CVE-2026-59827

CVE-2026-59827: Metabase Unsafe Deserialization in H2 Native Queries Severity: Critical CVSS 9.9 CVE: CVE-2026-59827 Advisory: GHSA-w95f-x9v9-wv36 Reporter: Matheus Gutierre @Gutierre0x80 Published: June 30, 2026 Vulnerability Summary An authenticated user with access to native SQL queries on an ...

openclaw-vuln-report

OpenClaw Vulnerability Analysis Report Chinese Interpretation of Security Vulnerability CVE-2026-25253 Read Online GitHub Pages: https://joseph19820124.github.io/openclaw-vuln-report/ Vulnerability Summary CVE : CVE-2026-25253 Score : CVSS 8.8 High Type : Cross-Site WebSocket Hijacking Impact :...

WordPress-Flex-QR-Code-Generator---CVE-2025-10041

CVE-2025-10041: Arbitrary File Upload Vulnerability Analysis in the Flex QR Code Generator Plugin 1. Vulnerability Overview Plugin Name : Flex QR Code Generator Affected Versions : ≤ 1.2.5 all versions Vulnerability Type : Arbitrary File Upload → Remote Code Execution RCE Exploitation Conditions ...

React2Shell

React2Shell – Advanced Discovery & Exploitation Framework An advanced React Server Components RSC vulnerability scanner and exploiter for CVE-2025-55182 and CVE-2025-66478 affecting Next.js applications. This tool expands upon the original React2Shell research and proof-of-concept by introducing...

CVE-2026-4631-cockpit-RCE

CVE-2026-4631 — Code Analysis Cockpit: Unauthenticated Remote Code Execution via SSH Command-Line Argument Injection...

0vercl0k

0vercl0k PoC for CVE-2021-28476 a guest-to-host "Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys...

CVE-2026-36340

CVE-2026-36340 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 CVE: CVE-2026-36340 Severity: Critical Affected Product: Krayin CRM v2.1.5 Vulnerability Type: Remote Code Execution RCE Authentication Required: Yes Summary A...

CVE-2025-55182-React2Shell

React2Shell React2Shell is a proof-of-concept PoC exploit demonstrating a CRITICAL remote code execution RCE vulnerability in modern web frameworks using React Server Components RSC. This PoC targets CVE-2025-55182 , a CVSS 10.0 vulnerability that allows to execute arbitrary system commands via...

CVE-2021-44228

CVE-2021-44228 Log4j2 Component Command Execution RCE Code By: Junsheng @Orange Cyber Security Lab Orange Cyber Security Lab https://0range.team/ 0x00 Risk Overview This tool is for authorized security testing only. Unauthorized attacks on illegal sites are prohibited. Read online 《Cybersecurity...

ESPOCRM-RCE-POC-CVE-2026-33656

EspoCRM = 9.3.3 CVE-2026-33656 — Authenticated RCE via Formula ACL Bypass + Attachment sourceId Path Traversal + .htaccess Poisoning Author : Jiva jivasecurity.com Writeup : https://jivasecurity.com/writeups/espocrm-rce-cve-2026-33656 Product : EspoCRM = 9.3.3 Auth : Admin credentials required...

CVE-2023-46805

19/01/2024 Update Updated with the latest info based on Assetnote's blog. Now three checks are executed before a status is shown, this also to better detect older versions of Avanti Blogs with analysis of the CVE: https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis...

CVE-2025-60595

CVE-2025-60595 SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution. This is the public refrence to be used on CVE site Arbitary code execution on the product owned by SPH Engineering. UGCS 5.13.0! Ardupilot/mavparse.py direct lines being Lines 230 "243: on the sph engineering...

CVE-2026-22812-OpenCode-RCE-exp

CVE-2026-22812-OpenCode-RCE-exp Usage: java -jar xxx.jar Recommended environment: jdk8...

cve-2025-3248

CVE-2025-3248 Langflow RCE Scanner A Python tool for scanning and exploiting the CVE-2025-3248 vulnerability, which allows remote code execution RCE in Langflow applications. Features Single-target scanning and command execution Batch URL scanning Interactive shell mode Multi-threaded batch...

CVE-2026-33439-PoC

CVE-2026-33439 — OpenAM Pre-Auth RCE Echo Mode Command output directly in the HTTP response — no DNS exfiltration or OOB needed. Uses com.iplanet.jato.RequestManager.getRequestContext to access the active JATO ThreadLocal request/response during deserialization. Works on Java 21+ where classic...

CVE-2026-0770-PoC

CVE-2026-0770 - Langflow Remote Code Execution Summary Langflow contains a critical remote code execution vulnerability in the validatecode function located in src/lfx/src/lfx/custom/validate.py. The function uses exec to execute user-supplied Python code without sandboxing, allowing arbitrary...

CVE-2026-23830-SandBreak

SandBreak CVE-2026-23830 Exploit Generator & Auto-Pwn Tool SandBreak is a robust, Go-based exploit generator designed to leverage the SandboxJS Escape vulnerability CVE-2026-23830. This tool exploits the unprotected AsyncFunction constructor in older versions of sandboxjs, allowing attackers to...

CVE-2026-24061-telnet2root

CVE-2026-24061 Vulnerability Scanner & Exploit 👨‍💻 Author: Furkan KAYAPINAR @FurkanKAYAPINAR Overview This repository contains a vulnerability scanner and an interactive exploit for CVE-2026-24061. This vulnerability affects inetutils-telnetd and potentially other Telnet implementations through...

CVE-2025-59287

CVE-2025-59287 WSUS CVE-2025-59287 – XML Deserialization RCE Reverse Shell A focused PoC to exploit WSUS CVE-2025-59287 via XML deserialization to achieve a Windows reverse shell. This script only supports a reverse shell payload no calc fallback. Target: Windows Server with WSUS role Technique:...

cve-2024-7965-poc

cve-2024-7965-poc CVE-2024-7965 is a high-severity vulnerability in the V8 JavaScript engine of the Google Chrome browser. The vulnerability stems from improper implementation in the V8 engine when handling specific JavaScript code, leading to heap memory corruption. An attacker could exploit thi...