Exploit for CVE-2026-52680

CVE-2026-52680 — Apache Kyuubi REST Batch Path-Traversal Arbit...

DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT

A new Russian loader-as-a-service LaaS codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager. "The first stage drops a...

Exploit for Incorrect Behavior Order in Github Copilot-Cli

Claude Code — git bare-repo / core.fsmonitor guard bypass P...

ubi-stage6-exploit-chain

Stage 6 - Ethical Hacking Advanced 2: Root the Box Assignm...

cmpunlocker

cmpunlocker Unlock tool for the NVIDIA CMP 170HX GA100 mini...

CVE-2026-18739

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

Exploit for CVE-2026-63223

CVE-2026-63223 — CodeIgniter 4 File Upload RCE Magic Bytes Bypas...

CVE-2026-18739

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

CVE-2026-18739 Popt-devel: popt-static: off-by-one in poptstuffargs

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

EUVD-2026-52577

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

CVE-2026-18739

The CVE concerns the popt library, specifically a vulnerability in the function poptStuffArgs . An off-by-one condition occurs when the function is called repeatedly by a host application or through deep alias nesting, which can corrupt internal program data. The description states this corruptio...

CVE-2026-18739

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

MAL-2026-11516 Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 127a096109f7b5b2bbedf7f6a9fc2e7baa706e93704ebd52615e744a9838fbc3 When installing the package or importing the module, code starts a background task collecting sensitive data, like sensitive environment variables, private key...

Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 127a096109f7b5b2bbedf7f6a9fc2e7baa706e93704ebd52615e744a9838fbc3 When installing the package or importing the module, code starts a background task collecting sensitive data, like sensitive environment variables, private key...

Exploit for Use After Free in Redis

🔥 CVE-2026-23479 – Redis UAF Proof of Concept !Licensehtt...

CVE-2026-14818

A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50W series firmware versions from V4.16 through V5.42 Patch 1,...

CVE-2026-8508

An improper authentication vulnerability in the "sociallogin.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an attacker on the WLAN to bypass captive portal authentication...

CVE-2026-6837

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

Exploit for CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell Rails Active Storage/libvips A...

CVE-2026-14818

CVE-2026-14818 describes a path traversal vulnerability in the CLI command used to execute configuration files on Zyxel devices. Affected firmware ranges include Zyxel ATP series (V4.32–V5.42 Patch 1), USG FLEX series (V4.50–V5.42 Patch 1), USG FLEX 50(W) series (V4.16–V5.42 Patch 1), and USG20(W...