit for Debian 10", "summary": "CVE-2021-3156: Sudo heap overflow exploit for Debian 10", "url": "https://github.com/0xdevil/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · gmldbd94/cve-2021-3156", "author": "gmldbd94", "first_seen": "2021-02-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "보안취약점 확인", "summary": "보안취약점 확인", "url": "https://github.com/gmldbd94/cve-2021-3156" }, { "repository": "PoC-in-GitHub · jm33-m0/CVE-2021-3156", "author": "jm33-m0", "first_seen": "2021-02-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 16, "title": "sudo heap overflow to LPE, in Go", "summary": "sudo heap overflow to LPE, in Go", "url": "https://github.com/jm33-m0/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · Rvn0xsy/CVE-2021-3156-plus", "author": "Rvn0xsy", "first_seen": "2021-02-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 205, "title": "CVE-2021-3156非交互式执行命令", "summary": "CVE-2021-3156非交互式执行命令", "url": "https://github.com/Rvn0xsy/CVE-2021-3156-plus" }, { "repository": "PoC-in-GitHub · oneoy/CVE-2021-3156", "author": "oneoy", "first_seen": "2021-02-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/oneoy/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · worawit/CVE-2021-3156", "author": "worawit", "first_seen": "2021-03-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 804, "title": "Sudo Baron Samedit Exploit", "summary": "Sudo Baron Samedit Exploit", "url": "https://github.com/worawit/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · lmol/CVE-2021-3156", "author": "lmol", "first_seen": "2021-03-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "Exploit generator for sudo CVE-2021-3156", "summary": "Exploit generator for sudo CVE-2021-3156", "url": "https://github.com/lmol/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · BearCat4/CVE-2021-3156", "author": "BearCat4", "first_seen": "2021-03-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-3156漏洞修复Shell", "summary": "CVE-2021-3156漏洞修复Shell", "url": "https://github.com/BearCat4/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · capturingcats/CVE-2021-3156", "author": "capturingcats", "first_seen": "2021-04-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/capturingcats/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · LiveOverflow/pwnedit", "author": "LiveOverflow", "first_seen": "2021-04-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 225, "title": "CVE-2021-3156 - Sudo Baron Samedit", "summary": "CVE-2021-3156 - Sudo Baron Samedit", "url": "https://github.com/LiveOverflow/pwnedit" }, { "repository": "PoC-in-GitHub · ajtech-hue/CVE-2021-3156-Mitigation-ShellScript-Build", "author": "ajtech-hue", "first_seen": "2021-05-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/ajtech-hue/CVE-2021-3156-Mitigation-ShellScript-Build" }, { "repository": "PoC-in-GitHub · donghyunlee00/CVE-2021-3156", "author": "donghyunlee00", "first_seen": "2021-06-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/donghyunlee00/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · TheFlash2k/CVE-2021-3156", "author": "TheFlash2k", "first_seen": "2021-06-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/TheFlash2k/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · Exodusro/CVE-2021-3156", "author": "Exodusro", "first_seen": "2021-07-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/Exodusro/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · 0x7183/CVE-2021-3156", "author": "0x7183", "first_seen": "2021-08-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Sudo Heap Overflow Baron Samedit", "summary": "Sudo Heap Overflow Baron Samedit", "url": "https://github.com/0x7183/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · sbladiamond/CVE-2021-3156", "author": "sbladiamond", "first_seen": "2021-09-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/sbladiamond/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · redhawkeye/sudo-exploit", "author": "redhawkeye", "first_seen": "2021-09-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 17, "title": "CVE-2021-3156 - sudo exploit for ubuntu 18.04 & 20.04", "summary": "CVE-2021-3156 - sudo exploit for ubuntu 18.04 & 20.04", "url": "https://github.com/redhawkeye/sudo-exploit" }, { "repository": "PoC-in-GitHub · d3c3ptic0n/CVE-2021-3156", "author": "d3c3ptic0n", "first_seen": "2021-09-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Sudo heap-based buffer overflow privilege escalation commands and mitigations.", "summary": "Sudo heap-based buffer overflow privilege escalation commands and mitigations.", "url": "https://github.com/d3c3ptic0n/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · musergi/CVE-2021-3156", "author": "musergi", "first_seen": "2021-10-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/musergi/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · halissha/CVE-2021-3156", "author": "halissha", "first_seen": "2021-10-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 exploit", "summary": "CVE-2021-3156 exploit", "url": "https://github.com/halissha/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · sharkmoos/Baron-Samedit", "author": "sharkmoos", "first_seen": "2021-11-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Exploit and Demo system for CVE-2021-3156", "summary": "Exploit and Demo system for CVE-2021-3156", "url": "https://github.com/sharkmoos/Baron-Samedit" }, { "repository": "PoC-in-GitHub · chenaotian/CVE-2021-3156", "author": "chenaotian", "first_seen": "2022-01-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 11, "title": "CVE-2021-3156 POC and Docker and Analysis write up", "summary": "CVE-2021-3156 POC and Docker and Analysis write up", "url": "https://github.com/chenaotian/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · ret2basic/SudoScience", "author": "ret2basic", "first_seen": "2022-02-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 deep dive.", "summary": "CVE-2021-3156 deep dive.", "url": "https://github.com/ret2basic/SudoScience" }, { "repository": "PoC-in-GitHub · puckiestyle/CVE-2021-3156", "author": "puckiestyle", "first_seen": "2022-03-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/puckiestyle/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · barebackbandit/CVE-2021-3156", "author": "barebackbandit", "first_seen": "2022-03-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Exploit for CVE-2021-3156", "summary": "Exploit for CVE-2021-3156", "url": "https://github.com/barebackbandit/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · RodricBr/CVE-2021-3156", "author": "RodricBr", "first_seen": "2022-03-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-3156", "summary": "CVE-2021-3156", "url": "https://github.com/RodricBr/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · ypl6/heaplens", "author": "ypl6", "first_seen": "2022-03-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CMPT733 Cybersecurity Lab II Project: GDB plugin for heap exploits inspired by CVE-2021-3156", "summary": "CMPT733 Cybersecurity Lab II Project: GDB plugin for heap exploits inspired by CVE-2021-3156", "url": "https://github.com/ypl6/heaplens" }, { "repository": "PoC-in-GitHub · q77190858/CVE-2021-3156", "author": "q77190858", "first_seen": "2022-05-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "sudo提权漏洞CVE-2021-3156复现代码", "summary": "sudo提权漏洞CVE-2021-3156复现代码", "url": "https://github.com/q77190858/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · arvindshima/CVE-2021-3156", "author": "arvindshima", "first_seen": "2022-06-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit)", "summary": "CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit)", "url": "https://github.com/arvindshima/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · Mhackiori/CVE-2021-3156", "author": "Mhackiori", "first_seen": "2022-07-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "Visualization, Fuzzing, Exploit and Patch of Baron Samedit Vulnerability", "summary": "Visualization, Fuzzing, Exploit and Patch of Baron Samedit Vulnerability", "url": "https://github.com/Mhackiori/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · PhuketIsland/CVE-2021-3156-centos7", "author": "PhuketIsland", "first_seen": "2022-11-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 30, "title": "利用sudo提权，只针对cnetos7", "summary": "利用sudo提权，只针对cnetos7", "url": "https://github.com/PhuketIsland/CVE-2021-3156-centos7" }, { "repository": "PoC-in-GitHub · 0x4ndy/clif", "author": "0x4ndy", "first_seen": "2022-11-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 100, "title": "clif is a command-line interface (CLI) application fuzzer, pretty much what wfuzz or ffuf are for web. It was inspired by sudo vulnerability CVE-2021-3156 and the fact that for some reasons, Google's afl-fuzz doesn't allow for unlimited argument or option specification.", "summary": "clif is a command-line interface (CLI) application fuzzer, pretty much what wfuzz or ffuf are for web. It was inspired by sudo vulnerability CVE-2021-3156 and the fact that for some reasons, Google's afl-fuzz doesn't allow for unlimited argument or option specification.", "url": "https://github.com/0x4ndy/clif" }, { "repository": "PoC-in-GitHub · hycheng15/CVE-2021-3156", "author": "hycheng15", "first_seen": "2022-12-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/hycheng15/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · mutur4/CVE-2021-3156", "author": "mutur4", "first_seen": "2023-05-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Baron SameEdit Heap Overflow LPE 1-Day Exploit", "summary": "Baron SameEdit Heap Overflow LPE 1-Day Exploit", "url": "https://github.com/mutur4/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · PurpleOzone/PE_CVE-CVE-2021-3156", "author": "PurpleOzone", "first_seen": "2023-05-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "Exploit for Ubuntu 20.04 using CVE-2021-3156 enhanced with post-exploitation scripts", "summary": "Exploit for Ubuntu 20.04 using CVE-2021-3156 enhanced with post-exploitation scripts", "url": "https://github.com/PurpleOzone/PE_CVE-CVE-2021-3156" }, { "repository": "PoC-in-GitHub · asepsaepdin/CVE-2021-3156", "author": "asepsaepdin", "first_seen": "2023-09-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/asepsaepdin/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · DDayLuong/CVE-2021-3156", "author": "DDayLuong", "first_seen": "2023-12-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/DDayLuong/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · DASICS-ICT/DASICS-CVE-2021-3156", "author": "DASICS-ICT", "first_seen": "2023-12-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/DASICS-ICT/DASICS-CVE-2021-3156" }, { "repository": "PoC-in-GitHub · wurwur/CVE-2021-3156", "author": "wurwur", "first_seen": "2024-01-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Different files for computer security coursework", "summary": "Different files for computer security coursework", "url": "https://github.com/wurwur/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · lypd0/CVE-2021-3156-checker", "author": "lypd0", "first_seen": "2024-05-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Checker for CVE-2021-3156 with static version check", "summary": "Checker for CVE-2021-3156 with static version check", "url": "https://github.com/lypd0/CVE-2021-3156-checker" }, { "repository": "PoC-in-GitHub · Bad3r/CVE-2021-3156-without-ip-command", "author": "Bad3r", "first_seen": "2024-11-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "fork of worawit/CVE-2021-3156 exploit_nss.py modified to work with ifconfig instead of the ip command", "summary": "fork of worawit/CVE-2021-3156 exploit_nss.py modified to work with ifconfig instead of the ip command", "url": "https://github.com/Bad3r/CVE-2021-3156-without-ip-command" }, { "repository": "PoC-in-GitHub · Sebastianbedoya25/CVE-2021-3156", "author": "Sebastianbedoya25", "first_seen": "2024-12-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/Sebastianbedoya25/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · czeti/baron-samedit", "author": "czeti", "first_seen": "2025-02-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This repository contains a Proof-of-Concept (PoC) exploit for the Baron Samedit vulnerability (CVE-2021-3156). The exploit demonstrates privilege escalation on Ubuntu 20.04 with sudo version 1.8.31 and glibc version 2.31. It includes an assembly-based exploit, a shared object payload, and a Makefile for automated compilation.", "summary": "This repository contains a Proof-of-Concept (PoC) exploit for the Baron Samedit vulnerability (CVE-2021-3156). The exploit demonstrates privilege escalation on Ubuntu 20.04 with sudo version 1.8.31 and glibc version 2.31. It includes an assembly-based exploit, a shared object payload, and a Makefile for automated compilation.", "url": "https://github.com/czeti/baron-samedit" }, { "repository": "PoC-in-GitHub · Sornphut/CVE-2021-3156-Heap-Based-Buffer-Overflow-in-Sudo-Baron-Samedit-", "author": "Sornphut", "first_seen": "2025-03-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/Sornphut/CVE-2021-3156-Heap-Based-Buffer-Overflow-in-Sudo-Baron-Samedit-" }, { "repository": "PoC-in-GitHub · shishirpandey18/CVE-2021-3156", "author": "shishirpandey18", "first_seen": "2025-05-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/shishirpandey18/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · Shuhaib88/Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156", "author": "Shuhaib88", "first_seen": "2025-05-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/Shuhaib88/Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156" }, { "repository": "PoC-in-GitHub · gmh5225/cve-2021-3156-", "author": "gmh5225", "first_seen": "2025-06-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/gmh5225/cve-2021-3156-" }, { "repository": "PoC-in-GitHub · TopskiyPavelQwertyGang/Review.CVE-2021-3156", "author": "TopskiyPavelQwertyGang", "first_seen": "2025-06-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156-Exploit-Demo", "summary": "CVE-2021-3156-Exploit-Demo", "url": "https://github.com/TopskiyPavelQwertyGang/Review.CVE-2021-3156" }, { "repository": "PoC-in-GitHub · Maalfer/Sudo-CVE-2021-3156", "author": "Maalfer", "first_seen": "2025-07-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "Exploit para explotar la vulnerabilidad CVE-2025-32463", "summary": "Exploit para explotar la vulnerabilidad CVE-2025-32463", "url": "https://github.com/Maalfer/Sudo-CVE-2021-3156" }, { "repository": "PoC-in-GitHub · HuzaifaTariqAfzalKhan/CVE-Exploit-Research-Development-ITSOLERA", "author": "HuzaifaTariqAfzalKhan", "first_seen": "2025-08-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A research regarding the exisiting CVE exploit : CVE-2021-3156(Sudo BufferOverflow)", "summary": "A research regarding the exisiting CVE exploit : CVE-2021-3156(Sudo BufferOverflow)", "url": "https://github.com/HuzaifaTariqAfzalKhan/CVE-Exploit-Research-Development-ITSOLERA" }, { "repository": "PoC-in-GitHub · VilmarTuminskii/cve-2021-3156-sudo-lab", "author": "VilmarTuminskii", "first_seen": "2026-01-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Projeto educacional desenvolvido em Python com foco na análise da vulnerabilidade CVE-2021-3156 (Baron Samedit), uma falha crítica no sudo que permitia elevação de privilégio local em sistemas Linux.", "summary": "Projeto educacional desenvolvido em Python com foco na análise da vulnerabilidade CVE-2021-3156 (Baron Samedit), uma falha crítica no sudo que permitia elevação de privilégio local em sistemas Linux.", "url": "https://github.com/VilmarTuminskii/cve-2021-3156-sudo-lab" }, { "repository": "PoC-in-GitHub · DakerQirszh/cve-2021-3156", "author": "DakerQirszh", "first_seen": "2026-01-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "fixed version", "summary": "fixed version", "url": "https://github.com/DakerQirszh/cve-2021-3156" }, { "repository": "PoC-in-GitHub · TheLeopard65/CVE-2021-3156-Baron-Samedit", "author": "TheLeopard65", "first_seen": "2026-03-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A simple Docker lab and Exploit setup for CVE-2021-3156 - \"Baron Samedit\".", "summary": "A simple Docker lab and Exploit setup for CVE-2021-3156 - \"Baron Samedit\".", "url": "https://github.com/TheLeopard65/CVE-2021-3156-Baron-Samedit" }, { "repository": "PoC-in-GitHub · Rana-Ali93/CVE-2021-3156-Sudo-Buffer-Overflow-Linux", "author": "Rana-Ali93", "first_seen": "2026-03-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Red Team exploitation of CVE-2021-3156 (Baron Samedit) – Heap Buffer Overflow in Sudo leading to Local Privilege Escalation on Ubuntu 20.04", "summary": "Red Team exploitation of CVE-2021-3156 (Baron Samedit) – Heap Buffer Overflow in Sudo leading to Local Privilege Escalation on Ubuntu 20.04", "url": "https://github.com/Rana-Ali93/CVE-2021-3156-Sudo-Buffer-Overflow-Linux" }, { "repository": "PoC-in-GitHub · ngtuonghung/CVE-2021-3156", "author": "ngtuonghung", "first_seen": "2026-03-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "POC for CVE-2021-3156 - Heap-based buffer overflow in sudo", "summary": "POC for CVE-2021-3156 - Heap-based buffer overflow in sudo", "url": "https://github.com/ngtuonghung/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · Robblackcatchai/porfolio-Baron-Samedit", "author": "Robblackcatchai", "first_seen": "2026-05-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "this is a study about CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit)", "summary": "this is a study about CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit)", "url": "https://github.com/Robblackcatchai/porfolio-Baron-Samedit" }, { "repository": "PoC-in-GitHub · calonnuotcabe/CVE-2021-3156", "author": "calonnuotcabe", "first_seen": "2026-05-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Exploiting heap-based buffer overflow in sudo for privilege escalation", "summary": "Exploiting heap-based buffer overflow in sudo for privilege escalation", "url": "https://github.com/calonnuotcabe/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · Kranti08/CVE-2021-3156-Baron-Samedit", "author": "Kranti08", "first_seen": "2026-06-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Exploitation and mitigation analysis of CVE-2021-3156 heap-based buffer overflow in sudo", "summary": "Exploitation and mitigation analysis of CVE-2021-3156 heap-based buffer overflow in sudo", "url": "https://github.com/Kranti08/CVE-2021-3156-Baron-Samedit" }, { "repository": "PoC-in-GitHub · IJBaig/CVE-2021-3156", "author": "IJBaig", "first_seen": "2026-07-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 (Baron Samedit) Report and Research", "summary": "CVE-2021-3156 (Baron Samedit) Report and Research", "url": "https://github.com/IJBaig/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · WhatsWrongAndWhy/CVE-2021-3156", "author": "WhatsWrongAndWhy", "first_seen": "2026-07-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/WhatsWrongAndWhy/CVE-2021-3156" }, { "repository": "PoC-in-GitHub · Shams-Ul-Mehmood/CVE-2021-3156-Project", "author": "Shams-Ul-Mehmood", "first_seen": "2026-08-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-3156 