CVE-2026-105326

The CUPS service is vulnerable to an argument injection flaw within the mailto notifier. When email notifications are enabled, the CUPS scheduler processes printer subscription requests containing a notify-recipient-uri . Because the mailto notifier fails to sanitize the recipient address before ...

WordPress ACPT (Premium) plugin <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution vulnerability

Authenticated Subscriber+ Remote Code Execution vulnerability discovered by d.v4ns3c in WordPress Plugin ACPT Pro - Custom Post Types Plugin for WordPress versions = 2.0.66...

CVE-2026-20253

CVE-2026-20253 — Splunk Enterprise Pre-Auth RCE Lab Unauthenticated Arbitrary File Creation and Truncation via PostgreSQL Sidecar CVSS 9.8 · Critical · CWE-306 · Actively exploited CISA KEV ⚠️ Disclaimer This repository is intended strictly for educational and authorised security research purposes...

CVE-2026-6789-Stack-Buffer-Overflow-in-Embedded-TLS-Certificate-Parser

9. CVE-2026-6789 – Stack Buffer Overflow in Embedded TLS Certificate Parser Overview A popular lightweight TLS library simulated contains a stack buffer overflow when parsing X.509 certificate Subject Alternative Name extensions with a crafted length field. Severity: Critical RCE on IoT/Industria...

CVE-2026-47668

CVE-2026-47668 Unauthenticated RCE in DBGate = 7.1.8 REF1: https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc REF2: https://github.com/Nxploited/CVE-2026-47668 rce.py Minimal implementation of RCE on /runners/start, Privileged If process can write to ./public/ folder, file...

CVE-2026-88393

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...

CVE-2026-104890 Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklistedextensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An...

CVE-2026-88391

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

wp2shell-poc

wp2shell 💙 Support the Project If you appreciate my work, consider supporting the project via USDT TRC20: TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN WordPress Core Pre-Authentication RCE Chain wp2shell is a security research Proof-of-Concept demonstrating a pre-authentication vulnerability chain in...

Gitlab-CVE-2026-19478

CVE-2026-19478 — GitLab GraphQL @glintroduced Directive Injection Unauthenticated Remote Code Injection via GraphQL Directive in GitLab CE/EE — Delete Any Public Project With a Single HTTP Request A hands-on penetration testing lab that reproduces CVE-2026-19478, a critical CVSS 9.4 vulnerability...

CVE-2022-0185

CVE-2022-0185 This repo contains demo exploits for CVE-2022-0185. There are two versions here. The non-kctf version fuse version specifically targets Ubuntu with kernel version 5.11.0-44. It does not directly return a root shell, but makes /bin/bash suid, which will lead to trivial privilege...

Exploit for CVE-2026-105314

Papermerge-core: Authenticated Path Traversal to Arbitrary Fil...

wp2shell

CVE-2026-63030 + CVE-2026-60137 – „wp2shell“: Unauthenticatede RCE im WordPress-Core Batch-Routen-Verwirrung der REST-API CVE-2026-63030 verknüpft mit einer WPQuery-authornotin-SQL-Injection CVE-2026-60137 → Pre-Auth Remote Code Execution gegen eine Standard-WordPress-Installation. Entdeckt von...

phuip-fpizdam

PHuiP-FPizdaM Cos'è Questo è un exploit per un bug in php-fpm CVE-2019-11043. In alcune configurazioni nginx + php-fpm, il bug è possibile da innescare dall'esterno. Questo significa che un utente web potrebbe ottenere l'esecuzione di codice se hai una configurazione vulnerabile vedi sotto. Write...

Astra Linux – Vulnerability in Chromium

Improper input validation in the Media component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. Versions up to 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its...

Astra Linux – Vulnerability in Chromium

Before 151.0.7922.109, writing V8 code in Google Chrome allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

BIT-APACHE-2026-42356 Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-63277

LibreOffice Calc is vulnerable to Remote Code Execution (RCE) when opening a document that links a cell range to an external data source. An attacker can craft a document naming a Java database driver to be loaded from a remote location, causing the application to execute Java code from that sour...

CVE-2026-63277 RCE via calcext:data-mappings, sql provider and jdbc connector

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in...