nextjs-CVE-2025-55182

CVE-2025-55182 / CVE-2025-66478 React2Shell - Next.js Remote Code Execution RCE PoC Critical vulnerability in Next.js Server Actions allowing unauthenticated Remote Code Execution via React Flight Protocol deserialization Overview This repository contains a Proof of Concept PoC for the critical R...

ExploitScript-CVE-2023-46604

ExploitScript-CVE-2023-46604 Disclaimer This repository contains proof-of-concept code for CVE-2023-466064 and is intended strictly for educational purposes. The authors and contributors do not endorse any illegal activity. The information presented here is for academic, security research, and...

CVE-2026-102599

A flaw was found in engine.io. A remote attacker can cause a Denial of Service DoS by establishing a valid session and sending a transport upgrade request with a mismatched or omitted protocol revision parameter. This discrepancy causes the server to attach incompatible communication handlers,...

CVE-2026-96322

Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally...

CVE-2026-85926

Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized attacker to execute code over a network...

CVE-2026-85367

Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally...

CVE-2026-84015

Heap-based buffer overflow in Remote Access Point-to-Point Protocol PPP EAP-TLS allows an unauthorized attacker to execute code over a network...

CVE-2026-83861

Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally...

CVE-2026-83843

Out-of-bounds read in Windows Internet Key Exchange IKE Protocol allows an unauthorized attacker to deny service over a network...

CVE-2026-102198

Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network...

CVE-2026-102599 Socket.IO: Engine.IO Protocol Revision Mismatch DoS

Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious...

CVE-2026-102599

Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious...

CVE-2026-102198

An out-of-bounds read vulnerability exists in the Windows Remote Desktop Protocol , which allows an authorized attacker to disclose information over a network. The vulnerability is classified as CWE-125 and carries a medium severity score of 5.3 . While the documents confirm the existence of the ...

CVE-2026-96322

A Use after free vulnerability in the Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally . The vulnerability has a CVSS 3.1 base score of 7.0 (HIGH) . While specific affected versions and the exact component/file are not detailed in the provided documents,...

CVE-2026-88147

A heap-based buffer overflow exists in the Windows Secure Socket Tunneling Protocol (SSTP) . This vulnerability allows an authorized attacker to perform a local privilege escalation . The impact includes high levels of confidentiality, integrity, and availability loss as reported in the CVSS metr...

CVE-2026-83861

A heap-based buffer overflow exists in the Windows Remote Desktop Protocol . This vulnerability allows an authorized attacker to achieve local privilege escalation . No specific exploit details or remediation instructions are provided in the documents beyond the mention of an official fix .

CVE-2026-85926

A Use after free vulnerability exists in the Windows Secure Socket Tunneling Protocol (SSTP) . This flaw allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.1 (High) , with high impact across confidentiality, integrity, and availability. Docume...

CVE-2026-85367

A Use after free vulnerability exists in the Windows Cash Drawer Protocol Provider . This flaw allows an authorized attacker to achieve local privilege elevation . The vulnerability has a CVSS 3.1 base score of 7.0 (High) . Specific details regarding the underlying root cause, affected versions, ...

CVE-2026-84015

A heap-based buffer overflow exists in the Remote Access Point-to-Point Protocol (PPP) EAP-TLS component within Microsoft Windows . This vulnerability allows an unauthorized attacker to execute arbitrary code over a network. The impact is rated as CRITICAL with a CVSS score of 9.80 . No specific ...

http2-rst-stream-attacker

CVE-2023-44487 and http2-rst-stream-attacker CVE-2023-44487 CVE-2023-44487 is an exploit against the HTTP2 protocol itself. In HTTP2, requests for data are initiated by sending a HEADERS frame. After receiving this frame, a server will start processing your request, subsequently sending DATA fram...