CVE-2026-77052

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path via a Caddy reverse proxy. An unauthenticated attacker on the local network can exploit the Node-RED Admin API to deploy malicious flows, leading to remote code execution and full control over the home automatio...

CVE-2026-77052 Missing Authentication for Node-RED in boneIO

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

EUVD-2026-109947

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2scan A self-hosted web page that checks whether a website...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell Checker A self-hosted web page that checks whether...

CVE-2026-115188

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user...

PoC_PHP2Shell

PoCPHP2Shell Security research and proof-of-concept for CV...

⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More

This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they...

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network...

CVE-2021-46398

CVE-2021-46398 - Lalie ARNOUD, Gaspard ANDRIEU In this repository, you will find a proof of concept of the exploitation of the CVE-2021-46398 flaw through a docker compose, as well as an analysis of the impacts of this flaw on information systems. Exploit Title: FileBrowser 2.17.2 - Cross Site...

Security Bulletin: IBM Integration Bus for z/OS Toolkit is vulnerable to remote code execution (CVE-2026-109618, CVE-2026-109619)

Summary IBM Integration Bus for z/OS Toolkit pattern generation using a PHP API for user-defined patterns is vulnerable to remote code execution. Vulnerability Details CVEID:CVE-2026-109618 DESCRIPTION: PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling o...

Security Bulletin: IBM App Connect Enterprise Toolkit is vulnerable to remote code execution (CVE-2026-109618, CVE-2026-109619)

Summary IBM App Connect Enterprise Toolkit pattern generation using a PHP API for user-defined patterns is vulnerable to remote code execution. Vulnerability Details CVEID:CVE-2026-109618 DESCRIPTION: PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of...

CVE-2026-115188

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user...

CVE-2026-115188

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user...

CVE-2026-115188

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user...

CVE-2026-115188

The campaign import feature in Mautic 7 is vulnerable to an unrestricted file upload (CWE-434, CWE-94). When processing uploaded campaign archives, the application copies bundled asset files into a publicly accessible media directory without validating file names or types. An authenticated user w...

EUVD-2026-109791

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user...

CVE-2026-115188

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user...

cybersecurity-lab-reports

🛡️ Red Team & Cybersecurity Engineering Technical Reports Wel...

CVE-2026-41089

CVE-2026-41089 — Windows Netlogon CLDAP Stack Buffer Overflow RCE Exploit CVE-ID: CVE-2026-41089 CVSS: 9.8 Critical CWE: CWE-121 Stack-based Buffer Overflow Attack Vector: UDP/389 CLDAP SearchRequest Impact: Remote Code Execution RCE / Denial of Service DoS Affected Versions: Windows Server 2012 ...