repository", "summary": "", "url": "https://github.com/Shams-Ul-Mehmood/CVE-2021-3156-Project" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/49521", "https://www.exploit-db.com/exploits/49522", "https://github.com/mr-r3b00t/CVE-2021-3156", "https://github.com/nexcess/sudo_cve-2021-3156", "https://github.com/reverse-ex/CVE-2021-3156", "https://github.com/unauth401/CVE-2021-3156", "https://github.com/ymrsmns/CVE-2021-3156", "https://github.com/elbee-cyber/CVE-2021-3156-PATCHER", "https://github.com/kernelzeroday/CVE-2021-3156-Baron-Samedit", "https://github.com/yaunsky/cve-2021-3156", "https://github.com/baka9moe/CVE-2021-3156-Exp", "https://github.com/ph4ntonn/CVE-2021-3156", "https://github.com/binw2018/CVE-2021-3156-SCRIPT", "https://github.com/freeFV/CVE-2021-3156", "https://github.com/mbcrump/CVE-2021-3156", "https://github.com/stong/CVE-2021-3156", "https://github.com/nobodyatall648/CVE-2021-3156", "https://github.com/blasty/CVE-2021-3156", "https://github.com/teamtopkarl/CVE-2021-3156", "https://github.com/Q4n/CVE-2021-3156", "https://github.com/kal1gh0st/CVE-2021-3156", "https://github.com/apogiatzis/docker-CVE-2021-3156", "https://github.com/Ashish-dawani/CVE-2021-3156-Patch", "https://github.com/SantiagoSerrao/ScannerCVE-2021-3156", "https://github.com/DanielAzulayy/CTF-2021", "https://github.com/dinhbaouit/CVE-2021-3156", "https://github.com/CptGibbon/CVE-2021-3156", "https://github.com/perlun/sudo-1.8.3p1-patched", "https://github.com/1N53C/CVE-2021-3156-PoC", "https://github.com/0xdevil/CVE-2021-3156", "https://github.com/gmldbd94/cve-2021-3156", "https://github.com/jm33-m0/CVE-2021-3156", "https://github.com/Rvn0xsy/CVE-2021-3156-plus", "https://github.com/oneoy/CVE-2021-3156", "https://github.com/worawit/CVE-2021-3156", "https://github.com/lmol/CVE-2021-3156", "https://github.com/BearCat4/CVE-2021-3156", "https://github.com/capturingcats/CVE-2021-3156", "https://github.com/LiveOverflow/pwnedit", "https://github.com/ajtech-hue/CVE-2021-3156-Mitigation-ShellScript-Build", "https://github.com/donghyunlee00/CVE-2021-3156", "https://github.com/TheFlash2k/CVE-2021-3156", "https://github.com/Exodusro/CVE-2021-3156", "https://github.com/0x7183/CVE-2021-3156", "https://github.com/sbladiamond/CVE-2021-3156", "https://github.com/redhawkeye/sudo-exploit", "https://github.com/d3c3ptic0n/CVE-2021-3156", "https://github.com/musergi/CVE-2021-3156", "https://github.com/halissha/CVE-2021-3156", "https://github.com/sharkmoos/Baron-Samedit", "https://github.com/chenaotian/CVE-2021-3156", "https://github.com/ret2basic/SudoScience", "https://github.com/puckiestyle/CVE-2021-3156", "https://github.com/barebackbandit/CVE-2021-3156", "https://github.com/RodricBr/CVE-2021-3156", "https://github.com/ypl6/heaplens", "https://github.com/q77190858/CVE-2021-3156", "https://github.com/arvindshima/CVE-2021-3156", "https://github.com/Mhackiori/CVE-2021-3156", "https://github.com/PhuketIsland/CVE-2021-3156-centos7", "https://github.com/0x4ndy/clif", "https://github.com/hycheng15/CVE-2021-3156", "https://github.com/mutur4/CVE-2021-3156", "https://github.com/PurpleOzone/PE_CVE-CVE-2021-3156", "https://github.com/asepsaepdin/CVE-2021-3156", "https://github.com/DDayLuong/CVE-2021-3156", "https://github.com/DASICS-ICT/DASICS-CVE-2021-3156", "https://github.com/wurwur/CVE-2021-3156", "https://github.com/lypd0/CVE-2021-3156-checker", "https://github.com/Bad3r/CVE-2021-3156-without-ip-command", "https://github.com/Sebastianbedoya25/CVE-2021-3156", "https://github.com/czeti/baron-samedit", "https://github.com/Sornphut/CVE-2021-3156-Heap-Based-Buffer-Overflow-in-Sudo-Baron-Samedit-", "https://github.com/shishirpandey18/CVE-2021-3156", "https://github.com/Shuhaib88/Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156", "https://github.com/gmh5225/cve-2021-3156-", "https://github.com/TopskiyPavelQwertyGang/Review.CVE-2021-3156", "https://github.com/Maalfer/Sudo-CVE-2021-3156", "https://github.com/HuzaifaTariqAfzalKhan/CVE-Exploit-Research-Development-ITSOLERA", "https://github.com/VilmarTuminskii/cve-2021-3156-sudo-lab", "https://github.com/DakerQirszh/cve-2021-3156", "https://github.com/TheLeopard65/CVE-2021-3156-Baron-Samedit", "https://github.com/Rana-Ali93/CVE-2021-3156-Sudo-Buffer-Overflow-Linux", "https://github.com/ngtuonghung/CVE-2021-3156", "https://github.com/Robblackcatchai/porfolio-Baron-Samedit", "https://github.com/calonnuotcabe/CVE-2021-3156", "https://github.com/Kranti08/CVE-2021-3156-Baron-Samedit", "https://github.com/IJBaig/CVE-2021-3156", "https://github.com/WhatsWrongAndWhy/CVE-2021-3156", "https://github.com/Shams-Ul-Mehmood/CVE-2021-3156-Project" ], "timeline": [ { "at": "2026-08-06T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-04-06", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-04-06", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-04-06", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-04-06", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-04-06", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2021-1931", "vendor": "Unknown vendor", "product": "Unknown product", "title": "proof of concept CVE-2021-1931 exploit for the blackberry key2 (le) that allows to flash unsigned images temporarily", "summary": "proof of concept CVE-2021-1931 exploit for the blackberry key2 (le) that allows to flash unsigned images temporarily", "updated_at": "2026-07-30T22:00:00Z", "published_at": "2026-07-30T22:00:00Z", "cvss": 0, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "PoC-in-GitHub · FakeShell/CVE-2021-1931-BBRY-KEY2", "author": "FakeShell", "first_seen": "2025-05-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "proof of concept CVE-2021-1931 exploit for the blackberry key2 (le) that allows to flash unsigned images temporarily", "summary": "proof of concept CVE-2021-1931 exploit for the blackberry key2 (le) that allows to flash unsigned images temporarily", "url": "https://github.com/FakeShell/CVE-2021-1931-BBRY-KEY2" }, { "repository": "PoC-in-GitHub · aomsin2526/xperia_5_bl_unlocker_poc", "author": "aomsin2526", "first_seen": "2026-07-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "My take on unlocking Xperia 5 SO-01M for p42 bootloader using CVE-2021-1931", "summary": "My take on unlocking Xperia 5 SO-01M for p42 bootloader using CVE-2021-1931", "url": "https://github.com/aomsin2526/xperia_5_bl_unlocker_poc" }, { "repository": "PoC-in-GitHub · starseed12345/QuestStack", "author": "starseed12345", "first_seen": "2026-07-31", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 173, "title": "Unlock the Meta Quest 1 bootloader and gain root access using GhostLock + CVE-2021-1931.", "summary": "Unlock the Meta Quest 1 bootloader and gain root access using GhostLock + CVE-2021-1931.", "url": "https://github.com/starseed12345/QuestStack" } ], "references": [ "https://github.com/FakeShell/CVE-2021-1931-BBRY-KEY2", "https://github.com/aomsin2526/xperia_5_bl_unlocker_poc", "https://github.com/starseed12345/QuestStack" ], "timeline": [ { "at": "2026-07-30T22:00:00Z", "label": "Discovered through PoC-in-GitHub", "url": "https://github.com/FakeShell/CVE-2021-1931-BBRY-KEY2" } ] }, { "id": "CVE-2021-1732", "vendor": "Microsoft", "product": "Win32k", "title": "Microsoft Win32k Privilege Escalation Vulnerability", "summary": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.", "updated_at": "2026-09-05T12:41:50Z", "published_at": "2026-09-05T12:41:50Z", "cvss": 7.8, "confidence": 90, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 3, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:41:50+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2021-1732 exploit", "summary": "Exploit for CVE-2021-1732. CVSS 7.8.", "cvss": 7.8, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FLYINBEDXYZ-CVE-2021-1732" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FLYINBEDXYZ-CVE-2021-1732" ], "timeline": [ { "at": "2026-09-05T12:41:50Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2021-11-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2021-1675", "vendor": "Microsoft", "product": "Windows", "title": "Microsoft Windows Print Spooler Remote Code Execution Vulnerability", "summary": "Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.", "updated_at": "2026-08-17T22:00:00Z", "published_at": "2026-08-17T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 390, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "PoC-in-GitHub · yu2u/CVE-2021-1675", "author": "yu2u", "first_seen": "2021-06-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2021-1675 exploit", "summary": "CVE-2021-1675 exploit", "url": "https://github.com/yu2u/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · cube0x0/CVE-2021-1675", "author": "cube0x0", "first_seen": "2021-06-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2000, "title": "C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527", "summary": "C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527", "url": "https://github.com/cube0x0/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · LaresLLC/CVE-2021-1675", "author": "LaresLLC", "first_seen": "2021-06-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 214, "title": "CVE-2021-1675 Detection Info", "summary": "CVE-2021-1675 Detection Info", "url": "https://github.com/LaresLLC/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · kondah/patch-cve-2021-1675", "author": "kondah", "first_seen": "2021-06-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/kondah/patch-cve-2021-1675" }, { "repository": "PoC-in-GitHub · evilashz/CVE-2021-1675-LPE-EXP", "author": "evilashz", "first_seen": "2021-07-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 56, "title": "PrintNightmare , Local Privilege Escalation of CVE-2021-1675 or CVE-2021-34527", "summary": "PrintNightmare , Local Privilege Escalation of CVE-2021-1675 or CVE-2021-34527", "url": "https://github.com/evilashz/CVE-2021-1675-LPE-EXP" }, { "repository": "PoC-in-GitHub · hlldz/CVE-2021-1675-LPE", "author": "hlldz", "first_seen": "2021-07-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 325, "title": "Local Privilege Escalation Edition for CVE-2021-1675/CVE-2021-34527", "summary": "Local Privilege Escalation Edition for CVE-2021-1675/CVE-2021-34527", "url": "https://github.com/hlldz/CVE-2021-1675-LPE" }, { "repository": "PoC-in-GitHub · puckiestyle/CVE-2021-1675", "author": "puckiestyle", "first_seen": "2021-07-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/puckiestyle/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · cybersecurityworks553/CVE-2021-1675_PrintNightMare", "author": "cybersecurityworks553", "first_seen": "2021-07-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 23, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/cybersecurityworks553/CVE-2021-1675_PrintNightMare" }, { "repository": "PoC-in-GitHub · tanarchytan/CVE-2021-1675", "author": "tanarchytan", "first_seen": "2021-07-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Fix without disabling Print Spooler", "summary": "Fix without disabling Print Spooler", "url": "https://github.com/tanarchytan/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · calebstewart/CVE-2021-1675", "author": "calebstewart", "first_seen": "2021-07-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1108, "title": "Pure PowerShell implementation of CVE-2021-1675 Print Spooler Local Privilege Escalation (PrintNightmare)", "summary": "Pure PowerShell implementation of CVE-2021-1675 Print Spooler Local Privilege Escalation (PrintNightmare)", "url": "https://github.com/calebstewart/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · Leonidus0x10/CVE-2021-1675-SCANNER", "author": "Leonidus0x10", "first_seen": "2021-07-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 9, "title": "Vulnerability Scanner for CVE-2021-1675/PrintNightmare", "summary": "Vulnerability Scanner for CVE-2021-1675/PrintNightmare", "url": "https://github.com/Leonidus0x10/CVE-2021-1675-SCANNER" }, { "repository": "PoC-in-GitHub · thomasgeens/CVE-2021-1675", "author": "thomasgeens", "first_seen": "2021-07-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/thomasgeens/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · mrezqi/CVE-2021-1675_CarbonBlack_HuntingQuery", "author": "mrezqi", "first_seen": "2021-07-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/mrezqi/CVE-2021-1675_CarbonBlack_HuntingQuery" }, { "repository": "PoC-in-GitHub · killtr0/CVE-2021-1675-PrintNightmare", "author": "killtr0", "first_seen": "2021-07-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/killtr0/CVE-2021-1675-PrintNightmare" }, { "repository": "PoC-in-GitHub · corelight/CVE-2021-1675", "author": "corelight", "first_seen": "2021-07-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 9, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/corelight/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · kougyokugentou/CVE-2021-1675", "author": "kougyokugentou", "first_seen": "2021-07-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A small powershell script to disable print spooler service using desired state configuration", "summary": "A small powershell script to disable print spooler service using desired state configuration", "url": "https://github.com/kougyokugentou/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · ptter23/CVE-2021-1675", "author": "ptter23", "first_seen": "2021-07-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-1675: ZERO-DAY VULNERABILITY IN WINDOWS PRINTER SERVICE WITH AN EXPLOIT AVAILABLE IN ALL OPERATING SYSTEM VERSIONS", "summary": "CVE-2021-1675: ZERO-DAY VULNERABILITY IN WINDOWS PRINTER SERVICE WITH AN EXPLOIT AVAILABLE IN ALL OPERATING SYSTEM VERSIONS", "url": "https://github.com/ptter23/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · initconf/cve-2021-1675-printnightmare", "author": "initconf", "first_seen": "2021-07-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "to catch cve-2021-1675-printnightmare", "summary": "to catch cve-2021-1675-printnightmare", "url": "https://github.com/initconf/cve-2021-1675-printnightmare" }, { "repository": "PoC-in-GitHub · ozergoker/PrintNightmare", "author": "ozergoker", "first_seen": "2021-07-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Windows Print Spooler Service RCE CVE-2021-1675 (PrintNightmare)", "summary": "Windows Print Spooler Service RCE CVE-2021-1675 (PrintNightmare)", "url": "https://github.com/ozergoker/PrintNightmare" }, { "repository": "PoC-in-GitHub · exploitblizzard/PrintNightmare-CVE-2021-1675", "author": "exploitblizzard", "first_seen": "2021-07-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "Youtube : https://youtu.be/Zr0KjYDSFKQ", "summary": "Youtube : https://youtu.be/Zr0KjYDSFKQ", "url": "https://github.com/exploitblizzard/PrintNightmare-CVE-2021-1675" }, { "repository": "PoC-in-GitHub · edsonjt81/CVE-2021-1675", "author": "edsonjt81", "first_seen": "2021-07-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/edsonjt81/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · sailay1996/PrintNightmare-LPE", "author": "sailay1996", "first_seen": "2021-07-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 76, "title": "CVE-2021-1675 (PrintNightmare)", "summary": "CVE-2021-1675 (PrintNightmare)", "url": "https://github.com/sailay1996/PrintNightmare-LPE" }, { "repository": "PoC-in-GitHub · JumpsecLabs/PrintNightmare", "author": "JumpsecLabs", "first_seen": "2021-07-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 19, "title": "Information on the Windows Spooler vulnerability - CVE-2021-1675; CVE 2021 34527", "summary": "Information on the Windows Spooler vulnerability - CVE-2021-1675; CVE 2021 34527", "url": "https://github.com/JumpsecLabs/PrintNightmare" }, { "repository": "PoC-in-GitHub · bartimusprimed/CVE-2021-1675-Yara", "author": "bartimusprimed", "first_seen": "2021-07-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/bartimusprimed/CVE-2021-1675-Yara" }, { "repository": "PoC-in-GitHub · k8gege/cve-2021-1675", "author": "k8gege", "first_seen": "2021-07-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 15, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/k8gege/cve-2021-1675" }, { "repository": "PoC-in-GitHub · galoget/PrintNightmare-CVE-2021-1675-CVE-2021-34527", "author": "galoget", "first_seen": "2021-07-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-1675 / CVE-2021-34527 - PrintNightmare Python, C# and PowerShell Exploits Implementations (LPE & RCE)", "summary": "CVE-2021-1675 / CVE-2021-34527 - PrintNightmare Python, C# and PowerShell Exploits Implementations (LPE & RCE)", "url": "https://github.com/galoget/PrintNightmare-CVE-2021-1675-CVE-2021-34527" }, { "repository": "PoC-in-GitHub · thalpius/microsoft-cve-2021-1675", "author": "thalpius", "first_seen": "2021-07-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/thalpius/microsoft-cve-2021-1675" }, { "repository": "PoC-in-GitHub · zha0/Microsoft-CVE-2021-1675", "author": "zha0", "first_seen": "2021-07-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/zha0/Microsoft-CVE-2021-1675" }, { "repository": "PoC-in-GitHub · Winter3un/CVE-2021-1675", "author": "Winter3un", "first_seen": "2021-07-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/Winter3un/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · hahaleyile/my-CVE-2021-1675", "author": "hahaleyile", "first_seen": "2021-07-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "see https://github.com/cube0x0/CVE-2021-1675", "summary": "see https://github.com/cube0x0/CVE-2021-1675", "url": "https://github.com/hahaleyile/my-CVE-2021-1675" }, { "repository": "PoC-in-GitHub · mstxq17/CVE-2021-1675_RDL_LPE", "author": "mstxq17", "first_seen": "2021-09-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 145, "title": "PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR。", "summary": "PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR。", "url": "https://github.com/mstxq17/CVE-2021-1675_RDL_LPE" }, { "repository": "PoC-in-GitHub · ly4k/PrintNightmare", "author": "ly4k", "first_seen": "2021-09-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 213, "title": "Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527)", "summary": "Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527)", "url": "https://github.com/ly4k/PrintNightmare" }, { "repository": "PoC-in-GitHub · Wra7h/SharpPN", "author": "Wra7h", "first_seen": "2021-09-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 9, "title": "C# PrintNightmare (CVE-2021-1675)", "summary": "C# PrintNightmare (CVE-2021-1675)", "url": "https://github.com/Wra7h/SharpPN" }, { "repository": "PoC-in-GitHub · OppressionBreedsResistance/CVE-2021-1675-PrintNightmare", "author": "OppressionBreedsResistance", "first_seen": "2021-10-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Working PowerShell POC", "summary": "Working PowerShell POC", "url": "https://github.com/OppressionBreedsResistance/CVE-2021-1675-PrintNightmare" }, { "repository": "PoC-in-GitHub · eversinc33/NimNightmare", "author": "eversinc33", "first_seen": "2021-12-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 18, "title": "CVE-2021-1675 LPE PoC in Nim (PrintNightmare Local Privilege Escalation)", "summary": "CVE-2021-1675 LPE PoC in Nim (PrintNightmare Local Privilege Escalation)", "url": "https://github.com/eversinc33/NimNightmare" }, { "repository": "PoC-in-GitHub · AndrewTrube/CVE-2021-1675", "author": "AndrewTrube", "first_seen": "2022-01-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "PrintNightmare Local Privilege Escalation", "summary": "PrintNightmare Local Privilege Escalation", "url": "https://github.com/AndrewTrube/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · TheJoyOfHacking/cube0x0-CVE-2021-1675", "author": "TheJoyOfHacking", "first_seen": "2022-02-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/TheJoyOfHacking/cube0x0-CVE-2021-1675" }, { "repository": "PoC-in-GitHub · TheJoyOfHacking/calebstewart-CVE-2021-1675", "author": "TheJoyOfHacking", "first_seen": "2022-02-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/TheJoyOfHacking/calebstewart-CVE-2021-1675" }, { "repository": "PoC-in-GitHub · r1skkam/PrintNightmare", "author": "r1skkam", "first_seen": "2022-12-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Learn about the vulnerability known as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527)", "summary": "Learn about the vulnerability known as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527)", "url": "https://github.com/r1skkam/PrintNightmare" }, { "repository": "PoC-in-GitHub · 000Tonio/cve-2021-1675", "author": "000Tonio", "first_seen": "2023-10-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/000Tonio/cve-2021-1675" }, { "repository": "PoC-in-GitHub · peckre/PNCVE-Win10-20H2-Exploit", "author": "peckre", "first_seen": "2024-01-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A one-click script to gain a System privileges command line in Windows 10 20H2 that exploits CVE-2021-1675", "summary": "A one-click script to gain a System privileges command line in Windows 10 20H2 that exploits CVE-2021-1675", "url": "https://github.com/peckre/PNCVE-Win10-20H2-Exploit" }, { "repository": "PoC-in-GitHub · whoami-chmod777/CVE-2021-1675-CVE-2021-34527", "author": "whoami-chmod777", "first_seen": "2024-02-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/whoami-chmod777/CVE-2021-1675-CVE-2021-34527" }, { "repository": "PoC-in-GitHub · whoami-chmod777/CVE-2021-1675---PrintNightmare-LPE-PowerShell-", "author": "whoami-chmod777", "first_seen": "2024-02-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/whoami-chmod777/CVE-2021-1675---PrintNightmare-LPE-PowerShell-" }, { "repository": "PoC-in-GitHub · 0xSs0rZ/Windows_Exploit", "author": "0xSs0rZ", "first_seen": "2024-06-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-1675/CVE-2021-34527 PrintNightmare & CVE-2020-0668", "summary": "CVE-2021-1675/CVE-2021-34527 PrintNightmare & CVE-2020-0668", "url": "https://github.com/0xSs0rZ/Windows_Exploit" }, { "repository": "PoC-in-GitHub · Sp4ceDogy/NPE-CS-V-CVE-2021-1675", "author": "Sp4ceDogy", "first_seen": "2025-03-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/Sp4ceDogy/NPE-CS-V-CVE-2021-1675" }, { "repository": "PoC-in-GitHub · DLL00P/CVE-2021-1675", "author": "DLL00P", "first_seen": "2025-07-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/DLL00P/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · ccordeiro/CVE-2021-1675", "author": "ccordeiro", "first_seen": "2025-11-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527", "summary": "C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527", "url": "https://github.com/ccordeiro/CVE-2021-1675" }, { "repository": "PoC-in-GitHub · VelesSecurity/CVE-2021-1675-PrintNightmare-Analysis", "author": "VelesSecurity", "first_seen": "2026-08-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2021-1675 repository", "summary": "", "url": "https://github.com/VelesSecurity/CVE-2021-1675-PrintNightmare-Analysis" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://github.com/yu2u/CVE-2021-1675", "https://github.com/cube0x0/CVE-2021-1675", "https://github.com/LaresLLC/CVE-2021-1675", "https://github.com/kondah/patch-cve-2021-1675", "https://github.com/evilashz/CVE-2021-1675-LPE-EXP", "https://github.com/hlldz/CVE-2021-1675-LPE", "https://github.com/puckiestyle/CVE-2021-1675", "https://github.com/cybersecurityworks553/CVE-2021-1675_PrintNightMare", "https://github.com/tanarchytan/CVE-2021-1675", "https://github.com/calebstewart/CVE-2021-1675", "https://github.com/Leonidus0x10/CVE-2021-1675-SCANNER", "https://github.com/thomasgeens/CVE-2021-1675", "https://github.com/mrezqi/CVE-2021-1675_CarbonBlack_HuntingQuery", "https://github.com/killtr0/CVE-2021-1675-PrintNightmare", "https://github.com/corelight/CVE-2021-1675", "https://github.com/kougyokugentou/CVE-2021-1675", "https://github.com/ptter23/CVE-2021-1675", "https://github.com/initconf/cve-2021-1675-printnightmare", "https://github.com/ozergoker/PrintNightmare", "https://github.com/exploitblizzard/PrintNightmare-CVE-2021-1675", "https://github.com/edsonjt81/CVE-2021-1675", "https://github.com/sailay1996/PrintNightmare-LPE", "https://github.com/JumpsecLabs/PrintNightmare", "https://github.com/bartimusprimed/CVE-2021-1675-Yara", "https://github.com/k8gege/cve-2021-1675", "https://github.com/galoget/PrintNightmare-CVE-2021-1675-CVE-2021-34527", "https://github.com/thalpius/microsoft-cve-2021-1675", "https://github.com/zha0/Microsoft-CVE-2021-1675", "https://github.com/Winter3un/CVE-2021-1675", "https://github.com/hahaleyile/my-CVE-2021-1675", "https://github.com/mstxq17/CVE-2021-1675_RDL_LPE", "https://github.com/ly4k/PrintNightmare", "https://github.com/Wra7h/SharpPN", "https://github.com/OppressionBreedsResistance/CVE-2021-1675-PrintNightmare", "https://github.com/eversinc33/NimNightmare", "https://github.com/AndrewTrube/CVE-2021-1675", "https://github.com/TheJoyOfHacking/cube0x0-CVE-2021-1675", "https://github.com/TheJoyOfHacking/calebstewart-CVE-2021-1675", "https://github.com/r1skkam/PrintNightmare", "https://github.com/000Tonio/cve-2021-1675", "https://github.com/peckre/PNCVE-Win10-20H2-Exploit", "https://github.com/whoami-chmod777/CVE-2021-1675-CVE-2021-34527", "https://github.com/whoami-chmod777/CVE-2021-1675---PrintNightmare-LPE-PowerShell-", "https://github.com/0xSs0rZ/Windows_Exploit", "https://github.com/Sp4ceDogy/NPE-CS-V-CVE-2021-1675", "https://github.com/DLL00P/CVE-2021-1675", "https://github.com/ccordeiro/CVE-2021-1675", "https://github.com/VelesSecurity/CVE-2021-1675-PrintNightmare-Analysis" ], "timeline": [ { "at": "2026-08-17T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2021-11-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2021-11-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2021-11-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2021-11-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2021-11-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2020-17103", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for miniplasma-advisory CVE-2020-17103", "summary": "MiniPlasma variant of CVE-2020-17103 affecting Windows cldflt.sys mini-filter driver.", "updated_at": "2026-08-26T22:40:39Z", "published_at": "2026-08-26T22:40:39Z", "cvss": 7.8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 25, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "what_happened": "MiniPlasma variant of CVE-2020-17103 affecting Windows cldflt.sys mini-filter driver.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for miniplasma-advisory CVE-2020-17103", "summary": "MiniPlasma variant of CVE-2020-17103 affecting Windows cldflt.sys mini-filter driver.", "what_happened": "MiniPlasma variant of CVE-2020-17103 affecting Windows cldflt.sys mini-filter driver.", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RFRANCA777-MINIPLASMA-ADVISORY", "https://kitploit.com/ru/tools/github/rfranca777/miniplasma-advisory/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-08-27T00:40:39", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RFRANCA777-MINIPLASMA-ADVISORY" }, { "title": "Exploit for miniplasma-advisory CVE-2020-17103", "summary": "MiniPlasma variant of CVE-2020-17103 affecting Windows cldflt.sys mini-filter driver.", "what_happened": "MiniPlasma variant of CVE-2020-17103 affecting Windows cldflt.sys mini-filter driver.", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RFRANCA777-MINIPLASMA-ADVISORY", "https://kitploit.com/ru/tools/github/rfranca777/miniplasma-advisory/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-08-27T00:40:39", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/rfranca777/miniplasma-advisory/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RFRANCA777-MINIPLASMA-ADVISORY", "https://kitploit.com/ru/tools/github/rfranca777/miniplasma-advisory/" ], "timeline": [ { "at": "2026-08-26T22:40:39Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-RFRANCA777-MINIPLASMA-ADVISORY" } ], "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2020-16898", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2020-16898_Checker", "summary": "Checker tool that scans Network Interfaces for CVE-2020-16898 vulnerability.", "updated_at": "2026-09-05T10:46:03Z", "published_at": "2026-09-05T10:46:03Z", "cvss": 8.8, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Adjacent", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "Checker tool that scans Network Interfaces for CVE-2020-16898 vulnerability.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2020-16898_Checker", "summary": "Checker tool that scans Network Interfaces for CVE-2020-16898 vulnerability.", "what_happened": "Checker tool that scans Network Interfaces for CVE-2020-16898 vulnerability.", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Adjacent", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-CPO-EH-CVE-2020-16898_CHECKER", "https://kitploit.com/ru/tools/github/cpo-eh/cve-2020-16898_checker/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-05T12:46:03", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-CPO-EH-CVE-2020-16898_CHECKER" }, { "title": "Exploit for CVE-2020-16898_Checker", "summary": "Checker tool that scans Network Interfaces for CVE-2020-16898 vulnerability.", "what_happened": "Checker tool that scans Network Interfaces for CVE-2020-16898 vulnerability.", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Adjacent", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-CPO-EH-CVE-2020-16898_CHECKER", "https://kitploit.com/ru/tools/github/cpo-eh/cve-2020-16898_checker/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-05T12:46:03", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/cpo-eh/cve-2020-16898_checker/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-CPO-EH-CVE-2020-16898_CHECKER", "https://kitploit.com/ru/tools/github/cpo-eh/cve-2020-16898_checker/" ], "timeline": [ { "at": "2026-09-05T10:46:03Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-CPO-EH-CVE-2020-16898_CHECKER" } ], "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2020-9289", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for cve-2019-6693 CVE-2019-6693", "summary": "FortiGate standard key allows decryption of user passwords, private keys, and HA passwords.", "updated_at": "2026-09-04T05:46:31Z", "published_at": "2026-09-04T05:46:31Z", "cvss": 6.5, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 24, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "what_happened": "FortiGate standard key allows decryption of user passwords, private keys, and HA passwords.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for cve-2019-6693 CVE-2019-6693", "summary": "FortiGate standard key allows decryption of user passwords, private keys, and HA passwords.", "what_happened": "FortiGate standard key allows decryption of user passwords, private keys, and HA passwords.", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SALADANDONIONRINGS-CVE-2019-6693", "https://kitploit.com/ru/tools/github/saladandonionrings/cve-2019-6693/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-04T07:46:31", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SALADANDONIONRINGS-CVE-2019-6693" }, { "title": "Exploit for cve-2019-6693 CVE-2019-6693", "summary": "FortiGate standard key allows decryption of user passwords, private keys, and HA passwords.", "what_happened": "FortiGate standard key allows decryption of user passwords, private keys, and HA passwords.", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SALADANDONIONRINGS-CVE-2019-6693", "https://kitploit.com/ru/tools/github/saladandonionrings/cve-2019-6693/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-04T07:46:31", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/saladandonionrings/cve-2019-6693/" }, { "repository": "synacktiv/CVE-2020-9289", "author": "synacktiv", "first_seen": "2023-06-30", "confidence": "High", "verification": "verified", "verified": true, "stars": 11, "title": "Decrypt reversible secrets encrypted using the default hardcoded key related to CVE-2020-9289 on FortiAnalyzer/FortiManager (the only difference with CVE-2019-6693 is the encryption routine).", "summary": "Decrypt reversible secrets encrypted using the default hardcoded key related to CVE-2020-9289 on FortiAnalyzer/FortiManager (the only difference with CVE-2019-6693 is the encryption routine).", "url": "https://github.com/synacktiv/CVE-2020-9289" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SALADANDONIONRINGS-CVE-2019-6693", "https://kitploit.com/ru/tools/github/saladandonionrings/cve-2019-6693/", "https://github.com/synacktiv/CVE-2020-9289" ], "timeline": [ { "at": "2026-09-04T05:46:31Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SALADANDONIONRINGS-CVE-2019-6693" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "id": "CVE-2020-7961", "vendor": "Liferay", "product": "Liferay Portal", "title": "Liferay Portal Deserialization of Untrusted Data Vulnerability", "summary": "Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute code via JSON web services.", "updated_at": "2026-07-27T22:00:00Z", "published_at": "2026-07-27T22:00:00Z", "cvss": 0, "confidence": 90, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 13, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute code via JSON web services.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 48332", "author": "Metasploit", "first_seen": "2020-04-16", "confidence": "High", "title": "Liferay Portal - Java Unmarshalling via JSONWS RCE (Metasploit)", "summary": "Liferay Portal - Java Unmarshalling via JSONWS RCE (Metasploit)", "url": "https://www.exploit-db.com/exploits/48332", "verification": "verified", "verified": true }, { "repository": "PoC-in-GitHub · mzer0one/CVE-2020-7961-POC", "author": "mzer0one", "first_seen": "2020-03-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 118, "title": "CVE-2020-7961 repository", "summary": "", "url": "https://github.com/mzer0one/CVE-2020-7961-POC" }, { "repository": "PoC-in-GitHub · thelostworldFree/CVE-2020-7961-payloads", "author": "thelostworldFree", "first_seen": "2020-05-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS)", "summary": "Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS)", "url": "https://github.com/thelostworldFree/CVE-2020-7961-payloads" }, { "repository": "PoC-in-GitHub · ShutdownRepo/CVE-2020-7961", "author": "ShutdownRepo", "first_seen": "2021-01-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 18, "title": "Exploit script for CVE-2020-7961", "summary": "Exploit script for CVE-2020-7961", "url": "https://github.com/ShutdownRepo/CVE-2020-7961" }, { "repository": "PoC-in-GitHub · CrackerCat/CVE-2020-7961-Mass", "author": "CrackerCat", "first_seen": "2021-04-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2020–7961 Mass exploit for Script Kiddies", "summary": "CVE-2020–7961 Mass exploit for Script Kiddies", "url": "https://github.com/CrackerCat/CVE-2020-7961-Mass" }, { "repository": "PoC-in-GitHub · Alaa-abdulridha/POC-CVE-2020-7961-Token-iterate", "author": "Alaa-abdulridha", "first_seen": "2021-05-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "POC-CVE-2020-7961-Token-iterate", "summary": "POC-CVE-2020-7961-Token-iterate", "url": "https://github.com/Alaa-abdulridha/POC-CVE-2020-7961-Token-iterate" }, { "repository": "PoC-in-GitHub · Alaa-abdulridha/GLiferay-CVE-2020-7961-golang", "author": "Alaa-abdulridha", "first_seen": "2021-05-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Detect vulns liferay CVE-2020-7961 by Nattroc (EOG Team)", "summary": "Detect vulns liferay CVE-2020-7961 by Nattroc (EOG Team)", "url": "https://github.com/Alaa-abdulridha/GLiferay-CVE-2020-7961-golang" }, { "repository": "PoC-in-GitHub · pashayogi/CVE-2020-7961-Mass", "author": "pashayogi", "first_seen": "2022-05-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2020-7961 repository", "summary": "", "url": "https://github.com/pashayogi/CVE-2020-7961-Mass" }, { "repository": "PoC-in-GitHub · manrop2702/CVE-2020-7961", "author": "manrop2702", "first_seen": "2024-03-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2020-7961 repository", "summary": "", "url": "https://github.com/manrop2702/CVE-2020-7961" }, { "repository": "PoC-in-GitHub · neverhavenamee/CVE-2020-7961", "author": "neverhavenamee", "first_seen": "2025-09-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2020-7961 repository", "summary": "", "url": "https://github.com/neverhavenamee/CVE-2020-7961" }, { "repository": "PoC-in-GitHub · dinosn/liferay-ga4-rce-research", "author": "dinosn", "first_seen": "2026-07-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "Security research on Liferay CE 7.0.3 GA4: pre-auth RCE as root (CVE-2020-7961 class) reproduced end-to-end, plus 16 more findings — 8+ with no known CVE. Agentic loop-hunt: 25 generators, 22 judges, 9 live validators on Docker. Evidence trail + one-go checker included.", "summary": "Security research on Liferay CE 7.0.3 GA4: pre-auth RCE as root (CVE-2020-7961 class) reproduced end-to-end, plus 16 more findings — 8+ with no known CVE. Agentic loop-hunt: 25 generators, 22 judges, 9 live validators on Docker. Evidence trail + one-go checker included.", "url": "https://github.com/dinosn/liferay-ga4-rce-research" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/48332", "https://github.com/mzer0one/CVE-2020-7961-POC", "https://github.com/thelostworldFree/CVE-2020-7961-payloads", "https://github.com/ShutdownRepo/CVE-2020-7961", "https://github.com/CrackerCat/CVE-2020-7961-Mass", "https://github.com/Alaa-abdulridha/POC-CVE-2020-7961-Token-iterate", "https://github.com/Alaa-abdulridha/GLiferay-CVE-2020-7961-golang", "https://github.com/pashayogi/CVE-2020-7961-Mass", "https://github.com/manrop2702/CVE-2020-7961", "https://github.com/neverhavenamee/CVE-2020-7961", "https://github.com/dinosn/liferay-ga4-rce-research" ], "timeline": [ { "at": "2026-07-27T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2021-11-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2020-1206", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for SMBGhost-WorkaroundApplier CVE-2020-0796", "summary": "SMBv3 unauthenticated RCE (CVE-2020-0796) workaround applier tool for unpatched systems.", "updated_at": "2026-08-24T14:34:43Z", "published_at": "2026-08-24T14:34:43Z", "cvss": 10, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "SMBv3 unauthenticated RCE (CVE-2020-0796) workaround applier tool for unpatched systems.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for SMBGhost-WorkaroundApplier CVE-2020-0796", "summary": "SMBv3 unauthenticated RCE (CVE-2020-0796) workaround applier tool for unpatched systems.", "what_happened": "SMBv3 unauthenticated RCE (CVE-2020-0796) workaround applier tool for unpatched systems.", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ALMORABEA-SMBGHOST-WORKAROUNDAPPLIER", "https://kitploit.com/ru/tools/github/almorabea/smbghost-workaroundapplier/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-08-24T16:34:43", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ALMORABEA-SMBGHOST-WORKAROUNDAPPLIER" }, { "title": "Exploit for SMBGhost-WorkaroundApplier CVE-2020-0796", "summary": "SMBv3 unauthenticated RCE (CVE-2020-0796) workaround applier tool for unpatched systems.", "what_happened": "SMBv3 unauthenticated RCE (CVE-2020-0796) workaround applier tool for unpatched systems.", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ALMORABEA-SMBGHOST-WORKAROUNDAPPLIER", "https://kitploit.com/ru/tools/github/almorabea/smbghost-workaroundapplier/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-08-24T16:34:43", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/almorabea/smbghost-workaroundapplier/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ALMORABEA-SMBGHOST-WORKAROUNDAPPLIER", "https://kitploit.com/ru/tools/github/almorabea/smbghost-workaroundapplier/" ], "timeline": [ { "at": "2026-08-24T14:34:43Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ALMORABEA-SMBGHOST-WORKAROUNDAPPLIER" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "id": "CVE-2020-0796", "vendor": "Microsoft", "product": "SMBv3", "title": "Microsoft SMBv3 Remote Code Execution Vulnerability", "summary": "A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.", "updated_at": "2026-08-24T14:34:43Z", "published_at": "2026-08-24T14:34:43Z", "cvss": 10, "confidence": 90, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": true, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 48216", "author": "eerykitty", "first_seen": "2020-03-14", "confidence": "High", "title": "Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Buffer Overflow (PoC)", "summary": "Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Buffer Overflow (PoC)", "url": "https://www.exploit-db.com/exploits/48216", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 48267", "author": "Daniel García Gutiérrez", "first_seen": "2020-03-30", "confidence": "High", "title": "Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation", "summary": "Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation", "url": "https://www.exploit-db.com/exploits/48267", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 48537", "author": "chompie1337", "first_seen": "2020-06-02", "confidence": "High", "title": "Microsoft Windows - 'SMBGhost' Remote Code Execution", "summary": "Microsoft Windows - 'SMBGhost' Remote Code Execution", "url": "https://www.exploit-db.com/exploits/48537", "verification": "verified", "verified": true }, { "title": "Exploit for SMBGhost-WorkaroundApplier