CVE-2026-83959

Substance3D - Sampler (Adobe) is affected by a Heap-based Buffer Overflow (CWE-122) that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction —a victim must open a malicious file. The CVSS 3.1 base score is 7.8 (HIGH) with a local attack ...

CVE-2026-83959 Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)

Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-33017

CVE-2026-33017 — PoC неаутентифицированной RCE в Langflow Отказ от ответственности Данный репозиторий создан в исследовательских и образовательных целях в области безопасности. Используйте его только в изолированной лабораторной среде. Использование против несанкционированных систем является...

CVE-2026-21877

CVE-2026-21877 Лабораторная среда для CVE-2026-1357 1. Создание окружения sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone Link of Repo sudo chmod +x networkmonitor.py sudo docker compose up --build -d Firefox : http://localhost:5678 Для...

CVE-2026-58400 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

CVE-2026-58400

GeoNetwork, an open-source geospatial metadata catalog maintained under OSGeo, is vulnerable to remote code execution via its Saxon XSLT processor used to render formatters. The processor lacks FEATURE_SECURE_PROCESSING and has ALLOW_EXTERNAL_FUNCTIONS enabled, allowing any loaded stylesheet to i...

CVE-2026-58400 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

Project-CVE-2026-75604

Исследование безопасности обхода кэша Next.js на Windows Только оборонительные исследования безопасности и авторизованная проверка. Этот репозиторий касается CVE-2026-75604 — критической уязвимости, которая может позволить неаутентифицированное удалённое выполнение кода на некоторых развёртывания...

EUVD-2026-70526

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user...

CVE-2026-71963

Hermes Agent versions 0.18.2 through 0.21.0 are vulnerable to remote code execution via a crafted .git/config file in a malicious repository. The agent executes git status or git diff before trust prompts are presented to the user; by setting core.fsmonitor to an attacker-controlled command, an a...

CVE-2024-47176

CVE-2024-47176 CUPS用脆弱性スキャナー: CVE-2024-47176 CUPS脆弱性CVE-2024-47176のマススキャナーは、Common Unix Printing System（CUPS）を実行している複数のシステムにおいて、CVE-2024-47176の脆弱性の有無を検出するために設計された専用ツールです。この脆弱性は、CUPSにおいてリモートコード実行（RCE）を許すもので、ポート631上のInternet Printing...

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

Project-CVE-2026-33017

CVE-2026-33017 Langflow Script — Пояснение кода автор: Xer0TLabs x Persephrak Decentralized Syndicate Назначение этого документа Этот документ представляет собой высокоуровневое объяснение предоставленной Python-программы для анализа, реагирования на инциденты и защитного анализа. Он намеренно не...

Inject-PHP-to-JPG-Using-Jhead

Inject-PHP-to-JPG-Using-Jhead $ pkg install vim ou apt-get install vim $ pkg install jhead ou apt-get install jhead $ jhead -h pour l'aide $ jhead -purejpg yourfiles.jpg $ jhead -ce yourfiles.jpg Appuyez sur ESC, tapez :x pour enregistrer $ jhead yourfiles.jpg Exemple :...

CVE-2025-10041

CVE-2025-10041 Flex QR Code Generator = 1.2.5 - Téléchargement arbitraire de fichiers sans authentification 🚨 Flex QR Code Generator ≤ 1.2.5 - Téléchargement arbitraire de fichiers sans authentification 📝 Description Le plugin Flex QR Code Generator pour WordPress est vulnérable au téléchargement...

selenium-node-takeover-kit

Exploits Metasploit Ce projet a été déplacé. Pour obtenir la dernière version, faites un pull depuis https://codeberg.org/JonStratton/selenium-node-takeover-kit Ceci combine certains des exemples ci-dessous pour téléverser des fichiers vers, télécharger des fichiers depuis, et exécuter du code su...

CVE-2025-12737

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

CVE-2026-6071

A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a...

EUVD-2026-70466

A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a...

CVE-2026-6071

Rockwell Automation Arena® is affected by a remote code execution vulnerability caused by an out-of-bounds write when parsing DOE files . An attacker can craft a malicious DOE file that, when opened by a legitimate user, writes past the end of an allocated object and executes code within the cont...