CVE-2026-93857

A stack-based buffer overflow vulnerability exists in the Fireware OS SIP proxy . A remote, unauthenticated attacker can exploit this by sending a specially crafted request through a policy utilizing the SIP proxy, potentially leading to remote code execution . No specific exploit details or reme...

EUVD-2026-111156

A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy...

CVE-2026-103594

A stack-based buffer overflow exists in the Fireware OS WireGuard configuration processing. A remote attacker with man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud can tamper with a FireCloud Gateway configuration payload . This vulnerability can lead to a Denial of...

CVE-2026-103594 Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution

A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by...

CVE-2026-93857 Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution

A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy...

vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

Summary An untrusted multimodal request can set mmprocessorkwargs.coderevision. When vLLM serves a model whose Hugging Face processor uses dynamic automap code and the operator enabled --trust-remote-code, this request value reaches AutoProcessor.frompretrained and selects the Python revision...

GHSA-H3RC-6MM3-GC2M vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

Summary An untrusted multimodal request can set mmprocessorkwargs.coderevision. When vLLM serves a model whose Hugging Face processor uses dynamic automap code and the operator enabled --trust-remote-code, this request value reaches AutoProcessor.frompretrained and selects the Python revision...

CVE-2021-44967

CVE-2021-44967: LimeSurvey authenticated RCE Proof of concept for CVE-2021-44967. The script authenticates to LimeSurvey, uploads and activates a PHP plugin, and triggers a reverse shell. Use this only against systems you own or are authorized to test. Requirements Python 3 beautifulsoup4,...

CVE-2026-78845

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution RCE via UPnP root description parsing...

Exploit for CVE-2026-16723

CVE-2026-16723 fastjson 1.2.83 Remote Code Execution Replay En...

EUVD-2026-111073

An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited ...

CVE-2026-92372 Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution

An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited ...

CVE-2026-92372

The TeamViewer Full Client for Linux and macOS (versions prior to 15.83) contains an out-of-bounds write vulnerability in its screen-image decoder . The root cause is missing destination bounds checking, which allows a remote attacker to execute arbitrary code by supplying crafted screen-image da...

LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

Summary An authenticated user with internaluser privileges can escalate to proxyadmin and achieve remote code execution. The proxy uses one encryption key for two purposes: sealing secrets at rest and minting session tokens. An attacker exploits this by requesting a new API key with a crafted...

GHSA-7HP6-4W63-5G45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

Summary An authenticated user with internaluser privileges can escalate to proxyadmin and achieve remote code execution. The proxy uses one encryption key for two purposes: sealing secrets at rest and minting session tokens. An attacker exploits this by requesting a new API key with a crafted...

LFITester

DISCLAIMER • This tool is for educational purposes only. • The developers and collaborators are not responsible for any illegal usage of this tool. LFITester LFITester is a Python3 tool which tests if a server is vulnerable to Local File Inclusion LFI attacks. It runs in Linux/Unix systems but it...

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

Cisco CUCM Remote Code Execution Chain — Detect

Fingerprint / reachability check for Cisco CUCM Remote Code Execution Chain !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Cisco CUCM Remote Code Execution Chain""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

IceWarp Server Static Route External Filter UNC DLL Remote Code Execution — Detect

Fingerprint / reachability check for IceWarp Server Static Route External Filter UNC DLL Remote Code Execution !/usr/bin/env python3 -- coding: utf-8 -- """Detection for IceWarp Server Static Route External Filter UNC DLL Remote Code Execution""" from kittysploit import from...

Opengear NGCS PDU name command injection

Administrator POST /api/v2/pdus with injected pdu.name breaks out of ogpower -n quoting; io.popen runs attacker command as root. !/usr/bin/env python3 -- coding: utf-8 -- """Opengear NGCS PDU name field command injection authenticated root.""" from future import annotations import json import re...