CVE-2026-60004-gitea-0day

CVE-2026-60004 - Gitea = 1.27.0 Pre-Auth RCE This is a proof-of-concept exploit for CVE-2026-60004, a critical remote code execution vulnerability in Gitea versions 1.17 through 1.27.0. The script automates the full exploitation chain, from user registration to establishing a stable, interactive...

revng

The rev.ng binary analysis framework and decompiler Welcome to the rev.ng project! rev.ng is an open source binary analysis framework based on LLVM and QEMU. It features a full-fledged decompiler. It's developed by rev.ng Labs in the open. Getting started Head to the online documentation to get...

CVE-2026-3030-Prototype-Pollution-in-JSON-Merge-Patch

CVE-2026-3030 – Prototype Pollution in JSON Merge Patch Program Code Node.js // server.js - Vulnerable REST API with deep merge const express = require'express'; const app = express; app.useexpress.json; let config = role: 'user', settings: ; // Insecure deep merge function pollutable via proto...

CVE-2026-60004

CVE-2026-60004 — Gitea diffpatch RCE Remote code execution PoC for the Gitea diffpatch endpoint. An account with write access to a repository on instances with open registration, simply registering an account suffices can execute arbitrary shell commands on the server as the Gitea service account...

CVE-2020-8158

CVE-2020-8158: TypeORM Prototype Pollution Vulnerability Overview This is a proof-of-concept demonstrating CVE-2020-8158, a critical prototype pollution vulnerability in TypeORM versions = 0.2.25 package.json - Dependencies Setup Instructions See SETUP.md for detailed setup and exploitation...

CVE-2020-8554

Create Kubernetes cluster kind create cluster --config ./kind.yaml The cluster must have certmanager: https://cert-manager.io/docs/installation/kubernetes/ Test vulnerability kubectl apply -f - 'EOF' apiVersion: v1 kind: Namespace metadata: name: kubeproxy-mitm --- apiVersion: apps/v1 kind:...

CVE-2026-23416-POC

CVE-2026-23416 — PoC mm/mseal: update VMA end correctly on merge Vulnerability discovered by Antonius / Blue Dragon Security Overview Field| Detail ---|--- CVE ID| CVE-2026-23416 Subsystem| mm/mseal — mm/vma.c Affected| Linux kernel 6.17 through 7.0-rc5 Fixed in| Linux 7.0-rc6, stable backports...

SealSecurity_Exam

SealSecurityExam Prototype pollution is a JavaScript vulnerability that enables an attacker to add arbitrary properties to global object prototypes, which may then be inherited by user-defined objects. A prototype pollution source is any user-controllable input that enables you to add arbitrary...

CVE-2026-71204-PoC

CVE-2026-71204 — changedetection.io: Omitted Checkbox in /settings Save Silently Disables API Key Enforcement Product: dgtlmoon/changedetection.io — v0.55.7 Files: changedetectionio/blueprint/settings/init.py, changedetectionio/forms.py CWE: CWE-284 — Improper Access Control CVSS 3.1:...

CVE-2026-92680

CVE-2026-92680 Proof of Concept Araxis Merge for Windows stores server credentials with DPAPI with pOptionalEntropy set to NULL. This allows any code running in the same user context to decrypt them. Full writeup: https://grepstrength.com/research/araxis-merge | ---|--- CVE| CVE-2026-92680 CWE|...

CVE-2026-103442

CVE-2026-103442: CentralAuth MergeAccount object injection Reporter: Marco Paciaroni BomboBombone. CentralAuth accepted a browser-supplied merge-session key when decoding migration state. A user with the centralauth-merge right could substitute a key that produced a PHP object graph. The report's...

merge-authz-test

merge-authz-test authz test CVE-2026-1999 siblings...

Exploit for OS Command Injection in N8N

CVE-2026-85168 — n8n Git node RCE via repository-local git con...

golismero

What's GoLismero? GoLismero is an open source framework for security testing. It's currently geared towards web security, but it can easily be expanded to other kinds of scans. The most interesting features of the framework are: Real platform independence. Tested on Windows, Linux, BSD and OS X. ...

EUVD-2026-107678

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access...

CVE-2026-14288

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access...

CVE-2026-14288

GitLab EE is affected by a vulnerability where improper access control during approval rule synchronization could allow an authenticated user to bypass required merge request approval policies on a protected branch. This issue, categorized under CWE-706 , impacts versions 17.4 before 19.3.6 , 19....

CVE-2026-14288 Use of Incorrectly-Resolved Name or Reference in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access...

CVE-2026-105711 Use of Cache Containing Sensitive Information in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could...

CVE-2026-105711

GitLab CE/EE versions 15.0 to 19.3.6, 19.4 to 19.4.3, and 19.5 to 19.5.1 are vulnerable to a use of cache containing sensitive information (CWE-524). The root cause is a viewer-independent fragment cache key that incorrectly shares per-user-redacted rendered content across all users. This allows ...