CVE-2026-9645-ScadaBR-Analysis

CVE-2026-9645 — ScadaBR Vulnerability Analysis Technical vulnerability analysis and CVE briefing for CVE-2026-9645 , affecting the open-source ScadaBR SCADA/HMI platform. Overview CVE-2026-9645 is a critical authenticated remote code execution vulnerability in ScadaBR. According to the prepared...

CVE-2026-2005

CVE-2026-2005 — PostgreSQL pgcrypto Heap Buffer Overflow Target commit: 4b324845ba5d24682b9b3708a769f00d160afbd7 PostgreSQL 18.1 — vulnerable Summary Field| Detail ---|--- CVE| CVE-2026-2005 Type| Heap buffer overflow Component| contrib/pgcrypto/pgp-pubdec.c — pgpparsepubencsesskey Impact| RCE as...

EUVD-2026-114458

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the Nova interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious .nv script through the shell permits a local user to execute code with kernel privileges witho...

CVE-2026-25253

CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw 1-Click Remote Code Execution PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e Description CVE-2026-25253 : OpenClaw Authentication Token Exfiltration Vulnerability description: OpenClaw aka clawdbo...

php-eol-cve-2026-109618-109619

CVE-2026-109618 / CVE-2026-109619 patches for end-of-life PHP 7.3 on EL7, 5.4 / 5.3 on Amazon Linux Unofficial backports of the PHP security team's minimal mitigation for the two critical, unauthenticated remote code execution vulnerabilities announced on 2026-10-21: CVE| Advisory| Summary...

CVE-2026-62853

The enterprise IoT platform ThingLinks is vulnerable to authenticated remote code execution (RCE) in versions prior to 1.4.0 . The vulnerability exists within the rule engine 's Groovy script test/register flow, where the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy scri...

CVE-2026-62853 ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed Groovy compilation and loading flow. An authenticated attacker can provide code that is compiled and instantiated on...

EUVD-2026-114455

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed Groovy compilation and loading flow. An authenticated attacker can provide code that is compiled and instantiated on...

CVE-2026-62853 ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed Groovy compilation and loading flow. An authenticated attacker can provide code that is compiled and instantiated on...

CVE-2026-21011-Log4j-style-JNDI-Injection-in-Custom-Logger-Simulated-

CVE-2026-21011 – Log4j‑style JNDI Injection in Custom Logger Simulated Program Code Java simulation in Python log4jsim.py - Custom logger that evaluates $... patterns import subprocess, re def logmessage: Vulnerable: looks up JNDI-like syntax and executes pattern = r'$\jndi:.+?' for match in...

CVE-2021-41773-Apache-Path-Traversal-Lab

Apache CVE-2021-41773 Security Lab A controlled cybersecurity lab developed during my internship at ITSOLERA PVT LTD to study and demonstrate CVE-2021-41773 , a path traversal and potential remote code execution vulnerability affecting Apache HTTP Server 2.4.49. 📌 Project Overview This project...

WordPress Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin <= 4.1.1 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Osman Hussein in WordPress Plugin WP Project Manager versions = 4.1.1...

CVE-2026-62847 Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary...

CVE-2026-62847 Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary...

CVE-2026-62847

The Metalama toolkit (specifically Metalama.Framework and Metalama.Tool ) is vulnerable to local code execution via DLL planting on Linux and macOS systems. The root cause is the use of predictable, world-writable temporary directories (via Path.GetTempPath()) to store and execute compile-time as...

CVE-2024-2961-XXE-Exploit

CVE-2024-2961 CNEXT XXE Channel Adaptation Exploit Script Adapts the PHP file-read - RCE exploit script from Ambionics' official cnext-exploits to the SVG upload + XXE arbitrary file read scenario PolarisCTF 2026 "Avatar Uploader" type challenges. Prerequisites Target: Linux + glibc update...

CVE-2026-62848

The Metalama Roslyn-based toolkit for C# contains an unsafe deserialization vulnerability in its Windows Visual Studio integration. The issue stems from the software's failure to restrict CLR types during the deserialization of local named-pipe messages between the devenv, out-of-process Roslyn c...

CVE-2026-62848

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. The pipe connects...

CVE-2026-62848 Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. The pipe connects...

CVE-2026-62848 Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. The pipe connects...