CVE-2024-25082

⚠️ CVE-2024-25082 - FontForge ZIP Remote Code Execution PoC Proof-of-Concept exploit for CVE-2024-25082 , a vulnerability affecting FontForge that allows Remote Code Execution RCE through a crafted ZIP archive. This repository demonstrates how the vulnerability can be exploited in a controlled lab...

CVE-2024-50379

Apache Tomcat CVE-2024-50379 TOCTOU Remote Code Execution...

Popcorn-TJNULL-OSCP-

HackTheBox: Popcorn Write-up Date: June 05, 2026 Difficulty: Easy Platform: HackTheBox Key Techniques: Port & Service Enumeration, Directory Fuzzing Gobuster, File Upload Evasion, HTTP Request Manipulation Burp Suite, Remote Code Execution RCE, Advanced TTY Shell Stabilization Python, Local...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094

Taskcluster, a task execution framework used by Mozilla, is vulnerable to unauthenticated remote code execution (RCE) in versions prior to 100.3.0 . The vulnerability exists in the web-server component when an anonymous role is present that exposes the GraphQL endpoint . Specifically, the applica...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

EUVD-2026-90205

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-102489

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions...

Security Bulletin: Vulnerabilities in Netty, Spring Boot, ACE, jackson-core might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Spring Boot, ACE, jackson-core. Vulnerabilities include A single TCP connection can create hundreds of thousands of long-lived stream objects, A remote peer could send frames that would result in the...

Security Bulletin: Vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer. Vulnerabilities include a crafted Host header that is only a superstring match for a configured host+path key can still route a...

CVE-2020-17533

Recently, a remote code execution vulnerability was discovered in Apache Struts2 CVE ID: CVE-2020-17530. The Apache Struts2 framework is a web framework for developing Java EE web applications. It is widely used, thus the threat impact scope is large. 2. Vulnerability Description If developers...

Samsung-CVE-2025-21042

🔐 CVE-2025-21042 — Samsung Image Codec Remote Code Execution ⚙️ What it is A critical vulnerability in Samsung’s image-processing library libimagecodec.quram.so — used on Galaxy Android devices. 🧩 It’s an out-of-bounds write flaw triggered when parsing malicious image files like DNG. 📸 A crafted...

CVE-2024-6387-POC

Exploiting OpenSSH Vulnerability CVE-2024-6387 🚀 A Python script designed to exploit a remote code execution RCE vulnerability in OpenSSH CVE-2024-6387. This vulnerability involves a condition in the handler that can lead to arbitrary code execution, allowing an attacker to gain root access. This...

Security Bulletin: Vulnerabilities in Angular,Netty,snakeYAML,Next.js might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Angular,Netty,snakeYAML,Next.js. Vulnerabilities include high-severity information disclosure vulnerability, allowing attackers to find hash collisions, uncontrolled resource consumption which lead to a Denial...

CVE-2026-47527

A flaw was found in the NVIDIA GPU display driver. An authenticated local attacker with high privileges can trigger an out-of-bounds read vulnerability in the device firmware. Successful exploitation may lead to arbitrary code execution, denial of service DoS, privilege escalation, or unauthorize...

CVE-2026-47515

A flaw was found in the NVIDIA GPU display driver. A local user with elevated privileges can trigger an unbounded string operation within the kernel mode layer, causing an out-of-bounds memory read. Successful exploitation could allow the attacker to execute arbitrary code, escalate privileges,...

CVE-2026-47582

A flaw was found in the NVIDIA GPU Display Driver for Windows kernel module. A local attacker with basic user privileges can trigger an out-of-bounds write vulnerability in the driver. A successful exploit could allow the attacker to achieve arbitrary code execution, escalate privileges, tamper...

CVE-2026-47537

A flaw was found in the NVIDIA GPU display driver. An out-of-bounds write vulnerability in the kernel mode layer allows a local privileged attacker to corrupt system memory. Successful exploitation can lead to arbitrary code execution, privilege escalation, or a Denial of Service DoS, as well as...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — CodeIgniter 4 Validation Rule Injection CVE-2023-32692 is a code injection vulnerability in the CodeIgniter 4 PHP framework, affecting versions 4.0.0 through 4.3.4. It was fixed in 4.3.5 released June 2023. This is a demo environment for anyone that wants to play with it...

CVE-2024-0692-SolarWinds-SEM-RCE

CVE-2024-0692-SolarWinds-SEM-RCE Based on my research during a penetration test, see the details here https://www.sprocketsecurity.com/blog/cve-2024-0692-building-the-exploit-that-didnt-exist...