CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

CVE-2026-39023

CVE-2026-39023 PoC RCE - RESPONSIVE filemanager v.9.14.0 dernière version – non corrigé Projet Github : https://github.com/trippo/ResponsiveFilemanager Prérequis : Aucun prérequis, cet exploit est non authentifié. L'application Responsive Filemanager est un outil de gestion de fichiers basé sur l...

CVE-2026-22356

CVE-2026-22356: Jetpack CRM 경로 탐색 취약점 및 RCE 경고: 이 도구는 승인된 테스트 환경에서만 사용해야 합니다. 불법적인 사용에 대한 모든 책임은 사용자에게 있습니다. 📥 요구 사항 root@kitploit: pip3 install requests urllib3 $ python3 exploit.py https://example.com --rce --cmd "id" + Target is VULNERABLE to LFI! Attempting Log Poisoning for RCE... Searching...

cve-2022-36804

CVE-2022-36804 Bitbucket PoC 이 저장소에는 Atlassian Bitbucket Server/Data Center 취약점 CVE-2022-36804를 위한 Python 익스플로잇 스크립트가 포함되어 있습니다. 이 문제는 Git 아카이브 흐름에서 발생하는 명령 삽입 결함으로, 조작된 prefix 매개변수가 서버에 의해 해석되어 셸 명령으로 실행될 수 있습니다. CVE-2022-36804란 무엇인가? CVE-2022-36804는 Bitbucket Server/Data Center 원격 명령 실행 취약점입니다....

UniBLEed

UniBLEed Unitree G1 RCE PoC & Scripts CVE-2026-76639 / CVE-2026-76640 technical details at boschko.ca/g1-ble-rce/ Use this repository only with robots, accounts, and networks you are authorized to test. The active chains can change the robot's WiFi configuration, stop or restart services, crash...

Explotacion-RCE-Pentesting-BlueKeep-CVE-2019-0708-

Эксплуатация уязвимости BlueKeep CVE-2019-0708 в контролируемой среде Учебный проект, посвящённый анализу, выполнению и решению проблем при эксплуатации уязвимости BlueKeep CVE-2019-0708 в службе RDP Windows Server 2008 R2, разработанный для дисциплины «Кибербезопасность» в Instituto Profesional...

mgo3-rce

MGO3 RCE Этот репозиторий содержит информацию о CVE-2026-19874. документация видеодемонстрация Хронология 2026-06-26: обнаружена уязвимость 2026-06-26: первый контакт с Konami 2026-07-01: уязвимость сообщена в Konami 2026-08-04: уязвимость была тихо исправлена Konami...

cve-2022-41352-zimbra-rce

В этом репозитории нет README...

CVE-2020-9496

CVE-2020-9496 - RCE Поскольку 2 запроса, связанных с xmlrpc, в webtools xmlrpc и ping не используют аутентификацию, они уязвимы для небезопасной десериализации. Эта проблема была сообщена команде безопасности Альваро Муньосом [email protected] из команды GitHub Security Lab. Эта уязвимость...

CVE-2026-4253-Scanner

CVE-2026-42530 — Safe-Check Scanner Scanner de masse non destructif pour la use-after-free NGINX HTTP/3 QUIC Inventoriez lesquels de vos hôtes sont exposés — sans jamais déclencher le bogue. ⚠️ Avertissement Cet outil est réservé aux tests de sécurité autorisés — votre propre infrastructure, ou de...

CVE-2026-19407

CVE-2026-19407 affects the Google Cloud Gemini Enterprise Agent Platform SDK for Python in versions prior to 1.166.1 . The vulnerability is a GCS Bucket Squatting flaw that allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft without requiring prior privileges ...

CVEs

CVE-2022-2992: Удаленное выполнение команд через импорт из Github Информация Описание: Это позволяет аутентифицированному пользователю добиться удаленного выполнения кода через конечную точку API импорта из GitHub. Затронутые версии: все версии с 11.10 до 15.1.6, 15.2–15.2.4, 15.3–15.3.2 Исправле...

CVE-2023-43364-Searchor-RCE-Exploit

CVE-2023-43364 – Эксплойт RCE для Searchor PoC Удаленное выполнение кода RCE через небезопасное использование eval в Searchor 2.4.2 Обзор Этот проект демонстрирует эксплуатацию CVE-2023-43364 — уязвимости удаленного выполнения кода RCE, затрагивающей Python-пакет Searchor 2.4.2. Проблема вызвана...

CVE-2026-91988 atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by...

CVE-2026-91988

atomic-agents-stack before 1.1.0 is vulnerable to remote code execution via its HTTP MCP server-registry backend (mcp_registry/http.py, function make_http_mcp_server_registry_backend_from_url). The factory accepts both http and https schemes; over cleartext http://, a network man-in-the-middle ca...

EUVD-2026-78659

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by...

CVE-2026-91964 FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in negosendnegotiationrequest when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written...

CVE-2026-91964 FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in negosendnegotiationrequest when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written...

EUVD-2026-78640

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in negosendnegotiationrequest when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written...

CVE-2026-91964

FreeRDP versions before 3.31.0 are affected by a heap-based buffer overflow in the nego_send_negotiation_request function. When a malicious RDP server sends a crafted Server Redirection PDU with an attacker-controlled LoadBalanceInfo field, the arbitrary-length data is written into a fixed 512-by...