CVE-2026-70376

CVE-2026-70376 — Pluck CMS Site-wide CSRF → RCE Fail-open Referer check + no CSRF tokens + double-extension upload A single admin page-visit deletes content, injects pages, and drops a webshell At a glance · Summary · Root cause · Attack chain · Exploit · Remediation · Timeline 📋 At a glance |...

CVE-2026-68138

CVE-2026-68138 — Linux kernel net/sched qdisc rate-table UAF tracking site Source for the CVE-2026-68138 patch-status tracker: a single-page site recording which distributions have shipped a fix for the net/sched qdisc rate-table use-after-free / double-free in the Linux kernel. Where the facts...

CVE-2026-25243-debugfree

CVE-2026-25243 — DEBUG-free Redis RCE private Reliable remote code execution from a single crafted RESTORE on jemalloc Redis — noDEBUG command, no /proc, no gdb, no ROP, ASLR on. Runs the attacker's command as the redis process root in default images. 🔒 Private repository — authorized security...

CVE-2026-23918

CVE-2026-23918: Apache HTTP/2 Double-Free DoS CVE-2026-23918 | Apache HTTP Server 2.4.66 | CWE-415: Double Free | CVSS 8.8 | Fixed in 2.4.67 A double-free vulnerability in modhttp2 h2mplx.c allows remote attackers to cause a denial of service worker crash via rapid RSTSTREAM frames that trigger a...

CVE-2026-19794

CVE-2026-19794 WP-Stats = 2.56 - Unauthenticated Stored Cross-Site Scripting Plugin URL https://wordpress.org/plugins/wp-stats/ Description Unauthenticated reflected XSS in the statsauthor GET parameter of statspage. The sanitization filter striptags is applied before urldecode, allowing an...

CVE-2026-58480

CVE-2026-58480 — Blocksy Companion Pro Unauthenticated File Upload RCE Advanced Reviews → saveattachments → Custom Fonts strpos Bypass → shell.woff2.php Overview CVE-2026-58480 also tracked as CVE-2026-15158 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in Blocksy...

CVE-2026-25243

CVE-2026-25243 — Redis RESTORE double-free → remote code execution Verified against Rocky Linux 8.10, aarch64, Redis 8.6.2, jemalloc 5.3.0. Reference: https://www.zeroday.cloud/blog/redis-cve-2026-25243-deep-dive TLDR; Stable exploit, works against variety of OS distro and architecture. Executive...

CVE-2026-19264

CVE-2026-19264 - Unauthenticated Path Traversal to Full Instance Takeover in Postiz Author: Krithik Babu P @DarkLycn1976 Published: 2026-08-10 CVE: CVE-2026-19264 Severity: Critical - CVSS 4.0 9.3 / CVSS 3.1 9.8 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory Affected:...

CVE-2026-23918

CVE-2026-23918 Apache modhttp2 Double-Free Detector https://github.com/user-attachments/assets/d6c30e58-548c-4b6d-9ba3-baa667238a58 python3 h2ghost.py -h usage: h2ghost.py -h --host HOST --port PORT --tls --no-tls --iterations ITERATIONS --burst-n BURSTN --timeout TIMEOUT --crash-threshold...

CVE-2021-31805-POC

CVE-2021-31805-POC Vulnerability Information Apache Struts is a free, open-source MVC framework for creating elegant, modern Java web applications. It favors convention over configuration, can be extended using a plugin architecture, and ships with plugins that support REST, AJAX, and JSON...

CVE-2026-31787

XSA-487 / CVE-2026-31787 Linux kernel double free in Xen privcmd driver A double free of kernel memory in the Linux kernel's Xen privcmd driver allows circumvention of kernel lockdown secure boot. Exploitation requires root-level access, which limits the broader security implications. | ---|---...

Important: Red Hat Security Advisory: xorg-x11-server security update

An update for xorg-x11-server is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling

A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension XKB geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a...

libxml2: double-free/UAF in libxml2 Python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

Important: Red Hat Security Advisory: libxml2 security update

An update for libxml2 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange DH-GEX client path. This occurs during FIPS Federal Information Processing Standards mode known-group validation when the client processes attacker-controlled DH-GEX...

libxml2: double-free/UAF in libxml2 Python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

CVE-2023-25136-PoC

CVE-2023-25136 Vulnerability Reproduction This project provides a minimal local experimental environment for reproducing the OpenSSH 9.1p1 pre-authentication double free memory corruption vulnerability CVE-2023-25136 and observing the server process crash DoS effect. Note: Official and mainstream...

Apache Struts2 S2-062 - Remote Code Execution

Apache Struts2 S2-062 is vulnerable to remote code execution. The fix issued for CVE-2020-17530 S2-061 was incomplete, meaning some of the tag's attributes could still perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. id: CVE-2021-31805 info: name...

Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read

Atlassian products including Jira, Confluence, and Bitbucket Data Center contain a pre-authentication arbitrary file read vulnerability in the shared atlassian-plugins-webresource library. The library improperly handles double colons :: as path separators in the resource routing, allowing...