CVE-2020-0796", "summary": "SMBv3 unauthenticated RCE (CVE-2020-0796) workaround applier tool for unpatched systems.", "what_happened": "SMBv3 unauthenticated RCE (CVE-2020-0796) workaround applier tool for unpatched systems.", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ALMORABEA-SMBGHOST-WORKAROUNDAPPLIER", "https://kitploit.com/ru/tools/github/almorabea/smbghost-workaroundapplier/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-08-24T16:34:43", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ALMORABEA-SMBGHOST-WORKAROUNDAPPLIER" }, { "title": "Exploit for SMBGhost-WorkaroundApplier CVE-2020-0796", "summary": "SMBv3 unauthenticated RCE (CVE-2020-0796) workaround applier tool for unpatched systems.", "what_happened": "SMBv3 unauthenticated RCE (CVE-2020-0796) workaround applier tool for unpatched systems.", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ALMORABEA-SMBGHOST-WORKAROUNDAPPLIER", "https://kitploit.com/ru/tools/github/almorabea/smbghost-workaroundapplier/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-08-24T16:34:43", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/almorabea/smbghost-workaroundapplier/" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/48216", "https://www.exploit-db.com/exploits/48267", "https://www.exploit-db.com/exploits/48537", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ALMORABEA-SMBGHOST-WORKAROUNDAPPLIER", "https://kitploit.com/ru/tools/github/almorabea/smbghost-workaroundapplier/" ], "timeline": [ { "at": "2026-08-24T14:34:43Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-02-10", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "id": "CVE-2020-0416", "vendor": "Unknown vendor", "product": "Unknown product", "title": "packages_apps_settings_AOSP10_r33_CVE-2020-0416 exploit", "summary": "Exploit for CVE-2020-0416. CVSS 9.3.", "updated_at": "2026-09-05T12:43:05Z", "published_at": "2026-09-05T12:43:05Z", "cvss": 9.3, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:43:05+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "packages_apps_settings_AOSP10_r33_CVE-2020-0416 exploit", "summary": "Exploit for CVE-2020-0416. CVSS 9.3.", "cvss": 9.3, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SHAIKUSAF-PACKAGES_APPS_SETTINGS_AOSP10_R33_CVE-2020-0416" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SHAIKUSAF-PACKAGES_APPS_SETTINGS_AOSP10_R33_CVE-2020-0416" ], "timeline": [ { "at": "2026-09-05T12:43:05Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SHAIKUSAF-PACKAGES_APPS_SETTINGS_AOSP10_R33_CVE-2020-0416" } ] }, { "id": "CVE-2020-0394", "vendor": "Unknown vendor", "product": "Unknown product", "title": "packages_apps_settings_AOSP10_r33_CVE-2020-0394 exploit", "summary": "Exploit for CVE-2020-0394. CVSS 7.8.", "updated_at": "2026-09-05T12:44:54Z", "published_at": "2026-09-05T12:44:54Z", "cvss": 7.8, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:44:54+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "packages_apps_settings_AOSP10_r33_CVE-2020-0394 exploit", "summary": "Exploit for CVE-2020-0394. CVSS 7.8.", "cvss": 7.8, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SHAIKUSAF-PACKAGES_APPS_SETTINGS_AOSP10_R33_CVE-2020-0394" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SHAIKUSAF-PACKAGES_APPS_SETTINGS_AOSP10_R33_CVE-2020-0394" ], "timeline": [ { "at": "2026-09-05T12:44:54Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SHAIKUSAF-PACKAGES_APPS_SETTINGS_AOSP10_R33_CVE-2020-0394" } ] }, { "id": "CVE-2019-17638", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2019-17638-Jetty exploit", "summary": "Exploit for CVE-2019-17638. CVSS 9.4.", "updated_at": "2026-09-05T12:43:03Z", "published_at": "2026-09-05T12:43:03Z", "cvss": 9.4, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:43:03+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2019-17638-Jetty exploit", "summary": "Exploit for CVE-2019-17638. CVSS 9.4.", "cvss": 9.4, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FORSE01-CVE-2019-17638-JETTY" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FORSE01-CVE-2019-17638-JETTY" ], "timeline": [ { "at": "2026-09-05T12:43:03Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FORSE01-CVE-2019-17638-JETTY" } ] }, { "id": "CVE-2019-6693", "vendor": "Fortinet", "product": "FortiOS", "title": "Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability", "summary": "Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.", "updated_at": "2026-09-04T05:46:31Z", "published_at": "2026-09-04T05:46:31Z", "cvss": 6.5, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 59, "kev": true, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "what_happened": "Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T08:15:22+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "cve-2019-6693 exploit", "summary": "Exploit for CVE-2019-6693. CVSS 6.5.", "cvss": 6.5, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SALADANDONIONRINGS-CVE-2019-6693" }, { "title": "Exploit for cve-2019-6693 CVE-2019-6693", "summary": "FortiGate standard key allows decryption of user passwords, private keys, and HA passwords.", "what_happened": "FortiGate standard key allows decryption of user passwords, private keys, and HA passwords.", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SALADANDONIONRINGS-CVE-2019-6693", "https://kitploit.com/ru/tools/github/saladandonionrings/cve-2019-6693/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-04T07:46:31", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/saladandonionrings/cve-2019-6693/" }, { "repository": "Real4XoR/CVE-2019-6693", "author": "Real4XoR", "first_seen": "2025-08-26", "confidence": "High", "verification": "verified", "verified": true, "stars": 1, "title": "CVE-2019-6693 repository", "summary": "", "url": "https://github.com/Real4XoR/CVE-2019-6693" }, { "repository": "saladandonionrings/cve-2019-6693", "author": "saladandonionrings", "first_seen": "2023-12-08", "confidence": "High", "verification": "verified", "verified": true, "stars": 28, "title": "An authorized remote user with access or knowledge of the standard encryption key can gain access and decrypt the FortiOS backup files and all non-administator passwords, private keys and High Availability passwords.", "summary": "An authorized remote user with access or knowledge of the standard encryption key can gain access and decrypt the FortiOS backup files and all non-administator passwords, private keys and High Availability passwords.", "url": "https://github.com/saladandonionrings/cve-2019-6693" }, { "repository": "synacktiv/CVE-2020-9289", "author": "synacktiv", "first_seen": "2023-06-30", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 11, "title": "Decrypt reversible secrets encrypted using the default hardcoded key related to CVE-2020-9289 on FortiAnalyzer/FortiManager (the only difference with CVE-2019-6693 is the encryption routine).", "summary": "Decrypt reversible secrets encrypted using the default hardcoded key related to CVE-2020-9289 on FortiAnalyzer/FortiManager (the only difference with CVE-2019-6693 is the encryption routine).", "url": "https://github.com/synacktiv/CVE-2020-9289" }, { "repository": "gquere/CVE-2019-6693", "author": "gquere", "first_seen": "2021-12-21", "confidence": "High", "verification": "verified", "verified": true, "stars": 8, "title": "Decrypt FortiGate configuration secrets", "summary": "Decrypt FortiGate configuration secrets", "url": "https://github.com/gquere/CVE-2019-6693" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SALADANDONIONRINGS-CVE-2019-6693", "https://kitploit.com/ru/tools/github/saladandonionrings/cve-2019-6693/", "https://github.com/Real4XoR/CVE-2019-6693", "https://github.com/saladandonionrings/cve-2019-6693", "https://github.com/synacktiv/CVE-2020-9289", "https://github.com/gquere/CVE-2019-6693" ], "timeline": [ { "at": "2026-09-04T05:46:31Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-06-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-06-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-06-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-06-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-06-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-06-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-06-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-06-25", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "id": "CVE-2019-1068", "vendor": "Microsoft", "product": "SQL Server", "title": "Microsoft SQL Server Remote Code Execution Vulnerability", "summary": "Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.", "updated_at": "2026-08-25T22:00:00Z", "published_at": "2026-08-25T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-08-25T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2018-16763", "vendor": "Unknown vendor", "product": "Unknown product", "title": "fuel CMS 1.4.1 - Remote Code Execution (1)", "summary": "fuel CMS 1.4.1 - Remote Code Execution (1)", "updated_at": "2026-09-05T12:38:51Z", "published_at": "2026-09-05T12:38:51Z", "cvss": 9.8, "confidence": 80, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 47138", "author": "0xd0ff9", "first_seen": "2019-07-19", "confidence": "High", "title": "fuel CMS 1.4.1 - Remote Code Execution (1)", "summary": "fuel CMS 1.4.1 - Remote Code Execution (1)", "url": "https://www.exploit-db.com/exploits/47138", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 49487", "author": "Alexandre ZANNI", "first_seen": "2021-01-28", "confidence": "High", "title": "Fuel CMS 1.4.1 - Remote Code Execution (2)", "summary": "Fuel CMS 1.4.1 - Remote Code Execution (2)", "url": "https://www.exploit-db.com/exploits/49487", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 50477", "author": "Padsala Trushal", "first_seen": "2021-11-03", "confidence": "High", "title": "Fuel CMS 1.4.1 - Remote Code Execution (3)", "summary": "Fuel CMS 1.4.1 - Remote Code Execution (3)", "url": "https://www.exploit-db.com/exploits/50477", "verification": "verified", "verified": true }, { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:38:51+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2018-16763 exploit", "summary": "Exploit for CVE-2018-16763. CVSS 9.8.", "cvss": 9.8, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ANTISECC-CVE-2018-16763" } ], "references": [ "https://www.exploit-db.com/exploits/47138", "https://www.exploit-db.com/exploits/49487", "https://www.exploit-db.com/exploits/50477", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-ANTISECC-CVE-2018-16763" ], "timeline": [ { "at": "2026-09-05T12:38:51Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/47138" } ] }, { "id": "CVE-2017-3066", "vendor": "Adobe", "product": "ColdFusion", "title": "Adobe ColdFusion Deserialization Vulnerability", "summary": "Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.", "updated_at": "2026-09-05T12:46:01Z", "published_at": "2026-09-05T12:46:01Z", "cvss": 10, "confidence": 90, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 4, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 43993", "author": "Faisal Tameesh", "first_seen": "2018-02-07", "confidence": "High", "title": "Adobe Coldfusion 11.0.03.292866 - BlazeDS Java Object Deserialization Remote Code Execution", "summary": "Adobe Coldfusion 11.0.03.292866 - BlazeDS Java Object Deserialization Remote Code Execution", "url": "https://www.exploit-db.com/exploits/43993", "verification": "verified", "verified": true }, { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:46:01+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2017-3066 exploit", "summary": "Exploit for CVE-2017-3066. CVSS 10.", "cvss": 10, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-CUCADILI-CVE-2017-3066" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/43993", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-CUCADILI-CVE-2017-3066" ], "timeline": [ { "at": "2026-09-05T12:46:01Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2025-02-24", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2016-5195", "vendor": "Linux", "product": "Kernel", "title": "Linux Kernel Race Condition Vulnerability", "summary": "Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.", "updated_at": "2026-08-25T22:00:00Z", "published_at": "2026-08-25T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 682, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 40616", "author": "Robin Verton", "first_seen": "2016-10-21", "confidence": "High", "title": "Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (SUID Method)", "summary": "Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (SUID Method)", "url": "https://www.exploit-db.com/exploits/40616", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 40847", "author": "Gabriele Bonacini", "first_seen": "2016-11-27", "confidence": "High", "title": "Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)", "summary": "Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)", "url": "https://www.exploit-db.com/exploits/40847", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 40838", "author": "Phil Oester", "first_seen": "2016-10-26", "confidence": "High", "title": "Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (Write Access Method)", "summary": "Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (Write Access Method)", "url": "https://www.exploit-db.com/exploits/40838", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 40839", "author": "FireFart", "first_seen": "2016-11-28", "confidence": "High", "title": "Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)", "summary": "Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)", "url": "https://www.exploit-db.com/exploits/40839", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 40611", "author": "Phil Oester", "first_seen": "2016-10-19", "confidence": "High", "title": "Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method)", "summary": "Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method)", "url": "https://www.exploit-db.com/exploits/40611", "verification": "verified", "verified": true }, { "repository": "PoC-in-GitHub · ASRTeam/CVE-2016-5195", "author": "ASRTeam", "first_seen": "2016-10-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2016-5195 repository", "summary": "", "url": "https://github.com/ASRTeam/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · timwr/CVE-2016-5195", "author": "timwr", "first_seen": "2016-10-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1010, "title": "CVE-2016-5195 (dirtycow/dirtyc0w) proof of concept for Android", "summary": "CVE-2016-5195 (dirtycow/dirtyc0w) proof of concept for Android", "url": "https://github.com/timwr/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · xlucas/dirtycow.cr", "author": "xlucas", "first_seen": "2016-10-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 13, "title": "CVE-2016-5195 exploit written in Crystal", "summary": "CVE-2016-5195 exploit written in Crystal", "url": "https://github.com/xlucas/dirtycow.cr" }, { "repository": "PoC-in-GitHub · istenrot/centos-dirty-cow-ansible", "author": "istenrot", "first_seen": "2016-10-21", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Ansible playbook to mitigate CVE-2016-5195 on CentOS", "summary": "Ansible playbook to mitigate CVE-2016-5195 on CentOS", "url": "https://github.com/istenrot/centos-dirty-cow-ansible" }, { "repository": "PoC-in-GitHub · pgporada/ansible-role-cve", "author": "pgporada", "first_seen": "2016-10-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 10, "title": "Mitigates CVE-2016-5195 aka DirtyCOW", "summary": "Mitigates CVE-2016-5195 aka DirtyCOW", "url": "https://github.com/pgporada/ansible-role-cve" }, { "repository": "PoC-in-GitHub · sideeffect42/DirtyCOWTester", "author": "sideeffect42", "first_seen": "2016-10-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "Dirty COW (CVE-2016-5195) vulnerability testing utility for Linux-based systems.", "summary": "Dirty COW (CVE-2016-5195) vulnerability testing utility for Linux-based systems.", "url": "https://github.com/sideeffect42/DirtyCOWTester" }, { "repository": "PoC-in-GitHub · scumjr/dirtycow-vdso", "author": "scumjr", "first_seen": "2016-10-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 513, "title": "PoC for Dirty COW (CVE-2016-5195)", "summary": "PoC for Dirty COW (CVE-2016-5195)", "url": "https://github.com/scumjr/dirtycow-vdso" }, { "repository": "PoC-in-GitHub · gbonacini/CVE-2016-5195", "author": "gbonacini", "first_seen": "2016-10-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 341, "title": "A CVE-2016-5195 exploit example.", "summary": "A CVE-2016-5195 exploit example.", "url": "https://github.com/gbonacini/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · DavidBuchanan314/cowroot", "author": "DavidBuchanan314", "first_seen": "2016-10-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 32, "title": "Universal Android root tool based on CVE-2016-5195. Watch this space.", "summary": "Universal Android root tool based on CVE-2016-5195. Watch this space.", "url": "https://github.com/DavidBuchanan314/cowroot" }, { "repository": "PoC-in-GitHub · aishee/scan-dirtycow", "author": "aishee", "first_seen": "2016-10-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 16, "title": "Scan vuls kernel CVE-2016-5195 - DirtyCow", "summary": "Scan vuls kernel CVE-2016-5195 - DirtyCow", "url": "https://github.com/aishee/scan-dirtycow" }, { "repository": "PoC-in-GitHub · oleg-fiksel/ansible_CVE-2016-5195_check", "author": "oleg-fiksel", "first_seen": "2016-10-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "CVE-2016-5195 repository", "summary": "", "url": "https://github.com/oleg-fiksel/ansible_CVE-2016-5195_check" }, { "repository": "PoC-in-GitHub · ldenevi/CVE-2016-5195", "author": "ldenevi", "first_seen": "2016-11-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Recent Linux privilege escalation exploit", "summary": "Recent Linux privilege escalation exploit", "url": "https://github.com/ldenevi/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · whu-enjoy/CVE-2016-5195", "author": "whu-enjoy", "first_seen": "2016-11-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 10, "title": "这里保留着部分脏牛漏洞的利用代码", "summary": "这里保留着部分脏牛漏洞的利用代码", "url": "https://github.com/whu-enjoy/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · firefart/dirtycow", "author": "firefart", "first_seen": "2016-11-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 935, "title": "Dirty Cow exploit - CVE-2016-5195", "summary": "Dirty Cow exploit - CVE-2016-5195", "url": "https://github.com/firefart/dirtycow" }, { "repository": "PoC-in-GitHub · ndobson/inspec_CVE-2016-5195", "author": "ndobson", "first_seen": "2016-12-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Inspec profile for detecting CVE-2016-5195 aka Dirty COW", "summary": "Inspec profile for detecting CVE-2016-5195 aka Dirty COW", "url": "https://github.com/ndobson/inspec_CVE-2016-5195" }, { "repository": "PoC-in-GitHub · sribaba/android-CVE-2016-5195", "author": "sribaba", "first_seen": "2017-01-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2016-5195 repository", "summary": "", "url": "https://github.com/sribaba/android-CVE-2016-5195" }, { "repository": "PoC-in-GitHub · esc0rtd3w/org.cowpoop.moooooo", "author": "esc0rtd3w", "first_seen": "2017-01-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "Android APK Based On Public Information Using DirtyCOW CVE-2016-5195 Exploit", "summary": "Android APK Based On Public Information Using DirtyCOW CVE-2016-5195 Exploit", "url": "https://github.com/esc0rtd3w/org.cowpoop.moooooo" }, { "repository": "PoC-in-GitHub · hyln9/VIKIROOT", "author": "hyln9", "first_seen": "2017-01-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 271, "title": "CVE-2016-5195 (Dirty COW) PoC for Android 6.0.1 Marshmallow", "summary": "CVE-2016-5195 (Dirty COW) PoC for Android 6.0.1 Marshmallow", "url": "https://github.com/hyln9/VIKIROOT" }, { "repository": "PoC-in-GitHub · droidvoider/dirtycow-replacer", "author": "droidvoider", "first_seen": "2017-03-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "CVE-2016-5195 dirtycow by timwr automated multi file patch tool", "summary": "CVE-2016-5195 dirtycow by timwr automated multi file patch