Exploit for CVE-2026-63766

CVE-2026-63766 — GPT-SoVITS Unauthenticated OS Command Injecti...

Millions of cars could be tracked and unlocked by a hidden security flaw

A car alarm vendor's coding mistake has left millions of vehicles vulnerable to theft and location tracking. Thanks to the way dealers sell car alarms, many affected drivers don't even know they have one installed. The device is the KARR Security System, a Bluetooth-enabled aftermarket alarm buil...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2025-32432 Craft CMS PoC Single-target proof-of-concept...

Exploit for Incorrect Authorization in Canonical Ubuntu_Linux

CVE-2021-3493 — Ubuntu OverlayFS Local Privilege Escalation A...

Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

Cisco Talos has discovered a new Rust-based remote access trojan RAT we call "msaRAT" attributed to the Chaos ransomware group. The name is derived from the binding names found in the binary: "msaOpen," "msaClose," "msaError," and "msaMessage". msaRAT is implemented using the Tokio asynchronous...

Preview: Cisco Talos at Black Hat USA 2026

We're looking forward to having some great conversations with those of you heading to the desert for Hacker Summer Camp 2026. We have a presence within the Cisco and Splunk booth 2633 during Black Hat where you can chat to us about our latest threat research, incident response, and how Talos powe...

Google Adds Selfie Video Recovery for Users Locked Out of Their Accounts

Google on Thursday announced a new way for users to sign-in to their accounts by letting them take a selfie video. The selfie for sign-in, per the tech giant, is another option on top of existing recovery methods to log in to an account, including an email address or a phone number. The idea is t...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 Apache HTTP Server Exploit This repository con...

Exploit for CVE-2026-56121

CVE-2026-56121 — Feast Registry Unauthenticated RCE dill.load...

Exploit for CVE-2026-64600

cve-id Donate Support the maintenance of this project wit...

CVE-2026-16287

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0...

CVE-2026-16287

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0...

CVE-2026-16287 Root Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-update

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0...

EUVD-2026-47933

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0...

CVE-2026-16287 Root Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-update

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0...

CVE-2026-16287

CVE-2026-16287 affects Pardus-update (TÜBİTAK BİLGEM) with OS command injection via offline update. Affected: pardus-update versions before 0.7.0 (starting at 0.6.6). Root cause: improper neutralization of special OS command elements. Impact: high for confidentiality, integrity, and availability;...

Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access

Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management MDSM products, including a critical flaw that has come under active exploitation in the wild. The security flaw, tracked as CVE-2026-16232 CVSS score: 9.3, is an...

Exploit for Deserialization of Untrusted Data in Lfprojects Mlflow

🚀 SmartHire - Hack The Box Writeup A...

http-bait

http-bait An HTTP honeypot that measures exploitation, no...

Apache Tika < 1.1.8 - Header Command Injection

Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. i...