Exploit for CVE-2026-98432

cve-2026-98432-audit !CVEhttps://img.shields.io/badge/CVE-...

CVE-2026-2441-PoC

CVE-2026-2441 — Chrome CSSFontFeatureValuesMap Use-After-Free CVSS 8.8 High | Actively Exploited in the Wild | Renderer RCE Sandboxed A use-after-free vulnerability in Google Chrome's Blink CSS engine that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted...

red-clippy

Red Clippy Your agent tests. Red Clippy keeps the record. Open-source pentest management built to be operated by an AI agent. Connect it to Claude Code over MCP and it runs the engagement alongside you: scope and assets, recon observations, methodology coverage, and findings with CVSS and evidenc...

Advisory ROSA-SA-2026-3324

Software: ruby3.2 OS: ROSA-CHROME Affected versions: = ruby3.2-3.2.10-3 Unaffected versions: ruby3.2-3.2.10-3 CVE-ID: CVE-2026-110264, CVE-2026-93577, CVE-2026-97229 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: Allows an unauthenticated user to execute arbitrary code on the server CVE-STATUS:...

halo-2.25.4-backup-write-CVE-2026-67920

Halo CMS Backup Restore Arbitrary File Write Vulnerability Summary A critical arbitrary file write vulnerability exists in the backup restoration functionality of Halo CMS versions up to 2.25.4. The restoreWorkdir method in MigrationServiceImpl.java copies the workdir/ directory from a...

openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)

A flaw was found in OpenJDK's Java Generic Security Services JGSS component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code within a sandboxed Java environment. Successful exploitation results in unauthorized information disclosure...

openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)

A flaw was found in OpenJDK's Java Generic Security Services JGSS component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code within a sandboxed Java environment. Successful exploitation results in unauthorized information disclosure...

patch-CVE-2026-09881

Patch: CVE-2026-09881 Vulnerability Details CVE : CVE-2026-09881 Product : Atlassian Confluence Description : Template injection RCE Severity : High Patch Status: DEPLOYED Field| Value ---|--- Patch Date| 2026-04-01 Status| deployed Deployed To| Production Validated By| SecOps Team References NVD...

CVE-2026-116402

The Brainstorm Force SureForms WordPress plugin (versions

EUVD-2026-112917

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9...

CVE-2026-116402 WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9...

librsvg: Use-after-free when XML includes have duplicated entities

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions Xincludes with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attack...

CVE-2026-4800-POC

CVE-2026-4800-POC Security Advisory https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc POC const = require'lodash'; Object.prototype.imports = 'x=process.getBuiltinModule"childprocess".execSync"curl https://example.com"':undefined .template'', ; Flow Using a prior prototype...

CVE-2026-25961-SumatraPDF-3.5.0---3.5.2-RCE

SumatraPDF Insecure Update PoC CVE-2026-25961 – Remote Code Execution via Malicious Update Server Author: Mohammed Idrees Banyamer Date: February 2026 CVE: CVE-2026-25961 GHSA: GHSA-xpm2-rr5m-x96q CVSS v3.1: 7.5 High AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected versions: SumatraPDF 3.5.0 – 3.5.2...

cve-2026-25676

CVE-2026-25676 Research DLL Search Path Hijacking in M-Track Duo HD Installer Overview This repository contains initial research and a proof-of-concept related to CVE-2026-25676, a DLL search path hijacking vulnerability affecting the installer of M-Track Duo HD 1.0.0. The goal of this project is...

CVE-2026-42231

GHSA-q5f4-99jv-pgg5 — n8n XML Webhook Prototype Pollution → RCE CVE: CVE-2026-42231 Severity: Critical CVSS 10.0 Affected: n8n element. xml2js 0.6.2 uses Object.defineProperty with a data descriptor to set element keys on parsed objects. Because 'proto' in obj is always true, assignOrPush wraps t...

CVE-2026-48202

The WordPress Brave plugin (brave-popup-builder) versions up to and including 0.8.8 is vulnerable to an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability. This flaw allows for Code Injection due to insufficient sanitization of input. No specific exploit l...

EUVD-2026-112915

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8...

CVE-2026-48202 WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8...

CVE-2026-6960

CVE-2026-6960 — BookingPress Pro ≤ 5.6 | Unauthenticated Arbitrary File Upload Research by: Atomic Edge Severity: Critical | CVSS: 9.8 | Auth Required: None ⚠️ v2 — Technical corrections applied based on community feedback. See Changelog for details. Overview A critical unauthenticated arbitrary...