tool", "url": "https://github.com/droidvoider/dirtycow-replacer" }, { "repository": "PoC-in-GitHub · FloridSleeves/os-experiment-4", "author": "FloridSleeves", "first_seen": "2017-06-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "os experiment 4 CVE-2016-5195", "summary": "os experiment 4 CVE-2016-5195", "url": "https://github.com/FloridSleeves/os-experiment-4" }, { "repository": "PoC-in-GitHub · arbll/dirtycow", "author": "arbll", "first_seen": "2017-10-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Ready to use, weaponized dirtycow (CVE-2016-5195)", "summary": "Ready to use, weaponized dirtycow (CVE-2016-5195)", "url": "https://github.com/arbll/dirtycow" }, { "repository": "PoC-in-GitHub · titanhp/Dirty-COW-CVE-2016-5195-Testing", "author": "titanhp", "first_seen": "2017-10-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Dirty COW (CVE-2016-5195) Testing", "summary": "Dirty COW (CVE-2016-5195) Testing", "url": "https://github.com/titanhp/Dirty-COW-CVE-2016-5195-Testing" }, { "repository": "PoC-in-GitHub · acidburnmi/CVE-2016-5195-master", "author": "acidburnmi", "first_seen": "2017-12-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2016-5195 repository", "summary": "", "url": "https://github.com/acidburnmi/CVE-2016-5195-master" }, { "repository": "PoC-in-GitHub · xpcmdshell/derpyc0w", "author": "xpcmdshell", "first_seen": "2018-04-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Example exploit for CVE-2016-5195", "summary": "Example exploit for CVE-2016-5195", "url": "https://github.com/xpcmdshell/derpyc0w" }, { "repository": "PoC-in-GitHub · Brucetg/DirtyCow-EXP", "author": "Brucetg", "first_seen": "2018-05-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 141, "title": "编译好的脏牛漏洞（CVE-2016-5195）EXP", "summary": "编译好的脏牛漏洞（CVE-2016-5195）EXP", "url": "https://github.com/Brucetg/DirtyCow-EXP" }, { "repository": "PoC-in-GitHub · jas502n/CVE-2016-5195", "author": "jas502n", "first_seen": "2019-08-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "Linux 本地提权漏洞", "summary": "Linux 本地提权漏洞", "url": "https://github.com/jas502n/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · imust6226/dirtcow", "author": "imust6226", "first_seen": "2019-10-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 9, "title": "脏牛Linux本地提权漏洞复现(CVE-2016-5195)", "summary": "脏牛Linux本地提权漏洞复现(CVE-2016-5195)", "url": "https://github.com/imust6226/dirtcow" }, { "repository": "PoC-in-GitHub · zakariamaaraki/Dirty-COW-CVE-2016-5195-", "author": "zakariamaaraki", "first_seen": "2019-11-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Exploit the dirtycow vulnerability to login as root", "summary": "Exploit the dirtycow vulnerability to login as root", "url": "https://github.com/zakariamaaraki/Dirty-COW-CVE-2016-5195-" }, { "repository": "PoC-in-GitHub · shanuka-ashen/Dirty-Cow-Explanation-CVE-2016-5195-", "author": "shanuka-ashen", "first_seen": "2020-05-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2016-5195 repository", "summary": "", "url": "https://github.com/shanuka-ashen/Dirty-Cow-Explanation-CVE-2016-5195-" }, { "repository": "PoC-in-GitHub · dulanjaya23/Dirty-Cow-CVE-2016-5195-", "author": "dulanjaya23", "first_seen": "2020-05-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This is a Dirty Cow (CVE-2016-5195) privilege escalation vulnerability exploit", "summary": "This is a Dirty Cow (CVE-2016-5195) privilege escalation vulnerability exploit", "url": "https://github.com/dulanjaya23/Dirty-Cow-CVE-2016-5195-" }, { "repository": "PoC-in-GitHub · KaviDk/dirtyCow", "author": "KaviDk", "first_seen": "2020-05-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Dirtycow also is known as CVE-2016-5195", "summary": "Dirtycow also is known as CVE-2016-5195", "url": "https://github.com/KaviDk/dirtyCow" }, { "repository": "PoC-in-GitHub · DanielEbert/CVE-2016-5195", "author": "DanielEbert", "first_seen": "2020-12-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "DirtyCOW Exploit for Android", "summary": "DirtyCOW Exploit for Android", "url": "https://github.com/DanielEbert/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · arttnba3/CVE-2016-5195", "author": "arttnba3", "first_seen": "2021-04-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "my personal POC of CVE-2016-5195(dirtyCOW)", "summary": "my personal POC of CVE-2016-5195(dirtyCOW)", "url": "https://github.com/arttnba3/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · talsim/root-dirtyc0w", "author": "talsim", "first_seen": "2021-10-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "DirtyCow root privilege escalation (CVE-2016-5195)", "summary": "DirtyCow root privilege escalation (CVE-2016-5195)", "url": "https://github.com/talsim/root-dirtyc0w" }, { "repository": "PoC-in-GitHub · KasunPriyashan/Y2S1-Project-Linux-Exploitaion-using-CVE-2016-5195-Vulnerability", "author": "KasunPriyashan", "first_seen": "2022-01-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2016-5195 repository", "summary": "", "url": "https://github.com/KasunPriyashan/Y2S1-Project-Linux-Exploitaion-using-CVE-2016-5195-Vulnerability" }, { "repository": "PoC-in-GitHub · th3-5had0w/DirtyCOW-PoC", "author": "th3-5had0w", "first_seen": "2022-02-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "An exploit script of CVE-2016-5195", "summary": "An exploit script of CVE-2016-5195", "url": "https://github.com/th3-5had0w/DirtyCOW-PoC" }, { "repository": "PoC-in-GitHub · r1is/CVE-2022-0847", "author": "r1is", "first_seen": "2022-03-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 282, "title": "CVE-2022-0847-DirtyPipe-Exploit CVE-2022-0847 是存在于 Linux内核 5.8 及之后版本中的本地提权漏洞。攻击者通过利用此漏洞，可覆盖重写任意可读文件中的数据，从而可将普通权限的用户提升到特权 root。 CVE-2022-0847 的漏洞原理类似于 CVE-2016-5195 脏牛漏洞（Dirty Cow），但它更容易被利用。漏洞作者将此漏洞命名为“Dirty Pipe”", "summary": "CVE-2022-0847-DirtyPipe-Exploit CVE-2022-0847 是存在于 Linux内核 5.8 及之后版本中的本地提权漏洞。攻击者通过利用此漏洞，可覆盖重写任意可读文件中的数据，从而可将普通权限的用户提升到特权 root。 CVE-2022-0847 的漏洞原理类似于 CVE-2016-5195 脏牛漏洞（Dirty Cow），但它更容易被利用。漏洞作者将此漏洞命名为“Dirty Pipe”", "url": "https://github.com/r1is/CVE-2022-0847" }, { "repository": "PoC-in-GitHub · TotallyNotAHaxxer/CVE-2016-5195", "author": "TotallyNotAHaxxer", "first_seen": "2022-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Ported golang version of dirtycow.c", "summary": "Ported golang version of dirtycow.c", "url": "https://github.com/TotallyNotAHaxxer/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · passionchenjianyegmail8/scumjrs", "author": "passionchenjianyegmail8", "first_seen": "2022-04-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "PoC for Dirty COW (CVE-2016-5195)", "summary": "PoC for Dirty COW (CVE-2016-5195)", "url": "https://github.com/passionchenjianyegmail8/scumjrs" }, { "repository": "PoC-in-GitHub · malinthag62/The-exploitation-of-Dirty-Cow-CVE-2016-5195", "author": "malinthag62", "first_seen": "2022-05-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "The Repository contains documents that explains the explotation of CVE-2016-5195", "summary": "The Repository contains documents that explains the explotation of CVE-2016-5195", "url": "https://github.com/malinthag62/The-exploitation-of-Dirty-Cow-CVE-2016-5195" }, { "repository": "PoC-in-GitHub · fei9747/CVE-2016-5195", "author": "fei9747", "first_seen": "2022-11-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2016-5195 repository", "summary": "", "url": "https://github.com/fei9747/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · LinuxKernelContent/DirtyCow", "author": "LinuxKernelContent", "first_seen": "2023-02-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "Below code takes advantage of a known vulnerability [Dirty COW (CVE-2016-5195)] 🔥", "summary": "Below code takes advantage of a known vulnerability [Dirty COW (CVE-2016-5195)] 🔥", "url": "https://github.com/LinuxKernelContent/DirtyCow" }, { "repository": "PoC-in-GitHub · h1n4mx0z/Research-CVE-2016-5195", "author": "h1n4mx0z", "first_seen": "2023-10-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2016-5195 repository", "summary": "", "url": "https://github.com/h1n4mx0z/Research-CVE-2016-5195" }, { "repository": "PoC-in-GitHub · EDLLT/CVE-2016-5195-master", "author": "EDLLT", "first_seen": "2023-11-29", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2016-5195 repository", "summary": "", "url": "https://github.com/EDLLT/CVE-2016-5195-master" }, { "repository": "PoC-in-GitHub · ZhiQiAnSecFork/DirtyCOW_CVE-2016-5195", "author": "ZhiQiAnSecFork", "first_seen": "2023-12-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2016-5195 repository", "summary": "", "url": "https://github.com/ZhiQiAnSecFork/DirtyCOW_CVE-2016-5195" }, { "repository": "PoC-in-GitHub · sakilahamed/Linux-Kernel-Exploit-LAB", "author": "sakilahamed", "first_seen": "2024-03-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "More specific : Dirty COW (CVE-2016-5195)", "summary": "More specific : Dirty COW (CVE-2016-5195)", "url": "https://github.com/sakilahamed/Linux-Kernel-Exploit-LAB" }, { "repository": "PoC-in-GitHub · ASUKA39/CVE-2016-5195", "author": "ASUKA39", "first_seen": "2024-04-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "DirtyCOW 笔记", "summary": "DirtyCOW 笔记", "url": "https://github.com/ASUKA39/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · LiEnby/PSSRoot", "author": "LiEnby", "first_seen": "2025-03-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "One-Click-Root program based on CVE-2016-5195, that works on the old 'PlayStation Certified' android devices", "summary": "One-Click-Root program based on CVE-2016-5195, that works on the old 'PlayStation Certified' android devices", "url": "https://github.com/LiEnby/PSSRoot" }, { "repository": "PoC-in-GitHub · 0x3n19m4/CVE-2016-5195", "author": "0x3n19m4", "first_seen": "2025-05-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2016-5195 linux kernel exploit", "summary": "CVE-2016-5195 linux kernel exploit", "url": "https://github.com/0x3n19m4/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · Samuel-G3/Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow", "author": "Samuel-G3", "first_seen": "2025-06-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Exploit para escalada de privilegios en Linux basado en la vulnerabilidad Dirty Cow (CVE-2016-5195). Incluye binario, código fuente e instrucciones para su uso en entornos controlados.", "summary": "Exploit para escalada de privilegios en Linux basado en la vulnerabilidad Dirty Cow (CVE-2016-5195). Incluye binario, código fuente e instrucciones para su uso en entornos controlados.", "url": "https://github.com/Samuel-G3/Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow" }, { "repository": "PoC-in-GitHub · mohammadamin382/dirtycow-lab", "author": "mohammadamin382", "first_seen": "2025-07-31", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Educational PoC for Dirty COW (CVE-2016-5195) with logging, ptrace fallback, and binary payload support.", "summary": "Educational PoC for Dirty COW (CVE-2016-5195) with logging, ptrace fallback, and binary payload support.", "url": "https://github.com/mohammadamin382/dirtycow-lab" }, { "repository": "PoC-in-GitHub · MarioAlejos-Cs/dirtycow-lab", "author": "MarioAlejos-Cs", "first_seen": "2025-08-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Explotación vulnerabilidad Dirty COW (CVE-2016-5195) en Ubuntu 16.04.1.", "summary": "Explotación vulnerabilidad Dirty COW (CVE-2016-5195) en Ubuntu 16.04.1.", "url": "https://github.com/MarioAlejos-Cs/dirtycow-lab" }, { "repository": "PoC-in-GitHub · ramahmdr/dirtycow", "author": "ramahmdr", "first_seen": "2026-01-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Dirty Cow exploit - CVE-2016-5195", "summary": "Dirty Cow exploit - CVE-2016-5195", "url": "https://github.com/ramahmdr/dirtycow" }, { "repository": "PoC-in-GitHub · elhaddadalaa788-alt/kernel-exploit-dirtycow-project-subm", "author": "elhaddadalaa788-alt", "first_seen": "2026-02-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Dirty COW Privilege Escalation (CVE-2016-5195)", "summary": "Dirty COW Privilege Escalation (CVE-2016-5195)", "url": "https://github.com/elhaddadalaa788-alt/kernel-exploit-dirtycow-project-subm" }, { "repository": "PoC-in-GitHub · theo543/OSDS_Paper_CVE-2016-5195", "author": "theo543", "first_seen": "2026-02-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2016-5195 repository", "summary": "", "url": "https://github.com/theo543/OSDS_Paper_CVE-2016-5195" }, { "repository": "PoC-in-GitHub · maur0amaya/Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow", "author": "maur0amaya", "first_seen": "2026-05-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Este proyecto tiene como objetivo demostrar de forma práctica el funcionamiento del exploit Dirty COW (CVE-2016-5195), una vulnerabilidad crítica del en el kernel de Linux. Se simula un escenario realista en el que un atacante con acceso local limitado a un sistema sin parchear logra escalar sus privilegios hasta obtener acceso completo como root.", "summary": "Este proyecto tiene como objetivo demostrar de forma práctica el funcionamiento del exploit Dirty COW (CVE-2016-5195), una vulnerabilidad crítica del en el kernel de Linux. Se simula un escenario realista en el que un atacante con acceso local limitado a un sistema sin parchear logra escalar sus privilegios hasta obtener acceso completo como root.", "url": "https://github.com/maur0amaya/Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow" }, { "repository": "PoC-in-GitHub · rauljvc8/Exploit-Dirty-Cow", "author": "rauljvc8", "first_seen": "2026-05-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Privilege escalation lab reproducing the DirtyCow kernel exploit (CVE-2016-5195) in a controlled environment. Includes vulnerable setup, exploit execution, privilege escalation to root, and mitigation analysis.", "summary": "Privilege escalation lab reproducing the DirtyCow kernel exploit (CVE-2016-5195) in a controlled environment. Includes vulnerable setup, exploit execution, privilege escalation to root, and mitigation analysis.", "url": "https://github.com/rauljvc8/Exploit-Dirty-Cow" }, { "repository": "PoC-in-GitHub · GonzaBot/kernel-exploit-dirtycow", "author": "GonzaBot", "first_seen": "2026-06-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Lab — Privilege Escalation via Dirty Cow CVE-2016-5195 | 4Geeks Academy", "summary": "Lab — Privilege Escalation via Dirty Cow CVE-2016-5195 | 4Geeks Academy", "url": "https://github.com/GonzaBot/kernel-exploit-dirtycow" }, { "repository": "PoC-in-GitHub · gogooma125732/CVE-2016-5195", "author": "gogooma125732", "first_seen": "2026-06-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Defensive analysis and non-weaponized validation of CVE-2016-5195 (Dirty COW), including root-cause research, patch analysis, and reproducible evidence.", "summary": "Defensive analysis and non-weaponized validation of CVE-2016-5195 (Dirty COW), including root-cause research, patch analysis, and reproducible evidence.", "url": "https://github.com/gogooma125732/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · voidgguy/lenovo-a1000g-mt8317-A412_01_09_130907-kernel-3.4.0-root-cve-2016-5195", "author": "voidgguy", "first_seen": "2026-07-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "[AI-assisted] Root method for Lenovo IdeaTab A1000G (MT8317, kernel 3.4.0, Android 4.1) via CVE-2016-5195 (Dirty COW)", "summary": "[AI-assisted] Root method for Lenovo IdeaTab A1000G (MT8317, kernel 3.4.0, Android 4.1) via CVE-2016-5195 (Dirty COW)", "url": "https://github.com/voidgguy/lenovo-a1000g-mt8317-A412_01_09_130907-kernel-3.4.0-root-cve-2016-5195" }, { "repository": "PoC-in-GitHub · Minime794/CVE-2016-5195", "author": "Minime794", "first_seen": "2026-08-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Copy Fail CVE-2016-5195", "summary": "Copy Fail CVE-2016-5195", "url": "https://github.com/Minime794/CVE-2016-5195" }, { "repository": "PoC-in-GitHub · KongQBin/CVE-2016-5195", "author": "KongQBin", "first_seen": "2026-08-26", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2016-5195 repository", "summary": "", "url": "https://github.com/KongQBin/CVE-2016-5195" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/40616", "https://www.exploit-db.com/exploits/40847", "https://www.exploit-db.com/exploits/40838", "https://www.exploit-db.com/exploits/40839", "https://www.exploit-db.com/exploits/40611", "https://github.com/ASRTeam/CVE-2016-5195", "https://github.com/timwr/CVE-2016-5195", "https://github.com/xlucas/dirtycow.cr", "https://github.com/istenrot/centos-dirty-cow-ansible", "https://github.com/pgporada/ansible-role-cve", "https://github.com/sideeffect42/DirtyCOWTester", "https://github.com/scumjr/dirtycow-vdso", "https://github.com/gbonacini/CVE-2016-5195", "https://github.com/DavidBuchanan314/cowroot", "https://github.com/aishee/scan-dirtycow", "https://github.com/oleg-fiksel/ansible_CVE-2016-5195_check", "https://github.com/ldenevi/CVE-2016-5195", "https://github.com/whu-enjoy/CVE-2016-5195", "https://github.com/firefart/dirtycow", "https://github.com/ndobson/inspec_CVE-2016-5195", "https://github.com/sribaba/android-CVE-2016-5195", "https://github.com/esc0rtd3w/org.cowpoop.moooooo", "https://github.com/hyln9/VIKIROOT", "https://github.com/droidvoider/dirtycow-replacer", "https://github.com/FloridSleeves/os-experiment-4", "https://github.com/arbll/dirtycow", "https://github.com/titanhp/Dirty-COW-CVE-2016-5195-Testing", "https://github.com/acidburnmi/CVE-2016-5195-master", "https://github.com/xpcmdshell/derpyc0w", "https://github.com/Brucetg/DirtyCow-EXP", "https://github.com/jas502n/CVE-2016-5195", "https://github.com/imust6226/dirtcow", "https://github.com/zakariamaaraki/Dirty-COW-CVE-2016-5195-", "https://github.com/shanuka-ashen/Dirty-Cow-Explanation-CVE-2016-5195-", "https://github.com/dulanjaya23/Dirty-Cow-CVE-2016-5195-", "https://github.com/KaviDk/dirtyCow", "https://github.com/DanielEbert/CVE-2016-5195", "https://github.com/arttnba3/CVE-2016-5195", "https://github.com/talsim/root-dirtyc0w", "https://github.com/KasunPriyashan/Y2S1-Project-Linux-Exploitaion-using-CVE-2016-5195-Vulnerability", "https://github.com/th3-5had0w/DirtyCOW-PoC", "https://github.com/r1is/CVE-2022-0847", "https://github.com/TotallyNotAHaxxer/CVE-2016-5195", "https://github.com/passionchenjianyegmail8/scumjrs", "https://github.com/malinthag62/The-exploitation-of-Dirty-Cow-CVE-2016-5195", "https://github.com/fei9747/CVE-2016-5195", "https://github.com/LinuxKernelContent/DirtyCow", "https://github.com/h1n4mx0z/Research-CVE-2016-5195", "https://github.com/EDLLT/CVE-2016-5195-master", "https://github.com/ZhiQiAnSecFork/DirtyCOW_CVE-2016-5195", "https://github.com/sakilahamed/Linux-Kernel-Exploit-LAB", "https://github.com/ASUKA39/CVE-2016-5195", "https://github.com/LiEnby/PSSRoot", "https://github.com/0x3n19m4/CVE-2016-5195", "https://github.com/Samuel-G3/Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow", "https://github.com/mohammadamin382/dirtycow-lab", "https://github.com/MarioAlejos-Cs/dirtycow-lab", "https://github.com/ramahmdr/dirtycow", "https://github.com/elhaddadalaa788-alt/kernel-exploit-dirtycow-project-subm", "https://github.com/theo543/OSDS_Paper_CVE-2016-5195", "https://github.com/maur0amaya/Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow", "https://github.com/rauljvc8/Exploit-Dirty-Cow", "https://github.com/GonzaBot/kernel-exploit-dirtycow", "https://github.com/gogooma125732/CVE-2016-5195", "https://github.com/voidgguy/lenovo-a1000g-mt8317-A412_01_09_130907-kernel-3.4.0-root-cve-2016-5195", "https://github.com/Minime794/CVE-2016-5195", "https://github.com/KongQBin/CVE-2016-5195" ], "timeline": [ { "at": "2026-08-25T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-03-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-03-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-03-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-03-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-03-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-03-03", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2016-3714", "vendor": "ImageMagick", "product": "ImageMagick", "title": "ImageMagick Improper Input Validation Vulnerability", "summary": "ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.", "updated_at": "2026-06-17T00:46:14.277", "published_at": "2016-05-05T18:59:03.273", "cvss": 