229538 matches found
exploit-arsenal
CVE Proof-of-Concept Collection Clean, dependency-free Pytho...
CVE-2026-8172
The CVE-2026-8172 entry concerns the WordPress plugin Simple Basic Contact Form (through 20250114). The issue is a Reflected Cross-Site Scripting vulnerability caused by not escaping user-supplied input before reflecting it in the contact form output on validation errors. Impact described: unauth...
Exploit for Improper Certificate Validation in Openssl
No d...
Exploit for Untrusted Pointer Dereference in Microsoft
Note The...
GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilities
Summary Multiple exploitable OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GV-I/O Box 4E versions: 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger these vulnerabilities. Confirmed...
The vulnerability of the decoder in the MSL console-based image editing tool ImageMagick, which allows a hacker to trigger a service failure.
The vulnerability of the decoder in the MSL console-based image editing tool ImageMagick relates to the possibility of exploiting memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a system failure...
CVE-2026-48109
MessagePack for C is a MessagePack serializer for C. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation is based on a deprecated fast-decompression algorithm that do...
CVE-2026-56306
Capgo before 12.128.2 contains a parsing vulnerability in the x-limited-key-id header that can bypass subkey enforcement and let attackers make requests under the main API key context instead of restricted subkey permissions. The issue arises from malformed, zero, or duplicate header values produ...
EUVD-2025-210303
picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.getentity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims using pickle.load...
red-specter-specter-foundry
No d...
Exploit for Out-of-bounds Write in Linux Linux_Kernel
No d...
BIT-NGINX-2026-48142 NGINX ngx_http_charset_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcharsetmodule module. When content is served or proxied through a location block with both sourcecharset utf-8; and a charset directive for example, charset koi8-r; configured, remote, unauthenticated attackers can send requests ...
EUVD-2026-38196
A security flaw has been discovered in Edimax BR-6478AC V2 1.23. Affected by this vulnerability is the function mp of the file /goform/mp of the component POST Request Handler. Performing a manipulation of the argument command results in command injection. The attack may be initiated remotely. Th...
EUVD-2026-38200
A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the function system of the file /cgi-bin/mbox-config?section=pingconfig of the component API Endpoint. This manipulation of the argument destination causes os command injection. The attack is possible to be carried o...
EUVD-2026-38195
A vulnerability was identified in Edimax BR-6478AC V2 1.23. Affected is the function wiz5in1redirect of the file /goform/wiz5in1redirect of the component POST Request Handler. Such manipulation of the argument newpass leads to command injection. The attack can be launched remotely. The exploit is...
EUVD-2026-38197
A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is the function router.replace/router.push of the file apps/frontend/src/app/auth/page.tsx of the component Auth Endpoint. Executing a manipulation of the argument returnURL can lead to cross site scripting. The...
CVE-2026-12823
A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler. The manipulation results in incorrect default permissions. The attack requires a local approach. The exploit has been released to the publ...
Microsoft 365 Copilot Command Injection Vulnerability (CNVD-2026-26512)
Microsoft 365 Copilot is an AI assistant integrated into the Microsoft 365 office suite. It offers features such as intelligent writing, data analysis, and content generation. Microsoft 365 Copilot has a command injection vulnerability. This vulnerability arises from the failure to properly...
The vulnerability of the IPL-decoder in the console-based graphic editor ImageMagick, which allows a hacker to trigger a service failure.
The vulnerability of the IPL-decoder in the console-based graphic editor ImageMagick is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...