CVE-2026-67401

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

Exploits

Exploits A selection of rebuilt and from scratch exploits. Some are existing ones remade for practice, others are self-discovered with CVEs...

next-16.2.4-pocs

Next.js v16.2.4 Security PoC Collection This repository collects reverse-engineered proof-of-concept material for the security issues fixed in Next.js v16.2.5. The root of the repo holds the release-window analysis, and poc/ holds one PoC bundle per advisory. This collection was reverse-engineere...

PoC-CVEs

PoC || GTFO Proof of Concepts of vulnerabilities...

CVE-2026-26012

CVE-2026-26012 — Vaultwarden Cipher Enumeration PoC Full Cipher Enumeration Ignoring Organization Collection Permissions A proof-of-concept exploit for CVE-2026-26012, a broken access control vulnerability in Vaultwarden = 1.35.2 that allows any organization member to retrieve and decrypt all...

Exploits

Exploits Some Exploits I've written...

Exploits

This repository contains a personal collection of Windows CVE I have turned in to exploit source, as well as a collection of payloads I've written to be used in conjunction with these exploits. Some of these CVE have been joined together in exploit chains for RCE, sandbox escapes and privilege...

pentaho-exploits

Exploits relating to https://research.aurainfosec.io/pentest/pentah0wnage Note: Some things might not work Thanks to my employer Aura Information Security for providing time for me to work on this project...

PT-2026-104021

Name of the Vulnerable Software and Affected Versions EasyIO FS32 versions prior to 3.3b63 Description An On-Chip Debug Interface issue in Johnson Controls EasyIO FS32 allows the collection of data from common resource locations, leading to information disclosure. Recommendations Update EasyIO FS...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2024_6682)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20246682 advisory. firefox: 115.15/128.2 ESR mozilla: Type confusion when looking up a property name in a with block CVE-2024-8381 mozilla: Internal event interfaces were...

Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2024_6681)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20246681 advisory. firefox: 115.15/128.2 ESR mozilla: Type confusion when looking up a property name in a with block CVE-2024-8381 mozilla: Internal event interfaces were...

CVE-2026-34493: On-Chip Debug and Test Interface With Improper Access Control

On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affects EasyIO FS32: before 3.3b63...

Linux Distros Unpatched Vulnerability : CVE-2026-103048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - URL redirection to untrusted site 'open redirect' vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data. Thi...

CLEANSTART-2026-WL91519 flaw was found in Ansible Collection community

Security vulnerability affects the ansible package. A flaw was found in Ansible Collection community...

Security Bulletin: Storage Virtualize Ansible Collection is VEX affected by a vulnerability in the crypography package

Summary Storage Virtualize Ansible Collection uses the cryptography package to establish secure communications with managed systems. Due to CVE-2026-34073, certificate validation performed by the cryptography package may incorrectly trust certificates in certain DNS name constraint scenarios...

CVE-2026-103443

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Collection Book extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection Book extension: 1.46, 1.45, and 1.43...

CVE-2026-103443

The MediaWiki Collection (Book) extension by The Wikimedia Foundation is vulnerable to a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This issue allows for XSS Targeting Non-Script Elements . The vulnerability specifically affects versions 1.46, 1.45, and 1....

CVE-2026-103443 API permits session-seeded javascript URL XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Collection Book extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection Book extension: 1.46, 1.45, and 1.43...

EUVD-2026-90079

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Collection Book extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection Book extension: 1.46, 1.45, and 1.43...

CVE-2026-103443 API permits session-seeded javascript URL XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Collection Book extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection Book extension: 1.46, 1.45, and 1.43...