CVE-2026-93518

A flaw was found in xorg-x11-server. Due to an integer truncation issue during memory allocation calculations within the X Keyboard Extension XKB, the server allocates an undersized buffer when resizing key types. An authenticated local client can exploit this vulnerability by sending specially...

CVE-2026-93517

A flaw was found in xorg-x11-server. The GLX OpenGL Extension to the X Window System interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially...

CVE-2024-45337

Proof of Concept exploit for CVE-2024-45337 This repository contains a proof of concept exploit for CVE-2024-45337. It can be used to wrap ssh when interacting with an SSH server which is implemented using golang.org/x/crypto = v0.30.0. while caching permissions in the...

NextJS-app-CVE-2025-55182

Next.js CVE-2025-55182 Proof of Concept This is a proof-of-concept Next.js application vulnerable to CVE-2025-55182 also known as "React2Shell", a critical Remote Code Execution RCE vulnerability in React Server Components. ⚠️ WARNING This application is intentionally vulnerable and should ONLY be...

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger vulnerability discovered by ? in WordPress Npm ghost versions = 1.18.0, 6.27.0...

ish

iSH A project to get a Linux shell running on iOS, using usermode x86 emulation and syscall translation. For the current status of the project, check the issues tab, and the commit logs. App Store page TestFlight beta Discord server Wiki with help and tutorials README中文 如若未能保持最新，请提交PR以更新 Hacking...

CVE-2026-107272

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

CVE-2026-107206

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

DEBIAN-CVE-2026-106574

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...

CVE-2026-106574

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...

DEBIAN-CVE-2026-106570

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is...

CVE-2026-106570

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is...

Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and...

Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty ar...

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Summary One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in...

NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server vulnerability discovered by ? in WordPress Npm quasar versions = 2.23.2...

EUVD-2026-94521

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

CVE-2021-4773

CVE-2021-4773 this is a practice example of how exploit vulnerability CVE-2021-4773 with a virtual machine for this tutorial you need the next virtual machine as kali linux virtual machine as ubuntu server install apache version 2.4.49 so lets started when you have 2 virtual machines running you...

CVE-2026-107272

Gophish versions through 0.12.1 are vulnerable to stored and reflected cross-site scripting (XSS) due to unescaped SMTP server error messages . An attacker who controls or intercepts a sending profile's SMTP server can inject malicious scripts. These scripts execute when administrators view campa...

EUVD-2026-94403

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...