PT-2026-86933

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...

PT-2026-86916

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...

PT-2026-86760

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution...

TencentOS Server 4: bluez (TSSA-2026:0960)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0960 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-48593

CVE-2025-48593: Ejecución Remota de Código Zero-Click en el Sistema Android Autor: LAKSHMIKANTHAN K letchupkt Fecha: Noviembre 2025 Gravedad: Crítica Una vulnerabilidad crítica de ejecución remota de código zero-click que afecta a los dispositivos Android 13-16. Resumen de la Vulnerabilidad...

CVE-2025-53770

CVE-2025-53770 Este es un escáner para la vulnerabilidad de ejecución remota de código no autenticada en SharePoint, a la que se le asignó el número de CVE CVE-2025-53770. El código fue escrito mediante ingeniería inversa de un payload visto en estado salvaje. Úsalo bajo tu propio riesgo; no soy...

CVE-2026-33454

Inyección de Cabeceras en camel-mail → Reproducción de Vulnerabilidad RCE CVE-2026-33454 Este proyecto demuestra una vulnerabilidad de inyección de cabeceras de mensaje Camel en el componente camel-mail de Apache Camel, rastreada como CVE-2026-33454. Un atacante que pueda enviar un correo...

CVE-2026-4480

🚨 CVE-2026-4480 - Ejecución Remota de Código Crítica en el Subsistema de Impresión de Samba Ejecución Remota de Código RCE Vulnerabilidad de Inyección de Comandos de Impresión en Samba "Un nombre de trabajo de impresión nunca debería convertirse en un comando de shell." 📖 Resumen CVE-2026-4480 es...

CVE-2021-44228_Log4Shell

Demo Exploiting Log4Shell Vulnerability CVE-2021-44228 This project simulates an RCE attack scenario through the Log4Shell vulnerability in the Apache Log4j 2 library. Components 1. vulnerable-app : Spring Boot application using Log4j 2.14.1. 2. attacker : Contains malicious LDAP server marshalse...

magento2-session-reaper-patch

Parche de Session Reaper para Magento 2 para CVE-2025-54236 Parche para CVE-2025-54236 también conocido como Session Reaper que permite la apropiación de cuentas de clientes y RCE bajo ciertas condiciones. Este parche es en realidad una extensión de Magento 2 y es universalmente compatible con...

Samba-CVE-2007-2447-Exploit-Username-Map-Script

Samba CVE-2007-2447 Exploit Username Map Script Este repositorio contiene un script de Python diseñado para automatizar la explotación de la vulnerabilidad CVE-2007-2447 en servidores Samba versiones 3.0.20 a 3.0.25rc3. Esta herramienta ha sido desarrollada con fines exclusivamente educativos y...

Langflow AI - Unauthenticated Remote Code Execution

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. id: CVE-2025-3248 info: name: Langflow AI - Unauthenticated Remote Code Execution author: nvn172...

Adobe ColdFusion - Pre-Auth Remote Code Execution

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-29300 info:...

ConnectWise ScreenConnect <= 23.9.7 - Path Traversal

ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access. id: CVE-2024-1708 info: name: ConnectWise ScreenConnect = 23.9.7 - Path Traversal...

Adobe ColdFusion - Deserialization of Untrusted Data

Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...

Roundcube Webmail - Remote Code Execution

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. id: CVE-2025-49113 info: name: Roundcube Webmail - Remote...

DrayTek - Remote Code Execution

DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta devices allow remote code execution as root without authentication via shell metacharacters to the cgi-bin/mainfunction.cgi URI. id: CVE-2020-8515 info: name: DrayTek - Remote Code Execution...

Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

CraftCMS - Remote Code Execution

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity...

Apache ActiveMQ - Remote Code Execution

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...