r2s

React2Shell R2S - CVE-2025-55182 Testing Tool Advanced exploitation testing tool for CVE-2025-55182 vulnerability assessment Features • Installation • Usage • Testing Environment • Legal 📖 What is R2S? R2S React2Shell is a security testing tool designed to help security researchers, developers, a...

CVE-2026-26831

CVE-2026-26831: OS command injection in textract Summary textract through version 2.5.0 allows OS command injection through the file path supplied to multiple extractors. Several code paths pass that file path into childprocess.exec with inadequate sanitization. An attacker who can influence the...

Blackash-CVE-2025-12762

🔐 CVE-2025-12762 — Critical RCE Vulnerability in pgAdmin 4 🚨 What’s the Issue? A Remote Code Execution RCE flaw exists in pgAdmin 4 versions ≤ 9.9. Attackers can run arbitrary commands on the host when pgAdmin is running in server mode and processes a PLAIN-format SQL dump during restore. ⚙️...

Ashwesker-CVE-2025-60021

🛑 CVE-2025-60021 — Apache bRPC Remote Command Injection 📌 Overview CVE-2025-60021 is a critical remote command injection vulnerability found in the heap profiler built-in service /pprof/heap of Apache bRPC versions earlier than 1.15.0 , allowing unauthenticated attackers to run arbitrary OS...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell PoC — CVE-2026-109619 This is a minimal proof of co...

CVE-2026-51992

CVE-2026-51992 Within ClickHouse, a feature exists that allows a user with the correct permissions to create dictionaries in order to interact with different databases and run specific queries on them. For PostgreSQL, SELECT queries are wrapped in a COPY QUERY TO STDOUT statement before being...

virtualenv Arbitrary Command Execution

The vulnerability of the tool for creating isolated virtual environments in Python virtualenv is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

activate.sh Arbitrary Command Execution

The vulnerability in the activate.sh script src/virtualenv/activation/bash/activate.sh, a tool for creating isolated virtual environments in Python virtualenv, is related to the failure to implement measures to neutralize special elements. Exploiting this vulnerability could allow an attacker to...

CVE-2026-102827

A flaw was found in simple-git. This vulnerability allows an attacker who can influence command arguments to achieve arbitrary command execution on the host system. The library's security filter checks for dangerous options using exact names but fails to account for Git accepting abbreviated...

CVE-2026-76524

A vulnerability in the Open Source Snort 3 control channel socket implementation allows an authenticated, local attacker with low privileges to achieve arbitrary command execution . The root cause is a lack of authentication when a local user connects to the Snort control channel socket. Successf...

CVE-2026-76524 Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability

A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the...

CVE-2026-104024

A flaw was found in PeaZip. The application relies on an incomplete list of restricted file extensions when prompting users before opening files directly from an archive on Windows. By convincing a user to open a specially crafted archive containing executable shortcut files, an attacker can...

CVE-2026-113776

A flaw was found in virtualenv. An attacker who can influence an environment's path or prompt setting can achieve arbitrary command execution when a user activates the virtual environment. This issue occurs because activation templates process substitution placeholders sequentially, allowing...

CVE-2026-70387

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork's and calls execl"/vendor/bin/sh", "sh", "-c", cmd, NULL with a caller-supplied command string. The only authorization check is...

CVE-2026-70387

This vulnerability exists in OnePlus OxygenOS on Android due to an Exposed Dangerous Method and Incorrect Authorization in the olc2 logging HAL . The HAL exposes a binder method that forks and executes a shell command (execl) using a caller-supplied string. The system only verifies that the calli...

CVE-2026-70387 OnePlus OxygenOS exposed dangerous method vulnerability

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork's and calls execl"/vendor/bin/sh", "sh", "-c", cmd, NULL with a caller-supplied command string. The only authorization check is...

EUVD-2026-107155

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork's and calls execl"/vendor/bin/sh", "sh", "-c", cmd, NULL with a caller-supplied command string. The only authorization check is...

Linux Distros Unpatched Vulnerability : CVE-2026-102827

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, th...

PT-2026-120514

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork's and calls execl"/vendor/bin/sh", "sh", "-c", cmd, NULL with a caller-supplied command string. The only authorization check is...

CVE-2026-112942

A flaw was found in launch-editor. This vulnerability can allow a remote attacker to achieve arbitrary command execution on Windows systems. By submitting a specially crafted file path containing line and column suffixes, an attacker can bypass file existence checks due to improper path validatio...