CVE-2026-35868

A Command Injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library affects the LB-link Router AC2100_AZ3 V1.0.4 . The root cause is insufficient validation and sanitization of user-supplied input before it reaches a system-level command execution context. An attacker...

EUVD-2026-67122

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components...

EUVD-2026-67100

An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...

CVE-2026-37004

BerriAI litellm versions up to and including 1.82.4 are affected by a Server-Side Template Injection (SSTI) vulnerability. The root cause is the use of an unsandboxed jinja2.Environment in the /prompts/test endpoint, which allows unauthenticated remote attackers to execute arbitrary OS commands b...

CVE-2026-37006

gpt-researcher v0.14.7 and earlier contains a vulnerability in its WebSocket endpoint that allows an unauthenticated remote attacker to achieve remote code execution by supplying malicious Model Context Protocol (MCP) configurations. The root cause lies in how the WebSocket endpoint processes MCP...

PT-2026-82808

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-37007

FileWriterTool in crewai-tools (versions

PT-2026-82774

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedomete...

PT-2026-82754

Name of the Vulnerable Software and Affected Versions Redis versions prior to 8.2.9 Redis versions prior to 8.4.6 Redis versions prior to 8.6.6 Redis versions prior to 8.8.2 Redis versions prior to 8.10.1 Description A use-after-free issue exists in the tlsProcessPendingData function, which manag...

CVE-2026-26897

EcoOnline EHS for Android (com.airsweb.v10 v0.2.499) is vulnerable to a deep link validation bypass in its MainActivity. The app's ehs-app:// scheme handler performs a naive string replacement (ehs-app: → https:) and loads the result into the WebView without applying the host allow-list used on a...

CVE-2024-31666

Schwachstellenübersicht In Flusity-CMS v.2.33 existiert eine Schwachstelle, die es einem entfernten Angreifer ermöglicht, durch ein sorgfältig konstruiertes Skript in der Komponente editaddonpost.php beliebigen Code auszuführen. Betroffene Versionen Flusity-CMS v.2.33 Details zur Schwachstelle Ei...

CVE-2022-45701

CVE-2022-45701 Arris Router Firmware 9.1.103 - удаленное выполнение кода RCE аутентифицированный POC эксплойт...

copy_fail

copyfail अनुसंधान नोट्स CVE-2026-31431 English 简体中文 यह रिपॉजिटरी Linux copyfail भेद्यता जिसे CVE-2026-31431 के रूप में ट्रैक किया गया है का अध्ययन करने के लिए एक रक्षात्मक अनुसंधान कार्यक्षेत्र है। इस रिपॉजिटरी का उद्देश्य विश्लेषण नोट्स को संरक्षित करना, प्रभाव का दस्तावेजीकरण करना और सुरक्षित...

Tomcat_PUT_GUI_EXP

TomcatPUTEXPV1.4 Tomcat PUT विधि द्वारा मनमाना फ़ाइल लेखन CVE-2017-12615 ग्राफिकल भेद्यता शोषण उपकरण भेद्यता परिचय 2017 सितंबर 19 को, Apache Tomcat ने आधिकारिक तौर पर दो उच्च-जोखिम भेद्यताओं की पुष्टि और सुधार किया, भेद्यता CVE संख्या: CVE-2017-12615 और CVE-2017-12616, जिनमें से दूरस्थ कोड निष्पा...

CVE-2025-69604

CVE-2025-69604 Descrição Esta vulnerabilidade é semelhante à descrita em CVE-2025-61229 – um atacante pode editar o modelo de tarefa para fazer com que as tarefas de backup do SuperDuper instalem um pacote arbitrário. O pacote pode então executar scripts de shell como usuário root e com o mais al...

samsung-android-lpe

Parte 1: Esecuzione arbitraria di comandi AT CVE-2026-20980 I comandi dell'Application Processor AP sono gestiti da atdistributor dopo aver commutato la modalità di connessione su un dispositivo sbloccato utilizzando. root@kitploit: AT+SWATD=0 AT+ACTIVATE=0,0,0 AT+SWATD=1 atdistributor verifica i...

CVE-2025-55182-POC

CVE-2025-55182 Next.js RCE Scanner Ferramenta de varredura e exploração da CVE-2025-55182, voltada para a vulnerabilidade de execução remota de código em aplicações Next.js. Suporta detecção em lote, execução de comandos, injeção de memory shell do Godzilla e funcionalidade de reverse shell. ⚠️...

silph

SILPH: Coletor Furtivo de Senhas Locais em Memória SILPH é uma ferramenta de red team de código aberto projetada para despejar segredos LSA, hashes SAM e credenciais DCC2 inteiramente em memória, sem gravar nenhum arquivo em disco. Diferentemente do projeto upstream go-secdump , o SILPH é criado...

CVE-2025-47812-PoC

CVE-2025-47812 — Wing FTP Server Execução Remota de Código RCE Visão Geral...

CVE-2025-5548-POC

CVE-2025-5548-POC Descrizione della vulnerabilità CVE-2025-5548 è una vulnerabilità di tipo stack buffer overflow identificata in FreeFloat FTP Server, un servizio FTP legacy per sistemi Windows. Il difetto risiede nel gestore del comando NOOP, che non esegue la validazione della dimensione...