CVE-2026-1657

CVE-2026-1657: Unauthenticated Arbitrary File Upload in EventPrime Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit systems without...

Malicious code in @celestial-community/baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17438 Malicious code in @celestial-community/baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

CVE-2022-28590

CVE-2022-28590 The original discovery and manual PoC is from tuando243: A Remote Code Execution RCE vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=installtheme. This PoC uploads a simple webshell for further remote code execution. This exploit expects from the server that...

Magento-CVE-2016-4010

Analysis and Exploitation of Magento Unauthenticated Remote Code Execution Vulnerability CVE-2016-4010 0x00 Preface On May 17, foreign security researcher Netanel Rubin publicly disclosed an unauthenticated remote code execution vulnerability in Magento CVE-2016-4010. This vulnerability actually...

CVE-2024-9570_D-Link-DIR-619L-bof

CVE-2024-9570D-Link-DIR-619L-bof Exploit for CVE-2024-9570 A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formEasySetTimezone of the file /goform/formEasySetTimezone. The manipulation of the argument curTime leads to buffer...

CVE-2026-111237

A vulnerability exists in Ultralytics FastSAM (up to commit b4ed20c2fed75eadc5aa7d8b09fedd137b873b52) within the AutoBackend Model Loading component. Specifically, the function session.get_modelmeta.custom_metadata_map in ultralytics/nn/autobackend.py is susceptible to an eval injection (CWE-95, ...

CVE-2026-111237 Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection

A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.getmodelmeta.custommetadatamap of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument...

EUVD-2026-102551

A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.getmodelmeta.custommetadatamap of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument...

FullBypass

FullBypass A tool which bypasses AMSI AntiMalware Scan Interface and PowerShell CLM Constrained Language Mode and gives you a FullLanguage PowerShell reverse shell. P.S Please do not use in unethical hacking and follow all rules and regulations of laws Usage: First, Download the bypass.csproj fil...

octopus

Octopus Huge thanks to QuoScient for having sponsored this project. Octopus is a security analysis framework for WebAssembly module and Blockchain Smart Contract. The purpose of Octopus is to provide an easy way to analyze closed-source WebAssembly module and smart contracts bytecode to understan...

CVE-2023-46012

CVE-2023-46012 LINKSYS AC1900 EA7500v3 IGD UPnP Stack Buffer Overflow Remote Code Execution Vulnerability This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of LINKSYS EA7500 routers. Authentication is not required to exploit this vulnerabilit...

EUVD-2026-102550

A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.getmodelmeta.custommetadatamap of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the...

CVE-2026-111212

A security flaw exists in ImprintLab Medical-SAM-Adapter versions 0.1.0-alpha and 0.1.0 . The vulnerability is located within the AutoBackend Model Loading component, specifically in the session.get_modelmeta.custom_metadata_map function of the file models/MobileSAMv2/ultralytics/nn/autobackend.p...

CVE-2026-111212 ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection

A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.getmodelmeta.custommetadatamap of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the...

CVE-2026-111212 ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection

A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.getmodelmeta.custommetadatamap of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the...

gsscred-move-uaf

GSSCred-move-uaf The com.apple.GSSCred XPC service, which runs as root on macOS and iOS, does not properly implement the "move" command, leading to a use-after-free condition in the doMove function. The GSSCred service can be reached from within the default application sandbox on iOS. This progra...

Vulnerable-to-Debian-OpenSSL-bug-CVE-2008-0166

Search for BTC coins on earlier versions of Bitcoin Core with critical vulnerability OpenSSL 0.9.8 CVE-2008-0166 In this article, we will create a tool that will generate Bitcoin Addresses P2PKH using the CVE-2008-0166 vulnerability. This is a research project to find BTC coins on earlier version...

GoRedOps

GoRedOps Telegram: https://t.me/ebytelabs GoRedOps is a collection of Golang projects designed specifically for red teamers and offensive security operations. This repository provides various tools and techniques essential for penetration testing, exploitation, and security research. Table of...

retrokit

retro-kit – reverse engineering old games headless Ghidra A toolkit for decompiling 32-bit games from roughly 1993–2010 with headless Ghidra: DOS LE/LX DOS/4GW, DOS/32A, PMODE/W, CauseWay, DOS/4G bind; also OS/2 LX and VxD built with Watcom C/C++ – with its own LE/LX loader for Ghidra and Watcom...