8.4, "confidence": 90, "confidence_label": "verified", "affected": "n/a; 0 through 6.9.3-9 (custom); 7.0.0-0; 7.0.1-0; 12.04; 14.04; 15.10; 16.04; 8.0; 9.0; 13.2; 42.1; 12", "fixed": "See vendor advisory", "source_count": 41, "kev": true, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-20", "what_happened": "ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 39767", "author": "Nikolay Ermishkin", "first_seen": "2016-05-04", "confidence": "High", "title": "ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities", "summary": "ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities", "url": "https://www.exploit-db.com/exploits/39767", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 39791", "author": "Metasploit", "first_seen": "2016-05-09", "confidence": "High", "title": "ImageMagick 6.9.3-9 / 7.0.1-0 - 'ImageTragick' Delegate Arbitrary Command Execution (Metasploit)", "summary": "ImageMagick 6.9.3-9 / 7.0.1-0 - 'ImageTragick' Delegate Arbitrary Command Execution (Metasploit)", "url": "https://www.exploit-db.com/exploits/39791", "verification": "verified", "verified": true }, { "title": "Exploit for CVE-2016-3714", "summary": "ImageMagick convert command processes .mvg files via tools component.", "what_happened": "ImageMagick convert command processes .mvg files via tools component.", "cvss": 10, "cvss_vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "attack_vector": "Network", "authentication": "Unknown", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-TOMMIIONFIRE-CVE-2016-3714", "https://kitploit.com/ru/tools/github/tommiionfire/cve-2016-3714/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-05T13:02:47", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-TOMMIIONFIRE-CVE-2016-3714" }, { "title": "Exploit for CVE-2016-3714", "summary": "ImageMagick convert command processes .mvg files via tools component.", "what_happened": "ImageMagick convert command processes .mvg files via tools component.", "cvss": 10, "cvss_vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "attack_vector": "Network", "authentication": "Unknown", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-TOMMIIONFIRE-CVE-2016-3714", "https://kitploit.com/ru/tools/github/tommiionfire/cve-2016-3714/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-05T13:02:47", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/tommiionfire/cve-2016-3714/" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/39767", "https://www.exploit-db.com/exploits/39791", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-TOMMIIONFIRE-CVE-2016-3714", "https://kitploit.com/ru/tools/github/tommiionfire/cve-2016-3714/", "http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog", "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html", "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html", "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html", "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html", "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html", "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html", "http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html", "http://rhn.redhat.com/errata/RHSA-2016-0726.html", "http://www.debian.org/security/2016/dsa-3580", "http://www.debian.org/security/2016/dsa-3746", "http://www.openwall.com/lists/oss-security/2016/05/03/13", "http://www.openwall.com/lists/oss-security/2016/05/03/18", "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html", "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html", "http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate", "http://www.securityfocus.com/archive/1/538378/100/0/threaded", "http://www.securityfocus.com/bid/89848", "http://www.securitytracker.com/id/1035742", "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568", "http://www.ubuntu.com/usn/USN-2990-1", "https://access.redhat.com/security/vulnerabilities/2296071", "https://bugzilla.redhat.com/show_bug.cgi?id=1332492", "https://imagetragick.com/", "https://security.gentoo.org/glsa/201611-21", "https://www.exploit-db.com/exploits/39767/", "https://www.exploit-db.com/exploits/39791/", "https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588", "https://www.imagemagick.org/script/changelog.php", "https://www.kb.cert.org/vuls/id/250519", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3714" ], "timeline": [ { "at": "2026-09-05T11:02:47Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2016-05-05T18:59:03.273", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3714" }, { "at": "2024-09-09", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "enrichment_checked_at": "2026-09-05T16:05:24Z", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2015-5377", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2015-5377 exploit", "summary": "Exploit for CVE-2015-5377. CVSS 9.8.", "updated_at": "2026-09-05T08:14:08Z", "published_at": "2026-09-05T08:14:08Z", "cvss": 9.8, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 32, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "RCE in Elasticsearch 1.5.2 via insecure Java deserialization on transport port 9300.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2015-5377", "summary": "RCE in Elasticsearch 1.5.2 via insecure Java deserialization on transport port 9300.", "what_happened": "RCE in Elasticsearch 1.5.2 via insecure Java deserialization on transport port 9300.", "cvss": 9.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FI3RO-CVE-2015-5377", "https://kitploit.com/hi/tools/github/fi3ro/cve-2015-5377/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-03T01:57:46", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FI3RO-CVE-2015-5377" }, { "repository": "fi3ro/CVE-2015-5377", "author": "fi3ro", "first_seen": "2020-12-28", "confidence": "High", "verification": "verified", "verified": true, "stars": 3, "title": "Java deserialization exploit for elasticsearch 1.5.2 CVE-2015-5377", "summary": "Java deserialization exploit for elasticsearch 1.5.2 CVE-2015-5377", "url": "https://github.com/fi3ro/CVE-2015-5377" }, { "title": "Exploit for CVE-2015-5377", "summary": "RCE in Elasticsearch 1.5.2 via insecure Java deserialization on transport port 9300.", "what_happened": "RCE in Elasticsearch 1.5.2 via insecure Java deserialization on transport port 9300.", "cvss": 9.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FI3RO-CVE-2015-5377", "https://kitploit.com/hi/tools/github/fi3ro/cve-2015-5377/" ], "repository": "kitploit.com", "author": "hi", "first_seen": "2026-09-03T01:57:46", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/hi/tools/github/fi3ro/cve-2015-5377/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FI3RO-CVE-2015-5377", "https://github.com/fi3ro/CVE-2015-5377", "https://kitploit.com/hi/tools/github/fi3ro/cve-2015-5377/" ], "timeline": [ { "at": "2026-09-05T08:14:08Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-FI3RO-CVE-2015-5377" } ] }, { "id": "CVE-2015-5287", "vendor": "Red Hat", "product": "Automatic Bug Reporting Tool", "title": "Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability", "summary": "Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.", "updated_at": "2026-08-25T22:00:00Z", "published_at": "2026-08-25T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 40, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 47421", "author": "Metasploit", "first_seen": "2019-09-25", "confidence": "High", "title": "ABRT - sosreport Privilege Escalation (Metasploit)", "summary": "ABRT - sosreport Privilege Escalation (Metasploit)", "url": "https://www.exploit-db.com/exploits/47421", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 38832", "author": "rebel", "first_seen": "2015-12-01", "confidence": "High", "title": "RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation", "summary": "RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation", "url": "https://www.exploit-db.com/exploits/38832", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 38835", "author": "rebel", "first_seen": "2015-12-01", "confidence": "High", "title": "abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation", "summary": "abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation", "url": "https://www.exploit-db.com/exploits/38835", "verification": "verified", "verified": true } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/47421", "https://www.exploit-db.com/exploits/38832", "https://www.exploit-db.com/exploits/38835" ], "timeline": [ { "at": "2026-08-25T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2015-3246", "vendor": "Red Hat", "product": "Libuser", "title": "Red Hat Libuser Race Condition Vulnerability", "summary": "Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.", "updated_at": "2026-08-25T22:00:00Z", "published_at": "2026-08-25T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 29, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 37706", "author": "Qualys Corporation", "first_seen": "2015-07-27", "confidence": "High", "title": "Libuser Library - Multiple Vulnerabilities", "summary": "Libuser Library - Multiple Vulnerabilities", "url": "https://www.exploit-db.com/exploits/37706", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 44633", "author": "Metasploit", "first_seen": "2018-05-16", "confidence": "High", "title": "Libuser - 'roothelper' Local Privilege Escalation (Metasploit)", "summary": "Libuser - 'roothelper' Local Privilege Escalation (Metasploit)", "url": "https://www.exploit-db.com/exploits/44633", "verification": "verified", "verified": true } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/37706", "https://www.exploit-db.com/exploits/44633" ], "timeline": [ { "at": "2026-08-25T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-08-26", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2014-0160", "vendor": "OpenSSL", "product": "OpenSSL", "title": "OpenSSL Information Disclosure Vulnerability", "summary": "The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.", "updated_at": "2026-08-17T22:00:00Z", "published_at": "2026-08-17T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 602, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 32764", "author": "Fitzl Csaba", "first_seen": "2014-04-09", "confidence": "High", "title": "OpenSSL 1.0.1f TLS Heartbeat Extension - 'Heartbleed' Memory Disclosure (Multiple SSL/TLS Versions)", "summary": "OpenSSL 1.0.1f TLS Heartbeat Extension - 'Heartbleed' Memory Disclosure (Multiple SSL/TLS Versions)", "url": "https://www.exploit-db.com/exploits/32764", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 32791", "author": "prdelka", "first_seen": "2014-04-10", "confidence": "High", "title": "OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (1)", "summary": "OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (1)", "url": "https://www.exploit-db.com/exploits/32791", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 32998", "author": "Ayman Sagy", "first_seen": "2014-04-24", "confidence": "High", "title": "OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (2) (DTLS Support)", "summary": "OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (2) (DTLS Support)", "url": "https://www.exploit-db.com/exploits/32998", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 32745", "author": "Jared Stafford", "first_seen": "2014-04-08", "confidence": "High", "title": "OpenSSL TLS Heartbeat Extension - 'Heartbleed' Memory Disclosure", "summary": "OpenSSL TLS Heartbeat Extension - 'Heartbleed' Memory Disclosure", "url": "https://www.exploit-db.com/exploits/32745", "verification": "verified", "verified": true }, { "repository": "PoC-in-GitHub · FiloSottile/Heartbleed", "author": "FiloSottile", "first_seen": "2014-04-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2379, "title": "A checker (site and tool) for CVE-2014-0160", "summary": "A checker (site and tool) for CVE-2014-0160", "url": "https://github.com/FiloSottile/Heartbleed" }, { "repository": "PoC-in-GitHub · titanous/heartbleeder", "author": "titanous", "first_seen": "2014-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 452, "title": "OpenSSL CVE-2014-0160 Heartbleed vulnerability test", "summary": "OpenSSL CVE-2014-0160 Heartbleed vulnerability test", "url": "https://github.com/titanous/heartbleeder" }, { "repository": "PoC-in-GitHub · DominikTo/bleed", "author": "DominikTo", "first_seen": "2014-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "bleed is a tool to test servers for the 'Heartbleed' vulnerability (CVE-2014-0160).", "summary": "bleed is a tool to test servers for the 'Heartbleed' vulnerability (CVE-2014-0160).", "url": "https://github.com/DominikTo/bleed" }, { "repository": "PoC-in-GitHub · cyphar/heartthreader", "author": "cyphar", "first_seen": "2014-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Mass, multithreaded testing for servers against Heartbleed (CVE-2014-0160).", "summary": "Mass, multithreaded testing for servers against Heartbleed (CVE-2014-0160).", "url": "https://github.com/cyphar/heartthreader" }, { "repository": "PoC-in-GitHub · jdauphant/patch-openssl-CVE-2014-0160", "author": "jdauphant", "first_seen": "2014-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 19, "title": "Patch openssl #heartbleed with ansible", "summary": "Patch openssl #heartbleed with ansible", "url": "https://github.com/jdauphant/patch-openssl-CVE-2014-0160" }, { "repository": "PoC-in-GitHub · musalbas/heartbleed-masstest", "author": "musalbas", "first_seen": "2014-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 572, "title": "Multi-threaded tool for scanning many hosts for CVE-2014-0160.", "summary": "Multi-threaded tool for scanning many hosts for CVE-2014-0160.", "url": "https://github.com/musalbas/heartbleed-masstest" }, { "repository": "PoC-in-GitHub · obayesshelton/CVE-2014-0160-Scanner", "author": "obayesshelton", "first_seen": "2014-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 repository", "summary": "", "url": "https://github.com/obayesshelton/CVE-2014-0160-Scanner" }, { "repository": "PoC-in-GitHub · Lekensteyn/pacemaker", "author": "Lekensteyn", "first_seen": "2014-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 331, "title": "Heartbleed (CVE-2014-0160) client exploit", "summary": "Heartbleed (CVE-2014-0160) client exploit", "url": "https://github.com/Lekensteyn/pacemaker" }, { "repository": "PoC-in-GitHub · isgroup/openmagic", "author": "isgroup", "first_seen": "2014-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 40, "title": "OpenSSL TLS heartbeat read overrun (CVE-2014-0160)", "summary": "OpenSSL TLS heartbeat read overrun (CVE-2014-0160)", "url": "https://github.com/isgroup/openmagic" }, { "repository": "PoC-in-GitHub · takeshixx/ssl-heartbleed.nse", "author": "takeshixx", "first_seen": "2014-04-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Nmap NSE script that discovers/exploits Heartbleed/CVE-2014-0160", "summary": "Nmap NSE script that discovers/exploits Heartbleed/CVE-2014-0160", "url": "https://github.com/takeshixx/ssl-heartbleed.nse" }, { "repository": "PoC-in-GitHub · roganartu/heartbleedchecker-chrome", "author": "roganartu", "first_seen": "2014-04-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Chrome extension that automatically checks visited sites for vulnerability to OpenSSL CVE-2014-0160", "summary": "Chrome extension that automatically checks visited sites for vulnerability to OpenSSL CVE-2014-0160", "url": "https://github.com/roganartu/heartbleedchecker-chrome" }, { "repository": "PoC-in-GitHub · zouguangxian/heartbleed", "author": "zouguangxian", "first_seen": "2014-04-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Checks for vulnerabilities: CVE-2014-0160", "summary": "Checks for vulnerabilities: CVE-2014-0160", "url": "https://github.com/zouguangxian/heartbleed" }, { "repository": "PoC-in-GitHub · sensepost/heartbleed-poc", "author": "sensepost", "first_seen": "2014-04-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 171, "title": "Test for SSL heartbeat vulnerability (CVE-2014-0160)", "summary": "Test for SSL heartbeat vulnerability (CVE-2014-0160)", "url": "https://github.com/sensepost/heartbleed-poc" }, { "repository": "PoC-in-GitHub · proactiveRISK/heartbleed-extention", "author": "proactiveRISK", "first_seen": "2014-04-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A firefox extension and checker for CVE-2014-0160", "summary": "A firefox extension and checker for CVE-2014-0160", "url": "https://github.com/proactiveRISK/heartbleed-extention" }, { "repository": "PoC-in-GitHub · amerine/coronary", "author": "amerine", "first_seen": "2014-04-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Test CIDR blocks for CVE-2014-0160/Heartbleed", "summary": "Test CIDR blocks for CVE-2014-0160/Heartbleed", "url": "https://github.com/amerine/coronary" }, { "repository": "PoC-in-GitHub · 0x90/CVE-2014-0160", "author": "0x90", "first_seen": "2014-04-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 8, "title": "Heartbleed variants", "summary": "Heartbleed variants", "url": "https://github.com/0x90/CVE-2014-0160" }, { "repository": "PoC-in-GitHub · waqasjamal-zz/HeartBleed-Vulnerability-Checker", "author": "waqasjamal-zz", "first_seen": "2014-04-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "This repo contains a script to automatically test sites for vulnerability to the Heartbleed Bug (CVE-2014-0160) based on the input file for the urls.", "summary": "This repo contains a script to automatically test sites for vulnerability to the Heartbleed Bug (CVE-2014-0160) based on the input file for the urls.", "url": "https://github.com/waqasjamal-zz/HeartBleed-Vulnerability-Checker" }, { "repository": "PoC-in-GitHub · siddolo/knockbleed", "author": "siddolo", "first_seen": "2014-04-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 mass test against subdomains", "summary": "CVE-2014-0160 mass test against subdomains", "url": "https://github.com/siddolo/knockbleed" }, { "repository": "PoC-in-GitHub · sammyfung/openssl-heartbleed-fix", "author": "sammyfung", "first_seen": "2014-04-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "OpenSSL Heartbleed (CVE-2014-0160) Fix script", "summary": "OpenSSL Heartbleed (CVE-2014-0160) Fix script", "url": "https://github.com/sammyfung/openssl-heartbleed-fix" }, { "repository": "PoC-in-GitHub · a0726h77/heartbleed-test", "author": "a0726h77", "first_seen": "2014-04-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 scanner", "summary": "CVE-2014-0160 scanner", "url": "https://github.com/a0726h77/heartbleed-test" }, { "repository": "PoC-in-GitHub · pblittle/aws-suture", "author": "pblittle", "first_seen": "2014-04-11", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "OpenSSL Heartbleed (CVE-2014-0160) vulnerability scanner.", "summary": "OpenSSL Heartbleed (CVE-2014-0160) vulnerability scanner.", "url": "https://github.com/pblittle/aws-suture" }, { "repository": "PoC-in-GitHub · hreese/heartbleed-dtls", "author": "hreese", "first_seen": "2014-04-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "POC for CVE-2014-0160 (Heartbleed) for DTLS", "summary": "POC for CVE-2014-0160 (Heartbleed) for DTLS", "url": "https://github.com/hreese/heartbleed-dtls" }, { "repository": "PoC-in-GitHub · 0xinf0/bleeding_onions", "author": "0xinf0", "first_seen": "2014-04-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 6, "title": "Script to find Exit and Guard nodes in the Tor Network, that are still suffering from CVE-2014-0160", "summary": "Script to find Exit and Guard nodes in the Tor Network, that are still suffering from CVE-2014-0160", "url": "https://github.com/0xinf0/bleeding_onions" }, { "repository": "PoC-in-GitHub · idkqh7/heatbleeding", "author": "idkqh7", "first_seen": "2014-04-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Test script for test 1Password database for SSL Hea(r)t Bleeding (CVE-2014-0160)", "summary": "Test script for test 1Password database for SSL Hea(r)t Bleeding (CVE-2014-0160)", "url": "https://github.com/idkqh7/heatbleeding" }, { "repository": "PoC-in-GitHub · GeeksXtreme/ssl-heartbleed.nse", "author": "GeeksXtreme", "first_seen": "2014-04-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Nmap NSE script that