Exploit for CVE-2026-109618

🍉 php2shell — CVE-2026-109618 / CVE-2026-109619 Pre-auth re...

Exploit for CVE-2026-109618

Php2Shell-POC Pre-auth remote code execution & reverse shel...

CVE-2026-92208

NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2026-92209

NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

DEBIAN-CVE-2026-92183

GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

CVE-2026-92183

GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

CVE-2026-92202

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target mus...

CVE-2026-114126

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. ...

CVE-2026-114125

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

DEBIAN-CVE-2026-111183

GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

CVE-2026-111183

GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

Exploit for CVE-2026-109618

PHP Vulnerability Exposure Scanner An interactive Bash utilit...

EUVD-2026-107474

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled...

Exploit for CVE-2026-109618

php2shell-check for Claude A passive check for Claude whether...

Exploit for CVE-2026-109618

php2shell-check A passive check for Claude whether a website...

CVE-2026-113870 Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with t...

EUVD-2026-107468

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with t...

CVE-2026-113870

MongoDB Compass is vulnerable to arbitrary code execution due to improper escaping of certain BSON values when converting a stored view’s aggregation pipeline into an editable source. An attacker can trigger this by providing a specially crafted view within a MongoDB deployment. If a user connect...

CVE-2026-114113

A flaw was found in sharp. The library includes a bundled version of libvips affected by multiple vulnerabilities within its GIF, TIFF, and VIPS image decoders. An attacker can exploit this by supplying a specially crafted image file to an application processing untrusted input, which may lead to...

CVE-2026-114112

A flaw was found in sharp. An attacker can exploit this vulnerability by submitting specially crafted AV1 Image File Format AVIF or High-Efficiency Image File Format HEIF images to applications processing untrusted media. Due to memory corruption during image decoding in a bundled library,...