Exploit for CVE-2026-109618

php2shell — CVE-2026-109618 / CVE-2026-109619 Research Indepe...

Exploit for CVE-2026-109618

php2shell-check !statushttps://img.shields.io/badge/status...

Exploit for CVE-2026-109618

php-rfc1867-guard For PHP 5.4 to 8.1, which get no official f...

Exploit for CVE-2026-109618

PHP session.uploadprogress vulnerability: PoC and validatio...

php2shell

PHP2Shell Research & assessment tool for CVE-2026-109618...

Exploit for CVE-2026-109618

php2shell-lab — CVE-2026-109618 / CVE-2026-109619 lab ⚠️ LO...

Exploit for CVE-2026-109618

php2shell-guard Defensive toolkit for php2shell CVE-2026...

Exploit for CVE-2026-109618

php2shell — CVE-2026-109618 / CVE-2026-109619 Research Indepe...

Exploit for CVE-2026-109618

phpup-2026 IOCs and detection rules for CVE-2026-109618 /...

Exploit for CVE-2026-109618

php-uploadprogress-waf Defensive detection rules for the repo...

CVE-2026-114093

Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session,...

CVE-2026-114082

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114093 Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint

Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session,...

CVE-2026-114093

Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session,...

CVE-2026-114093 Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint

Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session,...

EUVD-2026-106896

Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session,...

CVE-2026-114093

Versions of Trigger.dev prior to 4.5.6 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability involving the GET-based /logout endpoint . A remote attacker can trick an authenticated user into clicking an obfuscated, URL-encoded link, which triggers an automatic logout. This action re...

EUVD-2026-106885

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114082

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114082 Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...