discovers/exploits Heartbleed/CVE-2014-0160.", "summary": "Nmap NSE script that discovers/exploits Heartbleed/CVE-2014-0160.", "url": "https://github.com/GeeksXtreme/ssl-heartbleed.nse" }, { "repository": "PoC-in-GitHub · xlucas/heartbleed", "author": "xlucas", "first_seen": "2014-04-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A research tool designed to check for OpenSSL CVE-2014-0160 vulnerability", "summary": "A research tool designed to check for OpenSSL CVE-2014-0160 vulnerability", "url": "https://github.com/xlucas/heartbleed" }, { "repository": "PoC-in-GitHub · einaros/heartbleed-tools", "author": "einaros", "first_seen": "2014-04-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 98, "title": "OpenSSL Heartbleed (CVE-2014-0160) vulnerability scanner, data miner and RSA key-restore tools.", "summary": "OpenSSL Heartbleed (CVE-2014-0160) vulnerability scanner, data miner and RSA key-restore tools.", "url": "https://github.com/einaros/heartbleed-tools" }, { "repository": "PoC-in-GitHub · mozilla-services/Heartbleed", "author": "mozilla-services", "first_seen": "2014-04-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "A checker (site and tool) for CVE-2014-0160", "summary": "A checker (site and tool) for CVE-2014-0160", "url": "https://github.com/mozilla-services/Heartbleed" }, { "repository": "PoC-in-GitHub · yryz/heartbleed.js", "author": "yryz", "first_seen": "2014-04-19", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 4, "title": "openssl Heartbleed bug(CVE-2014-0160) check for Node.js", "summary": "openssl Heartbleed bug(CVE-2014-0160) check for Node.js", "url": "https://github.com/yryz/heartbleed.js" }, { "repository": "PoC-in-GitHub · DisK0nn3cT/MaltegoHeartbleed", "author": "DisK0nn3cT", "first_seen": "2014-05-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 18, "title": "Maltego transform to detect the OpenSSL Heartbleed vulnerability (CVE-2014-0160)", "summary": "Maltego transform to detect the OpenSSL Heartbleed vulnerability (CVE-2014-0160)", "url": "https://github.com/DisK0nn3cT/MaltegoHeartbleed" }, { "repository": "PoC-in-GitHub · OffensivePython/HeartLeak", "author": "OffensivePython", "first_seen": "2014-05-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 15, "title": "CVE-2014-0160 (Heartbeat Buffer over-read bug)", "summary": "CVE-2014-0160 (Heartbeat Buffer over-read bug)", "url": "https://github.com/OffensivePython/HeartLeak" }, { "repository": "PoC-in-GitHub · vortextube/ssl_scanner", "author": "vortextube", "first_seen": "2014-10-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Heartbleed (CVE-2014-0160) SSLv3 Scanner", "summary": "Heartbleed (CVE-2014-0160) SSLv3 Scanner", "url": "https://github.com/vortextube/ssl_scanner" }, { "repository": "PoC-in-GitHub · mpgn/heartbleed-PoC", "author": "mpgn", "first_seen": "2015-03-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 85, "title": ":broken_heart: Hearbleed exploit to retrieve sensitive information CVE-2014-0160 :broken_heart:", "summary": ":broken_heart: Hearbleed exploit to retrieve sensitive information CVE-2014-0160 :broken_heart:", "url": "https://github.com/mpgn/heartbleed-PoC" }, { "repository": "PoC-in-GitHub · iSCInc/heartbleed", "author": "iSCInc", "first_seen": "2015-05-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "A checker (site and tool) for CVE-2014-0160. Software from @FiloSottile for iSC Inc..", "summary": "A checker (site and tool) for CVE-2014-0160. Software from @FiloSottile for iSC Inc..", "url": "https://github.com/iSCInc/heartbleed" }, { "repository": "PoC-in-GitHub · marstornado/cve-2014-0160-Yunfeng-Jiang", "author": "marstornado", "first_seen": "2015-06-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 repository", "summary": "", "url": "https://github.com/marstornado/cve-2014-0160-Yunfeng-Jiang" }, { "repository": "PoC-in-GitHub · hmlio/vaas-cve-2014-0160", "author": "hmlio", "first_seen": "2015-07-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 15, "title": "Vulnerability as a service: showcasing CVS-2014-0160, a.k.a. Heartbleed", "summary": "Vulnerability as a service: showcasing CVS-2014-0160, a.k.a. Heartbleed", "url": "https://github.com/hmlio/vaas-cve-2014-0160" }, { "repository": "PoC-in-GitHub · hybridus/heartbleedscanner", "author": "hybridus", "first_seen": "2015-09-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 11, "title": "Network Scanner for OpenSSL Memory Leak (CVE-2014-0160)", "summary": "Network Scanner for OpenSSL Memory Leak (CVE-2014-0160)", "url": "https://github.com/hybridus/heartbleedscanner" }, { "repository": "PoC-in-GitHub · froyo75/Heartbleed_Dockerfile_with_Nginx", "author": "froyo75", "first_seen": "2015-10-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Dockerfile for testing CVE-2014-0160 Heartbleed exploitation.", "summary": "Dockerfile for testing CVE-2014-0160 Heartbleed exploitation.", "url": "https://github.com/froyo75/Heartbleed_Dockerfile_with_Nginx" }, { "repository": "PoC-in-GitHub · Xyl2k/CVE-2014-0160-Chrome-Plugin", "author": "Xyl2k", "first_seen": "2016-02-16", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Heartbleed", "summary": "Heartbleed", "url": "https://github.com/Xyl2k/CVE-2014-0160-Chrome-Plugin" }, { "repository": "PoC-in-GitHub · caiqiqi/OpenSSL-HeartBleed-CVE-2014-0160-PoC", "author": "caiqiqi", "first_seen": "2018-11-08", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "来自：https://www.freebuf.com/articles/web/31700.html", "summary": "来自：https://www.freebuf.com/articles/web/31700.html", "url": "https://github.com/caiqiqi/OpenSSL-HeartBleed-CVE-2014-0160-PoC" }, { "repository": "PoC-in-GitHub · Saymeis/HeartBleed", "author": "Saymeis", "first_seen": "2018-12-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2014-0160", "summary": "CVE-2014-0160", "url": "https://github.com/Saymeis/HeartBleed" }, { "repository": "PoC-in-GitHub · cved-sources/cve-2014-0160", "author": "cved-sources", "first_seen": "2019-01-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "cve-2014-0160", "summary": "cve-2014-0160", "url": "https://github.com/cved-sources/cve-2014-0160" }, { "repository": "PoC-in-GitHub · cheese-hub/heartbleed", "author": "cheese-hub", "first_seen": "2019-02-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "Demonstration of the Heartbleed Bug CVE-2014-0160", "summary": "Demonstration of the Heartbleed Bug CVE-2014-0160", "url": "https://github.com/cheese-hub/heartbleed" }, { "repository": "PoC-in-GitHub · artofscripting-zz/cmty-ssl-heartbleed-CVE-2014-0160-HTTP-HTTPS", "author": "artofscripting-zz", "first_seen": "2019-04-02", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 repository", "summary": "", "url": "https://github.com/artofscripting-zz/cmty-ssl-heartbleed-CVE-2014-0160-HTTP-HTTPS" }, { "repository": "PoC-in-GitHub · tomdevman/heartbleed-bug", "author": "tomdevman", "first_seen": "2019-04-03", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Example and demo setup for Heartbleed vulnerability (CVE-2014-0160). This should be used for testing purposes only!💔", "summary": "Example and demo setup for Heartbleed vulnerability (CVE-2014-0160). This should be used for testing purposes only!💔", "url": "https://github.com/tomdevman/heartbleed-bug" }, { "repository": "PoC-in-GitHub · ThanHuuTuan/Heartexploit", "author": "ThanHuuTuan", "first_seen": "2019-08-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Aquí está mi nuevo y primer exploit web, este exploit ataca a la vulnerabilidad de HeartBleed (CVE-2014-0160) espero que os guste.", "summary": "Aquí está mi nuevo y primer exploit web, este exploit ataca a la vulnerabilidad de HeartBleed (CVE-2014-0160) espero que os guste.", "url": "https://github.com/ThanHuuTuan/Heartexploit" }, { "repository": "PoC-in-GitHub · rouze-d/heartbleed", "author": "rouze-d", "first_seen": "2020-07-04", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Simple OpenSSL TLS Heartbeat (CVE-2014-0160) Scanner and Exploit (Multiple SSL/TLS versions)", "summary": "Simple OpenSSL TLS Heartbeat (CVE-2014-0160) Scanner and Exploit (Multiple SSL/TLS versions)", "url": "https://github.com/rouze-d/heartbleed" }, { "repository": "PoC-in-GitHub · WildfootW/CVE-2014-0160_OpenSSL_1.0.1f_Heartbleed", "author": "WildfootW", "first_seen": "2020-12-09", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 repository", "summary": "", "url": "https://github.com/WildfootW/CVE-2014-0160_OpenSSL_1.0.1f_Heartbleed" }, { "repository": "PoC-in-GitHub · GuillermoEscobero/heartbleed", "author": "GuillermoEscobero", "first_seen": "2020-12-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "CVE-2014-0160 OpenSSL Heartbleed Proof of Concept", "summary": "CVE-2014-0160 OpenSSL Heartbleed Proof of Concept", "url": "https://github.com/GuillermoEscobero/heartbleed" }, { "repository": "PoC-in-GitHub · anthophilee/A2SV--SSL-VUL-Scan", "author": "anthophilee", "first_seen": "2021-01-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "A2SV = Auto Scanning to SSL Vulnerability HeartBleed, CCS Injection, SSLv3 POODLE, FREAK... etc Support Vulnerability [CVE-2007-1858] Anonymous Cipher [CVE-2012-4929] CRIME(SPDY) [CVE-2014-0160] CCS Injection [CVE-2014-0224] HeartBleed [CVE-2014-3566] SSLv3 POODLE [CVE-2015-0204] FREAK Attack [CVE-2015-4000] LOGJAM Attack [CVE-2016-0800] SSLv2 DROWN Installation : $ apt update && apt upgrade $ apt install git $ apt install python2 $ apt install python $ git clone https://github.com/hahwul/ a2sv $ cd a2sv $ chmod +x * $ pip2 install -r requirements.txt usage : $ python2 a2sv.py -h It shows all commands how we can use this tool $ python a2sv.py -t 127.0.0.1 127.0.0.1 = target means here own device", "summary": "A2SV = Auto Scanning to SSL Vulnerability HeartBleed, CCS Injection, SSLv3 POODLE, FREAK... etc Support Vulnerability [CVE-2007-1858] Anonymous Cipher [CVE-2012-4929] CRIME(SPDY) [CVE-2014-0160] CCS Injection [CVE-2014-0224] HeartBleed [CVE-2014-3566] SSLv3 POODLE [CVE-2015-0204] FREAK Attack [CVE-2015-4000] LOGJAM Attack [CVE-2016-0800] SSLv2 DROWN Installation : $ apt update && apt upgrade $ apt install git $ apt install python2 $ apt install python $ git clone https://github.com/hahwul/ a2sv $ cd a2sv $ chmod +x * $ pip2 install -r requirements.txt usage : $ python2 a2sv.py -h It shows all commands how we can use this tool $ python a2sv.py -t 127.0.0.1 127.0.0.1 = target means here own device", "url": "https://github.com/anthophilee/A2SV--SSL-VUL-Scan" }, { "repository": "PoC-in-GitHub · ingochris/heartpatch.us", "author": "ingochris", "first_seen": "2021-02-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "OpenSSL Heartbleed Bug CVE-2014-0160 Toolkit. Built with ❤ by Christopher Ngo.", "summary": "OpenSSL Heartbleed Bug CVE-2014-0160 Toolkit. Built with ❤ by Christopher Ngo.", "url": "https://github.com/ingochris/heartpatch.us" }, { "repository": "PoC-in-GitHub · belmind/heartbleed", "author": "belmind", "first_seen": "2021-03-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "A collection of scripts and instructions to test CVE-2014-0160 (heartbleed). ❤️ 🩸", "summary": "A collection of scripts and instructions to test CVE-2014-0160 (heartbleed). ❤️ 🩸", "url": "https://github.com/belmind/heartbleed" }, { "repository": "PoC-in-GitHub · pierceoneill/bleeding-heart", "author": "pierceoneill", "first_seen": "2021-08-15", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "The Heartbleed bug `CVE-2014-0160` is a severe implementation flaw in the OpenSSL library, which enables attackers to steal data from the memory of the victim server. The contents of the stolen data depend on what is there in the memory of the server. It could potentially contain private keys, TLS session keys, usernames, passwords, credit cards, etc. The vulnerability is in the implementation of the Heartbeat protocol, which is used by SSL/TLS to keep the connection alive.", "summary": "The Heartbleed bug `CVE-2014-0160` is a severe implementation flaw in the OpenSSL library, which enables attackers to steal data from the memory of the victim server. The contents of the stolen data depend on what is there in the memory of the server. It could potentially contain private keys, TLS session keys, usernames, passwords, credit cards, etc. The vulnerability is in the implementation of the Heartbeat protocol, which is used by SSL/TLS to keep the connection alive.", "url": "https://github.com/pierceoneill/bleeding-heart" }, { "repository": "PoC-in-GitHub · h3x0v3rl0rd/CVE-2014-0160_Heartbleed", "author": "h3x0v3rl0rd", "first_seen": "2022-04-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 repository", "summary": "", "url": "https://github.com/h3x0v3rl0rd/CVE-2014-0160_Heartbleed" }, { "repository": "PoC-in-GitHub · GardeniaWhite/fuzzing", "author": "GardeniaWhite", "first_seen": "2022-05-07", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "fuzzing with libFuzzer，inlude openssl heartbleed (CVE-2014-0160)", "summary": "fuzzing with libFuzzer，inlude openssl heartbleed (CVE-2014-0160)", "url": "https://github.com/GardeniaWhite/fuzzing" }, { "repository": "PoC-in-GitHub · undacmic/heartbleed-proof-of-concept", "author": "undacmic", "first_seen": "2023-01-05", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 5, "title": "Proof of concept for exploiting the Heartbeat Extension bug detailed in the CVE-2014-0160. :old_key: :unlock:", "summary": "Proof of concept for exploiting the Heartbeat Extension bug detailed in the CVE-2014-0160. :old_key: :unlock:", "url": "https://github.com/undacmic/heartbleed-proof-of-concept" }, { "repository": "PoC-in-GitHub · cbk914/heartbleed-checker", "author": "cbk914", "first_seen": "2023-04-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Check for CVE-2014-0160", "summary": "Check for CVE-2014-0160", "url": "https://github.com/cbk914/heartbleed-checker" }, { "repository": "PoC-in-GitHub · MrE-Fog/CVE-2014-0160-Chrome-Plugin", "author": "MrE-Fog", "first_seen": "2023-04-30", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 repository", "summary": "", "url": "https://github.com/MrE-Fog/CVE-2014-0160-Chrome-Plugin" }, { "repository": "PoC-in-GitHub · timsonner/cve-2014-0160-heartbleed", "author": "timsonner", "first_seen": "2023-07-31", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 repository", "summary": "", "url": "https://github.com/timsonner/cve-2014-0160-heartbleed" }, { "repository": "PoC-in-GitHub · yashfren/CVE-2014-0160-HeartBleed", "author": "yashfren", "first_seen": "2024-09-20", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 repository", "summary": "", "url": "https://github.com/yashfren/CVE-2014-0160-HeartBleed" }, { "repository": "PoC-in-GitHub · Shayhha/HeartbleedAttack", "author": "Shayhha", "first_seen": "2025-04-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "This is the Heratbleed bug (CVE-2014-0160) documentation I did for Advenced Cyber Attacks course.", "summary": "This is the Heratbleed bug (CVE-2014-0160) documentation I did for Advenced Cyber Attacks course.", "url": "https://github.com/Shayhha/HeartbleedAttack" }, { "repository": "PoC-in-GitHub · ArtemCyberLab/Project-Field-Analysis-and-Memory-Leak-Demonstration", "author": "ArtemCyberLab", "first_seen": "2025-06-27", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "The objective of this project was to assess a remote host for the Heartbleed vulnerability (CVE-2014-0160), verify its presence, and exploit it to extract potentially sensitive information from server memory over the TLS protocol.", "summary": "The objective of this project was to assess a remote host for the Heartbleed vulnerability (CVE-2014-0160), verify its presence, and exploit it to extract potentially sensitive information from server memory over the TLS protocol.", "url": "https://github.com/ArtemCyberLab/Project-Field-Analysis-and-Memory-Leak-Demonstration" }, { "repository": "PoC-in-GitHub · indrajeetmp11/Heartbleed-PoC-Exploit-Script", "author": "indrajeetmp11", "first_seen": "2025-11-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 2, "title": "This Python PoC script detects the Heartbleed vulnerability (CVE-2014-0160) by performing a TLS handshake with heartbeat extension and sending a crafted heartbeat request. It parses responses to identify leaked memory, helping assess server susceptibility to this critical OpenSSL flaw.", "summary": "This Python PoC script detects the Heartbleed vulnerability (CVE-2014-0160) by performing a TLS handshake with heartbeat extension and sending a crafted heartbeat request. It parses responses to identify leaked memory, helping assess server susceptibility to this critical OpenSSL flaw.", "url": "https://github.com/indrajeetmp11/Heartbleed-PoC-Exploit-Script" }, { "repository": "PoC-in-GitHub · SimoesCTT/CTT-HEARTBLEED-Temporal-Resonance-Memory-Leak-Exploit-Heartbleed-CVE-2014-0160", "author": "SimoesCTT", "first_seen": "2026-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Heartbleed (CVE-2014-0160) was devastating because it leaked adjacent memory. CTT-Heartbleed goes further—it uses 33-layer temporal resonance to map, reconstruct, and extract specific memory regions across time, not just adjacent buffers.", "summary": "Heartbleed (CVE-2014-0160) was devastating because it leaked adjacent memory. CTT-Heartbleed goes further—it uses 33-layer temporal resonance to map, reconstruct, and extract specific memory regions across time, not just adjacent buffers.", "url": "https://github.com/SimoesCTT/CTT-HEARTBLEED-Temporal-Resonance-Memory-Leak-Exploit-Heartbleed-CVE-2014-0160" }, { "repository": "PoC-in-GitHub · 22imer/CVE-2014-0160", "author": "22imer", "first_seen": "2026-01-28", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 repository", "summary": "", "url": "https://github.com/22imer/CVE-2014-0160" }, { "repository": "PoC-in-GitHub · 0xBlackash/CVE-2014-0160", "author": "0xBlackash", "first_seen": "2026-03-01", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160", "summary": "CVE-2014-0160", "url": "https://github.com/0xBlackash/CVE-2014-0160" }, { "repository": "PoC-in-GitHub · Ryo-Soikutsu/Heartbleed", "author": "Ryo-Soikutsu", "first_seen": "2026-03-22", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Demonstration of the Heartbleed CVE (CVE-2014-0160), including lab setup instructions and source code to build your own Heartbleed lab for educational purposes", "summary": "Demonstration of the Heartbleed CVE (CVE-2014-0160), including lab setup instructions and source code to build your own Heartbleed lab for educational purposes", "url": "https://github.com/Ryo-Soikutsu/Heartbleed" }, { "repository": "PoC-in-GitHub · victoriacfigueiredo/heartbleed-lab", "author": "victoriacfigueiredo", "first_seen": "2026-05-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "Educational laboratory for studying CVE-2014-0160 (Heartbleed) and framing inconsistencies in TLS heartbeat handling.", "summary": "Educational laboratory for studying CVE-2014-0160 (Heartbleed) and framing inconsistencies in TLS heartbeat handling.", "url": "https://github.com/victoriacfigueiredo/heartbleed-lab" }, { "repository": "PoC-in-GitHub · tungduongNT/CVE-2014-0160.", "author": "tungduongNT", "first_seen": "2026-07-17", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 repository", "summary": "", "url": "https://github.com/tungduongNT/CVE-2014-0160." }, { "repository": "PoC-in-GitHub · IhsSpotlight/HeartBleed-CVE-2014-0160--SCRIPTS-python3", "author": "IhsSpotlight", "first_seen": "2026-08-18", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2014-0160 