CVE-2026-103059

A flaw was found in Gitea. When the built-in Secure Shell SSH server is enabled, public keys are evaluated using a case-insensitive comparison on certain database systems. A remote attacker who constructs a case variant of an existing user's registered public key and possesses the corresponding...

CVE-2025-55182-VulnCheckPOC

CVE-2025-55182 Vulnerability Check PoC Proof-of-concept scanner for detecting React Server Components RSC vulnerability in Next.js applications CVE-2025-55182. Usage This is only a check to see if a server is vulnerable, based on this release by Searchlight Cyber...

react-cve-2025-55182-lab

Setup: git clone https://github.com/alexandre-briongos-wavestone/react-cve-2025-55182-lab cd react-cve-2025-55182-lab sudo docker build -t react-rsc-lab . sudo docker run -p 3000:3000 react-rsc-lab Exploit: curl --path-as-is -i -s -k -X $'POST' \ -H $'Host: localhost:3000' -H $'User-Agent:...

POC2-CVE-2025-55182

React2Shell Ultimate - CVE-2025-66478 Scanner The most comprehensive scanner for Next.js RSC Remote Code Execution vulnerability ╔════════════════════════════════════════════════════════════════════════╗ ║ ║ ║ | \ | || / || | | | | ║ ║ | | / / |/ | | / /\ | ' \ / \ | | ║ ║ | / | | | | / / | | |...

Next.js-RSC-RCE-Scanner-CVE-2025-66478

Next.js-RSC-RCE-Scanner-CVE-2025-66478 CVE-2025-66478 Next.js vulnerability scanner. Detects whether a website is using a version of Next.js affected by the RSC React Server Components RCE vulnerability. Installation and Execution Using uv Recommended uv is a fast Python package manager. 1...

CVE-2021-41773

CVE-2021-41773 — Apache Path Traversal & RCE Exploitation Writeup of the TryHackMe "Modern Web Stacks" room, focused on exploiting CVE-2021-41773 , a path traversal vulnerability in Apache HTTP Server 2.4.49 that leads to remote code execution when modcgi is enabled. Summary Item| Detail ---|---...

CVE-2026-32996

CVE-2026-32996 A vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. Check blog post post for technical details. https://github.com/user-attachments/assets/8a570332-1cf6-4905-9107-8fcb973c9ce7 PoC CVE-2026-32996.exe "whoami C:\pwned.txt" + Found...

CVE-2025-55182

CVE-2025-55182 Scanner This repository contains a scanner tool for CVE-2025-55182 , a critical Remote Code Execution RCE vulnerability in React Server Components RSC. ⚠️ Disclaimer This tool is for educational and authorized testing purposes only. Do not use this tool on systems you do not own or...

CVE-2026-93749 vulnerabilities

Vulnerabilities for packages: langfuse, rancher-api-ui, saf, nextcloud-server, jupyter-base-notebook, opensearch-dashboards, vitess...

GHSA-68FV-2MGG-JV7Q vulnerabilities

Vulnerabilities for packages: langfuse, rancher-api-ui, saf, nextcloud-server, jupyter-base-notebook, opensearch-dashboards, vitess...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

Apache Solr <=8.8.1 - Server-Side Request Forgery

Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on anothe...

VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...

Jellyfin <10.7.0 - Local File Inclusion

Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk. id: CVE-2021-21402 info: name: Jellyfin 10.7.0 - Local File Inclusion author: dwisiswant0 severity: medium...

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

Oracle E-Business Suite - Server-Side Request Forgery

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite component: Runtime UI. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. id:...

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

[SECURITY] Fedora 44 Update: httpd-2.4.69-1.fc44

The Apache HTTP Server is a powerful, efficient, and extensible web server...

[SECURITY] Fedora 44 Update: janus-1.4.2-1.fc44

Janus is an open source WebRTC server designed and developed by Meetecho...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...