Exploit for CVE-2026-112900

Pillow Ghostscript Argument Injection PoC CVE-2026-112900 P...

Exploit for CVE-2026-112900

Pillow Ghostscript Argument Injection PoC CVE-2026-112900 P...

CLSA-2026-1792935277 openssh: Fix of 4 CVEs

CVE-2026-106585: a compressed packet could inflate far beyond the maximum packet size and exhaust memory; reject it once the decompressed payload reaches PACKETMAXSIZE. Backport upstream commit e0f85d83. - CVE-2026-106555: sshd kept GSSAPI client state from a partially completed authentication...

CLSA-2026-1792933338 openssh: Fix of 4 CVEs

CVE-2026-106555: sshd kept GSSAPI client state from a partially completed authentication attempt and could reuse it in a later attempt; reset it before each attempt. Backport upstream commits 670510d1 and d549f99d. - CVE-2026-106553: sshd stored delegated GSSAPI credentials even when GSSAPI user...

CLSA-2026-1792932827 openssh: Fix of 4 CVEs

CVE-2026-106555: sshd kept GSSAPI client state from a partially completed authentication attempt and could reuse it in a later attempt; reset it before each attempt. Backport upstream commits 670510d1 and d549f99d. - CVE-2026-106553: sshd stored delegated GSSAPI credentials even when GSSAPI user...

poc-sky

CVE-2019-2215 on Skyworth / Coocaa TVs 9S60, Android 8.0 Te...

ConfluenceMemshell

ConfluenceMemshell Confluence CVE 2021, 2022, 2023 exploitation tool, supports command execution, Godzilla, Behinder memory shell injection Supported Confluence versions: CVE-2021-26084, CVE-2022-26134, CVE202322515, CVE-2023-22527 If it helps you and you think it's good, please give it a big ⭐️❗️...

gcat

Gcat A stealthy Python based backdoor that uses Gmail as a command and control server This project was inspired by the original PoC code from Benjamin Donnelly This is PoC code... ... that was released for orginazations to test their defenses against these type of attacks. In order to detect them...

Amazon Linux 2023 : edk2-aarch64, edk2-ovmf, edk2-shell-aa64 (ALAS2023-2026-3227)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3227 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes disproportionate heap growth when OpenSSL cachesX.509 extensions. Impact summary: Receiving a craft...

Krayin CRM 2.2.x Authenticated Shell Upload

Krayin CRM version 2.2.x contains an authenticated arbitrary file upload vulnerability in its TinyMCE upload endpoint that may allow server-side PHP code execution. This proof of concept authenticates to the application and uploads a supplied file. https://packetstorm.news/download/237475...

ghostlock-somalia

GhostLock on a Unisoc T8300 Rooting a Redmi A7 Pro 5G CV...

Joern 4.0.665

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Important: ghostscript

Issue Overview: A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling o...

Exploit for CVE-2026-94293

CVE-2026-94293 — PoC: Asset Administration Shell Auth Bypass...

agkit (>=0.17.0, <=0.26.0), ai-puti (0.1.0b5) +238 more potentially affected by CVE-2026-112398 via pillow (11.1.0)

pillow PYPI version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - agkit =0.17.0, =0.2.0, =0.1.0, =0.76.0, =0.1.1, =3.1.8, =0.1.0, =0.1.0, =0.5.0, =25.2.0, =1.0.4, =0.1.0, =0.1.12 - arched-emailer 0.4.6 and more...

-php2shell-advanced

PHP2Shell Advanced Exploit Framework An advanced exploit fram...

ai-shell (>=0.1.0, <=1.0.4), airut (>=0.25.5, <=0.27.0) +142 more potentially affected by CVE-2026-115355 via mistune (>=3.0.0rc5, <=3.2.1)

mistune PYPI version =3.0.0rc5, =0.1.0, =0.25.5, =0.9.5, =3.0.0rc3, =3.2.1b1, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.2, =1.0.0.1, =0.0.1, =0.1.10, =0.1.20 and more Source cves: CVE-2026-115355 Source advisory: OSV:GHSA-H7WW-273W-6CM8...

CLSA-2026-1792770120 rpm: Fix of CVE-2026-84837

CVE-2026-84837: do not macro expand or shell interpret the tarball file name passed to rpmbuild -t...

CLSA-2026-1792769939 rpm: Fix of CVE-2026-84837

CVE-2026-84837: do not macro expand or shell interpret the tarball file name passed to rpmbuild -t...

DEBIAN-CVE-2026-39902

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ;&| $\n\r omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an inputstring containing single-quote, redirect...