r2s

React2Shell R2S - CVE-2025-55182 Testing Tool Advanced exploitation testing tool for CVE-2025-55182 vulnerability assessment Features • Installation • Usage • Testing Environment • Legal 📖 What is R2S? R2S React2Shell is a security testing tool designed to help security researchers, developers, a...

EUVD-2026-63392

Handlebars.java: Arbitrary file read in SpringTemplateLoader via URL-fragment suffix bypass...

EUVD-2026-64016

Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE...

GHSA-756X-9HF6-Q4H4 Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools

Summary An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs. When the tool is invoked, the runner imports and...

CVE-2026-33017

CVE-2026-33017 — Langflow Unauthenticated RCE HoGent CyberSecurity II — Network Pentesting & Exploitation NPE Academic year 2025–2026 Overview This repository contains a complete lab environment and exploitation demonstration of CVE-2026-33017 , a critical unauthenticated Remote Code Execution RC...

CTT-Mailpit-RCE-v1.0---Temporal-Resonance-Mail-Server-Takeover

🎯 CTT-Mailpit-Exploit: Perfect 11/10 Score Zero-Click Worm Transform a basic SMTP header injection CVE-2026-23829 into a perfect-scoring, self-propagating RCE worm using Convergent Time Theory. 📊 Score Transformation: 6.1 → 11.0/10 ⭐ Metric Original CVE-2026-23829 CTT-Enhanced Improvement CVSS...

CVE-2026-84888 RightNow-AI OpenFang tool_runner.rs shell_exec memory allocation

A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shellexec of the file crates/openfang-runtime/src/toolrunner.rs. This manipulation causes uncontrolled memory allocation. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-84888

RightNow-AI OpenFang up to version 0.6.9 contains a vulnerability in the shell_exec function within crates/openfang-runtime/src/tool_runner.rs. The flaw causes uncontrolled memory allocation , exploitable remotely with low privileges and no user interaction. The primary impact is low availability...

CVE-2026-84887 simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service

A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possibl...

CVE-2026-84887

A denial-of-service vulnerability exists in simular-ai Agent-S up to version 0.3.2 , located in the Model-generated GUI Action Execution Workflow component, specifically within the grounding.py file. The root cause is described as an "unknown functionality" manipulation leading to DoS . Remote ex...

marshalsec

Java Unmarshaller Security - Convirtiendo tus datos en ejecución de código Si has llegado aquí por Log4Shell/CVE-2021-44228, quizás quieras leer sobre los vectores de explotación y las versiones afectadas del runtime de Java: https://mbechler.github.io/2021/12/10/PSALog4ShellJNDIInjection/...

CVE-2026-84886 simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file guiagents/s1/utils/ocrserver.py of the component OCR HTTP API. Executing a manipulation of the argument imgbytes can lead to resource consumption. The attack may ...

CVE-2026-84886

A resource consumption vulnerability affects the OCR HTTP API component of simular-ai Agent-S versions up to 0.3.2. The flaw resides in the ImageData function within the file gui_agents/s1/utils/ocr_server.py, where manipulation of the img_bytes argument can exhaust system resources. The attack i...

CVE-2026-84885 simular-ai Agent-S CodeAgent code_agent.py denial of service

A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file codeagent.py of the component CodeAgent. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-84885

A denial of service vulnerability affects simular-ai Agent-S versions 0.3.1 and 0.3.2 , specifically within the CodeAgent component (file code_agent.py ). The exact function is described as unknown. The attack is launchable remotely with low complexity and requires low privileges, resulting in pa...

CVE-2026-84856

A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launc...

CVE-2026-84857

A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulation causes uncontrolled memory allocation. The attack can be initiated remotely. The exploit has been published and may be used. The vendor...

CVE-2026-84452

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...

AZL-99273 CVE-2026-78662 affecting package libcontainers-common 20240213-3

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

CVE-2026-23744

CVE-2026-23744 Exploit to MCPJam Inspector Install libraries with: pip install -r requirements.txt - use python CVE-2026-23744 --help to info MCPJam inspector is the local-first development platform for MCP servers. The Latest version Versions 1.4.2 and earlier are vulnerable to remote code...