338 matches found
CVE-2024-38063
CVE-2024-38063 โ Windows IPv6 Stack Vulnerability Analysis & PoC -red Technical analysis and Proof-of-Concept PoC for CVE-2024-38063 , a critical Remote Code Execution RCE vulnerability in the Windows IPv6 stack tcpip.sys. Discovered by KunLun Lab, this issue is zero-click , meaning it can be...
CVE-2026-28858
โ ๏ธ CVE-2026-28858 โ Buffer Overflow in Apple iOS/iPadOS โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โ SEVERITY: CRITICAL โ CVSS: 9.8 โ CWE-120 โ REMOTE โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ A remote user can cause unexpected system termination or...
CTT-Mailpit-RCE-v1.0---Temporal-Resonance-Mail-Server-Takeover
๐ฏ CTT-Mailpit-Exploit: Perfect 11/10 Score Zero-Click Worm Transform a basic SMTP header injection CVE-2026-23829 into a perfect-scoring, self-propagating RCE worm using Convergent Time Theory. ๐ Score Transformation: 6.1 โ 11.0/10 โญ Metric Original CVE-2026-23829 CTT-Enhanced Improvement CVSS...
skeleton
Skeleton but pronounced like Peloton A Zero-Click RCE exploit for CVE-2021-0326 on the Peloton Bike And also every other unpatched Android Device PoC requires ASLR to be disabled. Associated blog post:...
SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298
SOC336 - Windows OLE Zero-Click RCE Exploitation Detected CVE-2025-21298 Walkthrough ๐ Table of Content 1. Situation 2. Alert Overview 3. Tools Used 4. Analysis Email Security Log Management Proxy Log Endpoint Security Terminal History Network Action Processes CVE-2025-21298 Playbook Analyst Note...
CVE-2021-46398_Chamilo-LMS-RCE
CVE-2021-46398 Chamilo-LMS 1.11.14 RCE Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker's profile page. One-Cli...
Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201
Glass Cage: Zero-Click PNG Exploit Chain for iOS 18.2.1 CVE-2025-43300: O.o.B Wrrite in ImageIO CVE-2025-24201: WebKit Remote Code Execution CVE-2025-24085: Core Media Privilege Escalation Patched: Jan-March 2025 Tested On: iPhone 14 Pro Max iOS 18.2.1 VirusTotal Analysis Verified Hash Summary...
CVE-2025-48593
CVE-2025-48593 "A single malicious packet can own your device." โ Android Security Team, Nov 2025 Zero-Click Remote Code Execution in Android System Bluetooth Subsystem โ ๏ธ Critical Scope Clarification Updated April 2026 Standard phones and tablets are NOT vulnerable. CVE-2025-48593 only affects...
CVE-2023-23397
CVE-2023-23397 Exploitation & Mitigation Demo ๐ Overview This project demonstrates the detection, exploitation, and mitigation of CVE-2023-23397 , a critical zero-click NTLM relay vulnerability in Microsoft Outlook for Windows. Exploited via calendar invites, this vulnerability allows attackers t...
CVE-2026-34159
CVE-2026-34159 0 Click RCE exploit for CVE-2026-34159 Lama.cpp RPC server version b8487 exploit was developed by Hassan Ali @Casp3r0x0 you can find the full write up at https://www.pwntricks.com/ZeroClick-RCE-CVE-2026-34159-llama.cpp...
Telegram-0-Click-RCE-SECURITY-VULNERABILITY-ANALYSIS-REPORT
๐ด Telegram 0-Click RCE Vulnerability Analysis Report ZDI-CAN-30207 | CVSS 9.8 CRITICAL | Unpatched as of 2026-03-30 Author: Dennis Kim @gameworkerkim Date: March 30, 2026 Contact: [email protected] ๐ Summary Badges 1. Vulnerability Overview Executive Summary This is a zero-click remote code...
paracosme
Paracosme - CVE-2022-33318 - Remote Code Execution in ICONICS Genesis64 Paracosme is a memory corruption exploit I wrote to target the Genesis64 suite v10.97.1 made by ICONICS to achieve remote code execution. The exploit was demonstrated during the Pwn2Own 2022 Miami contest that took place at t...
Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election
The iPhone of Vladan ฤokiฤ, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19. The finding came six days before Serbia's October 25 snap parliamentary...
CVE-2026-0073
๐ CVE-2026-0073: Android adbd Authentication Bypass Weaponized Proof of Concept for the Wireless ADB TLS Auth Bypass vulnerability. Discovered by Barghest, Weaponized PoC by devtint. ๐ Overview CVE-2026-0073 is a critical cryptographic logic failure in the Android Debug Bridge daemon adbd that...
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The hidden attack code ran the moment an ad loaded on...
โNightmare Scenarioโ: Zero-Click Spyware Is Infecting Phones via Targeted Ads
Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising...
EUVD-2026-100478
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is...
CVE-2026-63169
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is...
PT-2026-113377
Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0 Description A stored cross-site scripting issue exists that allows authenticated users to post messages containing attacker-controlled iframes via the messenger's HTMLPurifier SafeIframe branch...