CVE-2026-90008

A flaw was found in the Linux kernel's megaraidsas component. The megasasmakeprpnvme function, which constructs a list of memory pages for data transfers, fails to verify the allocated buffer's boundaries. This can result in a buffer overrun, potentially leading to a system crash Denial of Servic...

CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

CVE-2026-106109

The Quasar Framework 's @quasar/app-vite component (versions 1.0.0 through 3.3.0) contains a vulnerability where it recursively removes the build.distDir before building. The root cause is a lack of validation to reject sensitive paths such as the project root, user home directory, filesystem roo...

Nextjs_Exploit_Tool

Next.js RSC RCE Exploit Tool CVE-2025-55182 Project Introduction CVE-2025-55182 is a high-severity vulnerability in Next.js's Server Component RSC processing chain. An attacker can craft special multipart/form-data requests and forged RSC response chunks to induce the server to execute arbitrary...

dovecot: Dovecot: MySQL multi-byte escaping wrong

A flaw was found in Dovecot. A remote attacker with high attack complexity could exploit this vulnerability to gain access to sensitive information and modify data without requiring any user interaction or privileges...

CVE-2026-105865

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

CVE-2014-160

CVE-2014-160 exploit Use like this: ./cve-2014-160 dvwa.local https && strings datadump.bin...

CVE-2024-24919

RU Это демонстрационный скрипт PoC для проверки уязвимости CVE-2024-24919. Скрипт предназначен для отправки HTTP POST запросов на указанные URL-адреса и анализа ответов на предмет возможных проблем безопасности, таких как несанкционированный доступ или утечка конфиденциальных данных. Скрипт...

siphondns

SiphonDNS A PoC for techniques described in this research. Implements data exfiltration via non-standard sections of DNS. Server: $ ./siphondns-server -method ecs Starting DNS server cmd id Command received Receiving data...

CVE-2022-22965

Spring4ShellCVE-2022-22965 Spring Framework RCE via Data Binding on JDK 9+ / spring4shell / CVE-2022-22965 Spring4ShellCVE-2022-22965 Exploit Demo https://user-images.githubusercontent.com/57348147/161458377-44ab2f76-f947-4599-aa0a-92cbaac819f8.mp4 Build docker pull me2nuk/cves:2022-22965 docker...

Vulnerability handling in Atlassian Data Center products

The vulnerability exists in several products within the Atlassian Data Center platform, including Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. The vulnerability is an Arbitrary File Access issue, allowing unauthorized attackers to access...

CVE-2026-105865 Payload: Incomplete validation during the upload file lifecycle

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

CVE-2026-105865 Payload: Incomplete validation during the upload file lifecycle

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

CVE-2026-105865

The Payload headless content management system is vulnerable to a path traversal issue in versions before 3.90.0 and canary versions before 4.0.0-canary.34 . An authenticated user with permissions to update or delete locally stored uploads can trigger a file cleanup process that removes unintende...

CVE-2026-105865 Payload: Incomplete validation during the upload file lifecycle

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

cve-2025-1323

cve-2025-1323 WP-Recall Plugin SQL Injection ⚠️ Legal Disclaimer This tool is intended for authorized security testing and educational use only. Do not use against systems without explicit permission. Misuse may be illegal. ✅ Requirements Python 3.x requests module Install dependencies: pip instal...

FBI Removes Accenture Contractor Over ShinyHunters Job Site Data Breach

The FBI removed a contractor over a ShinyHunters-linked breach. Reuters sources identified Accenture and an unpatched Oracle PeopleSoft system...

CVE-2026-105861 Payload external upload trust validation issue

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...

aisecplus-week01-danielossai

🔐 AISec Plus — Week 1: Map the Threat Researcher: Daniel Ossai Repo: aisecplus-week01-danielossai Submitted: Week 1 · AISec Plus Bootcamp 📌 Incident Name & Date EchoLeak CVE-2025-32711 Discovered: January 2025 · Disclosed: June 2025 · Patched: June 2025 📝 What Happened Researchers at Aim Security...

cacti-rce-cve-2022-46169-vulnerable-application

Cacti v1.2.22 внедрение команд CVE-2022-46169 уязвимое приложение Это уязвимое приложение для тестирования эксплойта уязвимости Cacti CVE-2022-46169. ПРЕДУПРЕЖДЕНИЕ! Это приложение содержит серьезные уязвимости безопасности. Запускайте его на свой страх и риск! Рекомендуется использовать резервну...