CVE-2024-21532-PoC-ggit

CVE-2024-21532 Command Injection vulnerability in ggit ggit describes itself as: Local promise-returning git command wrappers Resources: Project's GitHub source code: https://github.com/bahmutov/ggit Project's npm package: https://www.npmjs.com/package/ggit Article write-up on this vulnerability:...

CVE-2026-0770-PoC

CVE-2026-0770 - Langflow Remote Code Execution Summary Langflow contains a critical remote code execution vulnerability in the validatecode function located in src/lfx/src/lfx/custom/validate.py. The function uses exec to execute user-supplied Python code without sandboxing, allowing arbitrary...

CVE-2026-33017

CVE-2026-33017 — Langflow Unauthenticated RCE HoGent CyberSecurity II — Network Pentesting & Exploitation NPE Academic year 2025–2026 Overview This repository contains a complete lab environment and exploitation demonstration of CVE-2026-33017 , a critical unauthenticated Remote Code Execution RC...

Linux kernel exec De Thread DoS

The vulnerability of the dethread function in the exec component of the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

cve-2026-33067

CVE-2026-33017 — Langflow Unauthenticated RCE Nuclei Template Nuclei template that detects CVE-2026-33017 — an unauthenticated remote-code-execution vulnerability in Langflow ≤ 1.8.2 reachable through the public flow-build endpoint: POST /api/v1/buildpublictmp/flowid/flow The vulnerable handler...

Letta-CVE-2025-51482-RCE

Letta-CVE-2025-51482-RCE Vulnerability Cause Analysis 1. Lack of Code Security Inspection Problem: The system does not perform any security inspection on user-provided source code. Evidence: generateexecutionscript method directly inserts user code into the execution script: code += "\n" +...

CVE-2026-113620

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role,...

EUVD-2026-104989

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role,...

CVE-2026-113620

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1 , a vulnerability exists where operator WebSocket upgrades on the exec and log routes fail to verify the bearer JWT . The system decodes the payload and uses the contained groups or roles as RBAC subjects . An attacker can provide a self-mi...

CVE-2026-113620 Eclipse ioFog operator WebSocket accepts an unverified JWT

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role,...

PoC-CVE-2026-33017

CVE-2026-33017: Unauthenticated RCE in Langflow References Official Tracking & Databases CVE-2026-33017 MITRE: https://vulners.com/cve/CVE-2026-33017 NV...

PT-2026-117937

Name of the Vulnerable Software and Affected Versions piflow versions 2.0.0 through 2.0.1 Description The DeepAgents chat agent contains a flaw allowing remote code execution. The 'POST /chat' and 'POST /chat/stream' endpoints lack authentication, enabling attackers to instruct the agent to call...

CVE-2019-5736-PoC

Usage PoC was created to the scenario were victim is executing for example docker exec sh. Before running exploit it's required to overwrite sh binary in the container file system: printf '!/proc/self/exe' /bin/sh After that, when victim executes exec command, runc binary in the host file system...

CVE-2019-16941

CVE-2019-16941 Proof-of-Concept: The vulnerability requires multiple and relatively improbable conditions in order to get triggered, fact that limits its exploitability. However, it takes little effort and understanding to prepare a payload given the fact that it can result into an arbitrary code...

Exploit for CVE-2026-98256

CVE-2026-98256 — Linux Kernel signal subsystem’s non-leader ex...

pfBlockerNg-CVE-2022-40624

pfBlockerNg-CVE-2022-40624 Background pfBlockerNG is the Next Generation of pfBlocker with the following features: 1. Manage IPv4/v6 List Sources into 'Deny, Permit or Match' formats. 2. GeoIP database by MaxMind Inc. GeoLite2 Free version. 3. De-Duplication, Suppression, and Reputation...

CVE-2018-7600

Proof-Of-Concept for CVE-2018-7600 / SA-CORE-2018-002 codebeat badge Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. H...

PT-2026-117009

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perf event exit task and perf pending task A race condition exists between perf event exit task and perf pending task during begin new exec. During begin new exec, perf event exit task may be called, and th...

Exploit for CVE-2026-64560

OPPO Find X10 Pro Max PMX110 / OP659FL1 · CVE-2026-64560 Res...

Linux Distros Unpatched Vulnerability : CVE-2026-102607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlle...