CVE-2026-40003

CVE-2026-40003 aka Joselito is arbitrary memory write vulnerability found in the ZXIC/Sanechips ZX297520V3 SoC BootROM. !CAUTION This PoC has been published for research purposes only. You must NOT use this exploit for any malicious purposes. Do NOT use the exploit on devices you do not own or...

CVE-2026-7669-PoC

CVE-2026-7669 SGLang silently overrides trustremotecode=False to True and re-invokes AutoTokenizer.frompretrained whenever transformers v5 returns a TokenizersBackend object. A model with a custom tokenizerclass and an automap pointing at tokenizer.py reaches arbitrary code execution inside the...

CVE-2026-26336-PoC

CVE-2026-26336 — Alfresco Share Unauthenticated File Read Overview Alfresco Share exposes a /share/page/resource/ endpoint used to serve static resources. In vulnerable versions, this endpoint does not properly restrict path traversal, allowing an unauthenticated attacker to read arbitrary files...

CVE-2026-58073-check

Veeam Service Provider Console Agent Impersonation — Patch-State Detection Script A safe, unauthenticated detector for the KB4893 vulnerabilities in Veeam Service Provider Console published 2026-08-04. It answers one question per target, before any authentication or TLS: are the KB4893 fixes...

CVE-2025-63298

CVE-2025-63298 A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/managewebsite.php component. An authenticated user with administrative privileges can leverage this flaw by submitting a specially crafted POST request, enabling...

CVE-2026-21440

CVE-2026-21440 Advanced detection-only PoC for CVE-2026-21440 affecting AdonisJS BodyParser. No exploitation included. CVE-2026-21440 – AdonisJS Advanced Detection PoC Description This project provides an advanced detection-only Proof of Concept PoC for CVE-2026-21440 , a critical Path Traversal ...

Pluck-CMS-Stored-XSS---Installation

Pluck CMS 4.7.18 Stored XSS Author: Sergio Description: Multiple Cross-Site Scripting XSS vulnerabilities in installation of PluckCMS v.4.7.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the cont1 and cont2 parameters in the installation process- Website...

CVE-2026-82335 IBM Guardium Data Protection Buffer Overflow

IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of servic...

EUVD-2026-95247

IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of servic...

CVE-2026-82335

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are vulnerable to a heap-based buffer overflow within the Sniffer component 's MongoDB protocol parser. A remote attacker can exploit this by sending a specially crafted MongoDB SCRAM username with an excessive length, leading to memory c...

EUVD-2026-95246

IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial o...

CVE-2026-82344

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are vulnerable to a heap-based buffer overflow within the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can exploit this by sending crafted TDS login fragments that exceed the fixed-size reassembl...

CVE-2026-82344 IBM Guardium Data Protection Buffer Overflow

IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial o...

CVE-2026-84271 IBM Guardium Data Protection Signature Verification Bypass

IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges...

EUVD-2026-95240

IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges...

EUVD-2026-95239

IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters...

CVE-2026-84272 IBM Guardium Data Protection Missing Authentication

IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters...

CVE-2026-84272

IBM Guardium Data Protection versions 12.1 and 12.2.2 are vulnerable to a missing authentication flaw in the edge-controller component. An unauthenticated remote attacker can exploit this to execute arbitrary container images and seize control of managed edge clusters . No specific exploitation d...

EUVD-2026-95235

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector...

CVE-2026-84275

IBM Guardium Data Protection 12.2 is vulnerable to a path traversal flaw within the GIM file-upload functionality . This vulnerability allows an unauthenticated attacker to perform a traversal attack to write arbitrary files to the Collector . No specific remediation information or exploit detail...