repository", "summary": "", "url": "https://github.com/IhsSpotlight/HeartBleed-CVE-2014-0160--SCRIPTS-python3" } ], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.exploit-db.com/exploits/32764", "https://www.exploit-db.com/exploits/32791", "https://www.exploit-db.com/exploits/32998", "https://www.exploit-db.com/exploits/32745", "https://github.com/FiloSottile/Heartbleed", "https://github.com/titanous/heartbleeder", "https://github.com/DominikTo/bleed", "https://github.com/cyphar/heartthreader", "https://github.com/jdauphant/patch-openssl-CVE-2014-0160", "https://github.com/musalbas/heartbleed-masstest", "https://github.com/obayesshelton/CVE-2014-0160-Scanner", "https://github.com/Lekensteyn/pacemaker", "https://github.com/isgroup/openmagic", "https://github.com/takeshixx/ssl-heartbleed.nse", "https://github.com/roganartu/heartbleedchecker-chrome", "https://github.com/zouguangxian/heartbleed", "https://github.com/sensepost/heartbleed-poc", "https://github.com/proactiveRISK/heartbleed-extention", "https://github.com/amerine/coronary", "https://github.com/0x90/CVE-2014-0160", "https://github.com/waqasjamal-zz/HeartBleed-Vulnerability-Checker", "https://github.com/siddolo/knockbleed", "https://github.com/sammyfung/openssl-heartbleed-fix", "https://github.com/a0726h77/heartbleed-test", "https://github.com/pblittle/aws-suture", "https://github.com/hreese/heartbleed-dtls", "https://github.com/0xinf0/bleeding_onions", "https://github.com/idkqh7/heatbleeding", "https://github.com/GeeksXtreme/ssl-heartbleed.nse", "https://github.com/xlucas/heartbleed", "https://github.com/einaros/heartbleed-tools", "https://github.com/mozilla-services/Heartbleed", "https://github.com/yryz/heartbleed.js", "https://github.com/DisK0nn3cT/MaltegoHeartbleed", "https://github.com/OffensivePython/HeartLeak", "https://github.com/vortextube/ssl_scanner", "https://github.com/mpgn/heartbleed-PoC", "https://github.com/iSCInc/heartbleed", "https://github.com/marstornado/cve-2014-0160-Yunfeng-Jiang", "https://github.com/hmlio/vaas-cve-2014-0160", "https://github.com/hybridus/heartbleedscanner", "https://github.com/froyo75/Heartbleed_Dockerfile_with_Nginx", "https://github.com/Xyl2k/CVE-2014-0160-Chrome-Plugin", "https://github.com/caiqiqi/OpenSSL-HeartBleed-CVE-2014-0160-PoC", "https://github.com/Saymeis/HeartBleed", "https://github.com/cved-sources/cve-2014-0160", "https://github.com/cheese-hub/heartbleed", "https://github.com/artofscripting-zz/cmty-ssl-heartbleed-CVE-2014-0160-HTTP-HTTPS", "https://github.com/tomdevman/heartbleed-bug", "https://github.com/ThanHuuTuan/Heartexploit", "https://github.com/rouze-d/heartbleed", "https://github.com/WildfootW/CVE-2014-0160_OpenSSL_1.0.1f_Heartbleed", "https://github.com/GuillermoEscobero/heartbleed", "https://github.com/anthophilee/A2SV--SSL-VUL-Scan", "https://github.com/ingochris/heartpatch.us", "https://github.com/belmind/heartbleed", "https://github.com/pierceoneill/bleeding-heart", "https://github.com/h3x0v3rl0rd/CVE-2014-0160_Heartbleed", "https://github.com/GardeniaWhite/fuzzing", "https://github.com/undacmic/heartbleed-proof-of-concept", "https://github.com/cbk914/heartbleed-checker", "https://github.com/MrE-Fog/CVE-2014-0160-Chrome-Plugin", "https://github.com/timsonner/cve-2014-0160-heartbleed", "https://github.com/yashfren/CVE-2014-0160-HeartBleed", "https://github.com/Shayhha/HeartbleedAttack", "https://github.com/ArtemCyberLab/Project-Field-Analysis-and-Memory-Leak-Demonstration", "https://github.com/indrajeetmp11/Heartbleed-PoC-Exploit-Script", "https://github.com/SimoesCTT/CTT-HEARTBLEED-Temporal-Resonance-Memory-Leak-Exploit-Heartbleed-CVE-2014-0160", "https://github.com/22imer/CVE-2014-0160", "https://github.com/0xBlackash/CVE-2014-0160", "https://github.com/Ryo-Soikutsu/Heartbleed", "https://github.com/victoriacfigueiredo/heartbleed-lab", "https://github.com/tungduongNT/CVE-2014-0160.", "https://github.com/IhsSpotlight/HeartBleed-CVE-2014-0160--SCRIPTS-python3" ], "timeline": [ { "at": "2026-08-17T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-05-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-05-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-05-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-05-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2022-05-04", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2011-3192", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Apache - Denial of Service", "summary": "Apache - Denial of Service", "updated_at": "2026-09-05T08:11:19Z", "published_at": "2026-09-05T08:11:19Z", "cvss": 7.8, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 87, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Denial of service in Apache versions 1.3.x, 2.0.64 and 2.2.19 and below.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 18221", "author": "Ramon de C Valle", "first_seen": "2011-12-09", "confidence": "High", "title": "Apache - Denial of Service", "summary": "Apache - Denial of Service", "url": "https://www.exploit-db.com/exploits/18221", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 17696", "author": "kingcope", "first_seen": "2011-08-19", "confidence": "High", "title": "Apache - Remote Memory Exhaustion (Denial of Service)", "summary": "Apache - Remote Memory Exhaustion (Denial of Service)", "url": "https://www.exploit-db.com/exploits/17696", "verification": "verified", "verified": true }, { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T08:11:19+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2011-3192-apache-exploit", "summary": "Exploit for CVE-2011-3192. CVSS 7.8.", "cvss": 7.8, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-BLUEDRAGONSECURITY-CVE-2011-3192-APACHE-EXPLOIT" }, { "title": "CVE-2011-3192-apache-exploit", "summary": "Denial of service in Apache versions 1.3.x, 2.0.64 and 2.2.19 and below.", "what_happened": "Denial of service in Apache versions 1.3.x, 2.0.64 and 2.2.19 and below.", "cvss": 7.8, "cvss_vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "attack_vector": "Network", "authentication": "Unknown", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-BLUEDRAGONSECURITY-CVE-2011-3192-APACHE-EXPLOIT", "https://kitploit.com/ru/tools/github/bluedragonsecurity/cve-2011-3192-apache-exploit/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-08-25T03:46:08", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/bluedragonsecurity/cve-2011-3192-apache-exploit/" }, { "repository": "bluedragonsecurity/CVE-2011-3192-apache-exploit", "author": "bluedragonsecurity", "first_seen": "2026-05-14", "confidence": "High", "verification": "verified", "verified": true, "stars": 2, "title": "CVE-2011-3192 - Remote Apache DOS for Apache versions 1.3.x, 2.0.64 and below and 2.2.19 and below. Developed in 2011 by Antonius (ev1lut10n / w1sdom)", "summary": "CVE-2011-3192 - Remote Apache DOS for Apache versions 1.3.x, 2.0.64 and below and 2.2.19 and below. Developed in 2011 by Antonius (ev1lut10n / w1sdom)", "url": "https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit" }, { "repository": "Xinjis/Apache_ByteRange_DoS_cve_2011_3192", "author": "Xinjis", "first_seen": "2025-08-08", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "Script en python para comprobar CVE", "summary": "Script en python para comprobar CVE", "url": "https://github.com/Xinjis/Apache_ByteRange_DoS_cve_2011_3192" }, { "repository": "futurezayka/CVE-2011-3192", "author": "futurezayka", "first_seen": "2023-09-16", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2011-3192 repository", "summary": "", "url": "https://github.com/futurezayka/CVE-2011-3192" }, { "repository": "stcmjp/cve-2011-3192", "author": "stcmjp", "first_seen": "2020-04-09", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "This Repository use to test Apache Killer (cve-2011-3192).", "summary": "This Repository use to test Apache Killer (cve-2011-3192).", "url": "https://github.com/stcmjp/cve-2011-3192" }, { "repository": "tkisason/KillApachePy", "author": "tkisason", "first_seen": "2011-10-26", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 16, "title": "Python Apache Killer (Range Header DoS CVE-2011-3192)", "summary": "Python Apache Killer (Range Header DoS CVE-2011-3192)", "url": "https://github.com/tkisason/KillApachePy" } ], "references": [ "https://www.exploit-db.com/exploits/18221", "https://www.exploit-db.com/exploits/17696", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-BLUEDRAGONSECURITY-CVE-2011-3192-APACHE-EXPLOIT", "https://kitploit.com/ru/tools/github/bluedragonsecurity/cve-2011-3192-apache-exploit/", "https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit", "https://github.com/Xinjis/Apache_ByteRange_DoS_cve_2011_3192", "https://github.com/futurezayka/CVE-2011-3192", "https://github.com/stcmjp/cve-2011-3192", "https://github.com/tkisason/KillApachePy" ], "timeline": [ { "at": "2026-09-05T08:11:19Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/18221" } ] }, { "id": "CVE-2009-3103", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Microsoft Windows - SMB2 Negotiate Protocol '0x72' Response Denial of Service", "summary": "Microsoft Windows - SMB2 Negotiate Protocol '0x72' Response Denial of Service", "updated_at": "2026-09-05T12:41:05Z", "published_at": "2026-09-05T12:41:05Z", "cvss": 10, "confidence": 80, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 12524", "author": "Jelmer de Hen", "first_seen": "2010-05-07", "confidence": "High", "title": "Microsoft Windows - SMB2 Negotiate Protocol '0x72' Response Denial of Service", "summary": "Microsoft Windows - SMB2 Negotiate Protocol '0x72' Response Denial of Service", "url": "https://www.exploit-db.com/exploits/12524", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 10005", "author": "laurent gaffie", "first_seen": "2009-11-11", "confidence": "High", "title": "Microsoft Windows 7/2008 R2 - Remote Kernel Crash", "summary": "Microsoft Windows 7/2008 R2 - Remote Kernel Crash", "url": "https://www.exploit-db.com/exploits/10005", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 9594", "author": "laurent gaffie", "first_seen": "2009-09-09", "confidence": "High", "title": "Microsoft Windows Vista/7 - SMB2.0 Negotiate Protocol Request Remote Blue Screen of Death (MS07-063)", "summary": "Microsoft Windows Vista/7 - SMB2.0 Negotiate Protocol Request Remote Blue Screen of Death (MS07-063)", "url": "https://www.exploit-db.com/exploits/9594", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 40280", "author": "ohnozzy", "first_seen": "2016-02-26", "confidence": "High", "title": "Microsoft Windows - 'srv2.sys' SMB Code Execution (Python) (MS09-050)", "summary": "Microsoft Windows - 'srv2.sys' SMB Code Execution (Python) (MS09-050)", "url": "https://www.exploit-db.com/exploits/40280", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 14674", "author": "Piotr Bania", "first_seen": "2010-08-17", "confidence": "High", "title": "Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050)", "summary": "Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050)", "url": "https://www.exploit-db.com/exploits/14674", "verification": "verified", "verified": true }, { "repository": "Exploit-DB 16363", "author": "Metasploit", "first_seen": "2010-07-03", "confidence": "High", "title": "Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050) (Metasploit)", "summary": "Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050) (Metasploit)", "url": "https://www.exploit-db.com/exploits/16363", "verification": "verified", "verified": true }, { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T12:41:05+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "ms09-050_CVE-2009-3103 exploit", "summary": "Exploit for CVE-2009-3103. CVSS 10.", "cvss": 10, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SEC13B-MS09-050_CVE-2009-3103" } ], "references": [ "https://www.exploit-db.com/exploits/12524", "https://www.exploit-db.com/exploits/10005", "https://www.exploit-db.com/exploits/9594", "https://www.exploit-db.com/exploits/40280", "https://www.exploit-db.com/exploits/14674", "https://www.exploit-db.com/exploits/16363", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-SEC13B-MS09-050_CVE-2009-3103" ], "timeline": [ { "at": "2026-09-05T12:41:05Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/12524" } ] }, { "id": "CVE-2007-2447", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit)", "summary": "Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit)", "updated_at": "2026-09-05T08:11:11Z", "published_at": "2026-09-05T08:11:11Z", "cvss": 6, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 107, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Samba usermap script vulnerability enables remote code execution.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 16320", "author": "Metasploit", "first_seen": "2010-08-18", "confidence": "High", "title": "Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit)", "summary": "Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit)", "url": "https://www.exploit-db.com/exploits/16320", "verification": "verified", "verified": true }, { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-05T08:11:11+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2007-2447 exploit", "summary": "Exploit for CVE-2007-2447. CVSS 6.", "cvss": 6, "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AMRIUNIX-CVE-2007-2447" }, { "title": "Exploit for CVE-2007-2447", "summary": "Samba usermap script vulnerability enables remote code execution.", "what_happened": "Samba usermap script vulnerability enables remote code execution.", "cvss": 6, "cvss_vector": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "attack_vector": "Network", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AMRIUNIX-CVE-2007-2447", "https://kitploit.com/hi/tools/github/amriunix/cve-2007-2447/" ], "repository": "kitploit.com", "author": "hi", "first_seen": "2026-08-26T06:09:53", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/hi/tools/github/amriunix/cve-2007-2447/" }, { "repository": "harshiys/CVE-2007-2447-Exploitation-SIEM-Detection-Lab", "author": "harshiys", "first_seen": "2026-05-28", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Isolated AD/Linux attack lab: exploited CVE-2007-2447 via Metasploit, detected with Wazuh SIEM mapped to MITRE ATT&CK (T1190, T1059) ", "summary": "Isolated AD/Linux attack lab: exploited CVE-2007-2447 via Metasploit, detected with Wazuh SIEM mapped to MITRE ATT&CK (T1190, T1059) ", "url": "https://github.com/harshiys/CVE-2007-2447-Exploitation-SIEM-Detection-Lab" }, { "repository": "Mboatella25/metasploitable-pentest-lab", "author": "Mboatella25", "first_seen": "2026-07-17", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "Pentest completo sobre Metasploitable: recon con nmap, explotación con Metasploit (CVE-2007-2447), extracción y cracking de credenciales, persistencia SSH", "summary": "Pentest completo sobre Metasploitable: recon con nmap, explotación con Metasploit (CVE-2007-2447), extracción y cracking de credenciales, persistencia SSH", "url": "https://github.com/Mboatella25/metasploitable-pentest-lab" }, { "repository": "EthicalHackingLabs/metasploitable2-exploitation-metasploit", "author": "EthicalHackingLabs", "first_seen": "2026-06-26", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "Full Metasploit exploitation walkthrough against Metasploitable2 — vsftpd backdoor, Samba CVE-2007-2447, UnrealIRCd backdoor, Netcat exfiltration, and credential cracking prep.", "summary": "Full Metasploit exploitation walkthrough against Metasploitable2 — vsftpd backdoor, Samba CVE-2007-2447, UnrealIRCd backdoor, Netcat exfiltration, and credential cracking prep.", "url": "https://github.com/EthicalHackingLabs/metasploitable2-exploitation-metasploit" }, { "repository": "r3vpwnx/CVE-2007-2447", "author": "r3vpwnx", "first_seen": "2026-02-14", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Samba 3.0.20 CVE-2007-2447 Exploit", "summary": "Samba 3.0.20 CVE-2007-2447 Exploit", "url": "https://github.com/r3vpwnx/CVE-2007-2447" }, { "repository": "DesmondHinds94/S22_The_Verification_Protocol", "author": "DesmondHinds94", "first_seen": "2026-05-29", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "P1 W8 S22 - Metasploit Samba CVE-2007-2447 Exploitation", "summary": "P1 W8 S22 - Metasploit Samba CVE-2007-2447 Exploitation", "url": "https://github.com/DesmondHinds94/S22_The_Verification_Protocol" }, { "repository": "jaden-mas1010/Metasploitable2-Vulnerability-Assessment", "author": "jaden-mas1010", "first_seen": "2026-05-26", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "End‑to‑end Metasploitable2 vulnerability assessment covering reconnaissance, exploitation (vsftpd backdoor, distcc RCE, Samba CVE‑2007‑2447), reverse‑shell handling, and Wireshark traffic analysis. Includes SOC‑style documentation, evidence, and mitigation recommendations.", "summary": "End‑to‑end Metasploitable2 vulnerability assessment covering reconnaissance, exploitation (vsftpd backdoor, distcc RCE, Samba CVE‑2007‑2447), reverse‑shell handling, and Wireshark traffic analysis. Includes SOC‑style documentation, evidence, and mitigation recommendations.", "url": "https://github.com/jaden-mas1010/Metasploitable2-Vulnerability-Assessment" }, { "repository": "Youneskc/SMB-Penetration-Testing-NTLM-Relay-Version-2-", "author": "Youneskc", "first_seen": "2026-05-19", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "SMB Red Team Lab— NTLM Relay via LLMNR Poisoning, CVE-2007-2447, NTLMv2 Hash Cracking & NT AUTHORITY\\SYSTEM on Windows 10", "summary": "SMB Red Team Lab— NTLM Relay via LLMNR Poisoning, CVE-2007-2447, NTLMv2 Hash Cracking & NT AUTHORITY\\SYSTEM on Windows 10", "url": "https://github.com/Youneskc/SMB-Penetration-Testing-NTLM-Relay-Version-2-" }, { "repository": "Daviddoctor/Samba-CVE-2007-2447-Exploit-Username-Map-Script", "author": "Daviddoctor", "first_seen": "2026-04-17", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Samba CVE-2007-2447 Exploit", "summary": "Samba CVE-2007-2447 Exploit", "url": "https://github.com/Daviddoctor/Samba-CVE-2007-2447-Exploit-Username-Map-Script" }, { "repository": "Nyabayo/flatiron-pentest-nmap-enum4linux-smb-ftp-samba-metasploitable2-kali-healthcare-report", "author": "Nyabayo", "first_seen": "2026-04-10", "confidence": "Medium", "verification": "candidate", "verified": false, "stars": 0, "title": "flatiron cyberdefense penetration testing scanning enumeration nmap sV sS T4 enum4linux smb ftp vsftpd samba telnet vnc mysql nfs ssh metasploitable2 kali linux healthcare staging cve 2011 2523 cve 2007 2447 cve 2010 2075 vulnerability assessment lab", "summary": "flatiron cyberdefense penetration testing scanning enumeration nmap sV sS T4 enum4linux smb ftp vsftpd samba telnet vnc mysql nfs ssh metasploitable2 kali linux healthcare staging cve 2011 2523 cve 2007 2447 cve 2010 2075 vulnerability assessment lab", "url": "https://github.com/Nyabayo/flatiron-pentest-nmap-enum4linux-smb-ftp-samba-metasploitable2-kali-healthcare-report" }, { "repository": "vig9610/Exploiting-Samba-on-Metasploitable-2", "author": "vig9610", "first_seen": "2026-01-16", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Utilize metasploit from a Kali Linux machine to exploit a well-known samba vulnerability (CVE-2007-2447). This is done in order to infiltrate a Metasploitable 2 machine with a reverse shell to access the root folder. Once this folder has been accessed, it should reveal the /etc/shadow folder which would give proof of compromise.", "summary": "Utilize metasploit from a Kali Linux machine to exploit a well-known samba vulnerability (CVE-2007-2447). This is done in order to infiltrate a Metasploitable 2 machine with a reverse shell to access the root folder. Once this folder has been accessed, it should reveal the /etc/shadow folder which would give proof of compromise.", "url": "https://github.com/vig9610/Exploiting-Samba-on-Metasploitable-2" } ], "references": [ "https://www.exploit-db.com/exploits/16320", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AMRIUNIX-CVE-2007-2447", "https://kitploit.com/hi/tools/github/amriunix/cve-2007-2447/", "https://github.com/harshiys/CVE-2007-2447-Exploitation-SIEM-Detection-Lab", "https://github.com/Mboatella25/metasploitable-pentest-lab", "https://github.com/EthicalHackingLabs/metasploitable2-exploitation-metasploit", "https://github.com/r3vpwnx/CVE-2007-2447", "https://github.com/DesmondHinds94/S22_The_Verification_Protocol", "https://github.com/jaden-mas1010/Metasploitable2-Vulnerability-Assessment", "https://github.com/Youneskc/SMB-Penetration-Testing-NTLM-Relay-Version-2-", "https://github.com/Daviddoctor/Samba-CVE-2007-2447-Exploit-Username-Map-Script", "https://github.com/Nyabayo/flatiron-pentest-nmap-enum4linux-smb-ftp-samba-metasploitable2-kali-healthcare-report", "https://github.com/vig9610/Exploiting-Samba-on-Metasploitable-2" ], "timeline": [ { "at": "2026-09-05T08:11:11Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/16320" } ] } ] }