EUVD-2026-102188

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.p...

CVE-2026-57569 Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.p...

CVE-2026-57569 Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.p...

CVE-2026-57569 Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.p...

CVE-2026-14669

CVE-2026-14669 - PostgreSQL tochar Timezone Abbreviation Heap Buffer Overflow PostgreSQL tochar function has a heap buffer overflow vulnerability when handling timezone formatting. By setting an overly long POSIX timezone abbreviation, an attacker can trigger an out-of-bounds write to a fixed...

cve-2026-13934

CVE-2026-13934 This is the work project repository. Investigation, analysis, work, and reports are handled in one repo D088/D091. This file is the repository/board entry document. For the full folder and artifact conventions, see docs/conventions.md. The body status, conclusions, links is updated...

poc-cve-collection

poc-cve-collection Poc CVE Collection 🧪 Collects CVE PoCs and backs them up to the Internet Archive when they are unavailable on GitHub. Donate Support the maintenance of this project with PayPal or by scanning the QR code below. Example CVE-2026-31431 Title crypto: algifaead - Revert to operatin...

CVE-2026-41940-Security-Patch

CVE-2026-41940-Security-Patch Unofficial temporary patch for the CVE-2026-41940 vulnerability Can be used for temporary defense Please upgrade to the official release as soon as conditions permit cPanel Security Announcement:...

actions-secrets

SecureStack Secrets Analysis GitHub Action A GitHub Action that analyses your source code for secrets, credentials, API keys, server and database hostnames/URLS, and a lot more! When you add this to GitHub Actions we will analyze your source code to make sure there is no sensitive data in your...

CVE-2026-71518

CVE-2026-71518 — Typemill Unauthenticated Authorization Bypass Path-equivalent URL variants bypass role-restricted media downloads Restriction is keyed on the raw request path; the file is read from the OS-resolved path — the two disagree At a glance · Summary · Root cause · Attack chain · Exploi...

CVE-2026-60004-gitea-0day

CVE-2026-60004 - Gitea = 1.27.0 Pre-Auth RCE This is a proof-of-concept exploit for CVE-2026-60004, a critical remote code execution vulnerability in Gitea versions 1.17 through 1.27.0. The script automates the full exploitation chain, from user registration to establishing a stable, interactive...

cve-2026-69243-poc-aiohttp-smuggling

CVE-2026-69243 — aiohttp Request Smuggling CWE-444 Request smuggling via rejected WebSocket upgrade in aiohttp Or build the Rust version zero dependencies, std only: git clone https://github.com/JVBotelho/cve-2026-69243-poc-aiohttp-smuggling cd cve-2026-69243-poc-aiohttp-smuggling/poc cargo build...

CVE-2026-70481

CVE-2026-70481 Open WebUI, affected 0.5.0 through 0.10.2, patched in 0.11.0. Moderate, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 and CWE-862. In backend/openwebui/routers/channels.py the message update and delete handlers branch on the channel type, and the two branches ask...

CVE-2026-17566

CVE-2026-17566 — pgAdmin 4 Import/Export Data RCE PoC A remote code execution PoC for the pgAdmin 4 Import/Export Data tool. It exploits the divergence in backslash escaping semantics between the isqueryparensbalanced parenthesis checker and psql to inject \copy ... TO PROGRAM and execute arbitra...

EUVD-2026-102187

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...

CVE-2026-57568 Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...

CVE-2026-57568

The photo-management tool Lychee is vulnerable to Stored XSS in versions prior to 7.6.0 . The root cause is that config/markdown.php enables allow_unsafe_links, allowing authenticated users with album-edit permissions to store javascript: URIs in photo or album Markdown descriptions. These descri...

CVE-2026-57568 Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...

CVE-2026-57568 Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...

CVE-2026-60004

CVE-2026-60004 — Gitea diffpatch RCE Remote code execution PoC for the Gitea diffpatch endpoint. An account with write access to a repository on instances with open registration, simply registering an account suffices can execute arbitrary shell commands on the server as the Gitea service account...