CVE-2026-2441-PoC

CVE-2026-2441 — Chrome CSSFontFeatureValuesMap Use-After-Free CVSS 8.8 High | Actively Exploited in the Wild | Renderer RCE Sandboxed A use-after-free vulnerability in Google Chrome's Blink CSS engine that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted...

CVE-2026-21509

CVE-2026-21509 — Microsoft Office OLE Security-Feature Bypass Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here for an actively exploited vulnerability. A security-feature bypass in Microsoft Office that lets a crafted document load COM...

CVE-2026-20131-POC

CVE-2026-20131---Cisco-SD-WAN-Preauth-RCE Cisco SD-WAN Zero-Day CVE-2026-20131 Exploited Since 2023 for Admin Access. This repository contains a working proof-of-concept exploit for CVE-2026-20131, a critical pre-authentication vulnerability in Cisco Catalyst SD-WAN Controller formerly vSmart and...

CVE-2026-0300

PAN-OS CVE-2026-0300 Non-Destructive Exposure Survey Tool Overview This tool is a non-destructive exposure survey utility for assessing whether a target PAN-OS service may expose network-accessible surfaces related to CVE-2026-0300. The tool is intended for authorized defensive security validatio...

CVE-2025-59287-When-your-patch-server-becomes-the-attack-vector

CVE-2025-59287 — 当你的补丁服务器成为攻击载体时 🗿 TL;DR: 微软已修补了 Windows Server Update Services WSUS 中的一个严重未认证远程代码执行 RCE 漏洞，该漏洞已在野外被积极利用。问题源于对攻击者控制数据的不安全反序列化 ，允许远程实现 SYSTEM 级入侵。这个漏洞本质上将你的更新服务器——本应保护你网络安全的工具——变成了针对网络的潜在武器。请立即修补，或在修补前隔离 WSUS。 发生了什么（通俗解释） WSUS 是许多企业环境中分发 Windows...

Blackash-CVE-2025-61882

🛡️🚨 CVE‑2025‑61882 — Critical Pre‑Auth Remote Code Execution in Oracle E‑Business Suite EBS 🚨🛡️ Short summary: Critical pre‑auth remote code execution in Oracle E‑Business Suite EBS — affects 12.2.3 → 12.2.14, CVSS 9.8 , actively exploited in the wild ransom/ extortion activity reported...

CVE-2025-55182

📌 CVE-2025-55182 — React2Shell Crítica Ejecución Remota de Código RCE No Autenticada en React Server Components 📖 Resumen CVE-2025-55182, informalmente apodado React2Shell, es una vulnerabilidad crítica de ejecución remota de código RCE divulgada el 3 de diciembre de 2025 en React Server Componen...

CVE-2021-41773-Apache-RCE

CVE-2021-41773-Apache-RCE Apache HTTP Server 2.4.49 のパス正規化に対する変更に欠陥が見つかりました。攻撃者はパストラバーサル攻撃を利用して、Alias のようなディレクティブで設定されたディレクトリ外のファイルに URL をマッピングする可能性があります。これらのディレクトリ外のファイルが通常のデフォルト設定「require all denied」で保護されていない場合、リクエストは成功する可能性があります。さらに、これらのエイリアスパスで CGI...

CVE-2026-76461

⚡ CVE-2026-76461 - Critical SQL Injection...

CVE-2026-20127

🛡️ CVE-2026-20127 — Cisco Catalyst SD-WAN Authentication Bypass 📌 Overview CVE-2026-20127 is a critical authentication bypass vulnerability affecting Cisco Catalyst SD-WAN components, including controllers and management systems. A remote unauthenticated attacker can exploit improper authenticatio...

Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution

Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-76461 , carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of...

CVE-2023-35078

CVE-2023-35078 shodan dorks 公開ターゲットを見つけるには、以下の shodan dorks を使用できます。 http.favicon.hash:362091310 http.favicon.hash:545827989 path=/mifs 以下のコマンドを使用して、shodan API からデータをチェックスクリプトに適した形式に変換できます。 root@kitploit: jq -cr 'select.http.favicon.hash == 362091310 | if .ssl? then "https://" else "http://" end ...

SonicWall-SMA1000-Zero-Day-IoC-Check

SonicWall SMA1000 ゼロデイ IoC チェック 積極的に悪用されているSonicWall SMA 1000シリーズの脆弱性 CVE-2026-15409 および CVE-2026-15410 に関連する、選択された侵害指標に対する非公式のBashベースのログチェックです。 !CAUTION 独立したコミュニティプロジェクト: このリポジトリは、SonicWallやドイツ連邦情報セキュリティ庁（BSI）とは提携しておらず、承認、保守、または支援を受けていません。 !IMPORTANT...

CVE-2024-5274-Detection

CVE-2024-5274-Detection Guardian Code: A Script to Uncover CVE-2024-5274 Vulnerabilities CVE-2024-5274 Google Chrome Zero-Day Vulnerability Detection and Update Script Overview Google recently patched a fourth zero-day vulnerability in Chrome, known as CVE-2024-5274, which allows attackers to...

CVE-2023-29336

CVE-2023-29336 - Win32k Local Privilege Escalation - PoC Details have emerged about a now-patched actively exploited security flaw in Microsoft Windows that could be abused by a threat actor to gain elevated privileges on affected systems. The vulnerability, tracked as CVE-2023-29336, is rated 7....

CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild

Overview On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition CE and Enterprise Edition EE. The release addresses CVE-2026-85706, a critical path traversal vulnerability CWE-22 in the repository commits API with a CVSSv3.1 score of 10.0. According to GitLa...

CVE-2025-55182

CVE-2025-55182 — React2Shell Critical Remote Code Execution in React Server Components. Severity: CRITICAL | CVSS v3.1: 10.0 Maximum | Status: Actively Exploited What Is This? React2Shell is a critical security vulnerability in React Server Components RSC — a modern feature that lets React run...

mikrotrick-poc

MikroTrick 实验室 PoC — CVE-2026-67276（RouterOS SSH 公钥认证绕过） 仅供实验室使用。 仅可针对您自己拥有的 RouterOS 实例运行。 攻击非您拥有的设备属于犯罪行为（CFAA、波兰刑法第 267 条及相应法律）。 背景 CERT PL（2026-09-05）披露了六个 RouterOS 漏洞，这些漏洞在野外被积极利用，构成攻击链 “MikroTrick” （当 SSH 可被互联网访问时，可实现未认证的完全设备接管）。MikroTik 已于 2026-09-03 在 7.25beta3 / 7.24.2 / 7.23.4 / 6.49.21...

CVE-2025-64446

🛡️ CVE-2025-64446 - FortiWeb Critical Authentication Bypass & Path Traversal Critical unauthenticated vulnerability allowing remote attackers to create administrator accounts on FortiWeb devices. 📌 Overview CVE-2025-64446 is a severe relative path traversal vulnerability in the FortiWeb Web...

Blackash-CVE-2025-53770

🧠 CVE-2025-53770 : Critical SharePoint RCE Vulnerability Exploited via ViewState Forgery 📌 Vulnerability Overview Type : Remote Code Execution RCE CVSS Score : 9.8 Critical Component : Microsoft SharePoint Server on-prem Root Cause : Insecure deserialization of ViewState data using stolen ASP.NET...