292748 matches found
CVE-2025-68937
CVE-2025-68937 - RCE por Symlink en Plantillas de Gitea/Forgejo Prueba de concepto automatizada para CVE-2025-68937 : salto de directorio mediante el seguimiento de enlaces simbólicos en el procesamiento de repositorios plantilla de Gitea y Forgejo, que conduce a la ejecución remota de código...
EXPLOIT-CVE-2026-22778
CVE-2026-22778 — vLLM RCE in video processing Vulnerable lab + proof of concept for CVE-2026-22778 CVSS 9.8, an unauthenticated remote code execution chain in vLLM's multimodal ingestion path...
CVE-2026-41089-Netlogon-RCE-PoC
🛡️ CVE-2026-41089 Netlogon Security Research & AI Security Tool Module Security Research • Defensive Validation • AI Security Tool Integration CVE-2026-41089 Netlogon RCE Scanner & Analysis | AI Security Tool...
CVE-2026-84862
IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...
CVE-2025-20352
CVE-2025-20352 — Desbordamiento de Pila SNMP en Cisco IOS / IOS XE Escrito de investigación por Sentinel AI Defense. Solo análisis defensivo — no se publica ningún exploit funcional ni PoC aquí. Un desbordamiento de búfer basado en pila en el subsistema SNMP de Cisco IOS e IOS XE: un paquete SNMP...
cve-2026-63030_60137-wordpress_rce_reproduction
CVE-2026-63030 / CVE-2026-60137 — "wp2shell" WordPress Core RCE Chain Discoverer: Searchlight Cyber via GPT-5.6 Sol Severity: Critical — CVSS 9.8 CVE-2026-63030, CVSS 9.1 CVE-2026-60137 Status: Actively exploited — added to CISA KEV Alias: "wp2shell" Overview This is an unauthenticated remote cod...
CVE-2019-9194-elFinder-Command-Injection-PoC
CVE-2019-9194 — Inyección de Comandos en elFinder PoC Vulnerabilidad de inyección de comandos en elFinder = 2.1.47 a través del componente conector PHP. Permite ejecución remota de código sin autenticación como el usuario del servidor web. Cómo funciona Sube un JPEG válido con un nombre de archiv...
CVE-2026-25938-FUXA-Unauthenticated-RCE
CVE-2026-25938 - FUXA Unauthenticated RCE 1. What is FUXA? FUXA is a free, open-source, web-based SCADA Supervisory Control and Data Acquisition and HMI Human-Machine Interface platform used for industrial automation , IoT , and real-time process visualization. It lets users build custom...
XSS2Shell-CVE-2026-64638
CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS → Remote Code Execution Chain DOM Clobbering + Application Password Theft + REST API Plugin Activation = Full RCE ⚡ Overview CVE-2026-64638 is a critical pre-authentication Reflected XSS in WordPress wp-login.php. The vulnerability exist...
CVE-2026-85750
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...
CVE-2026-79721
A flaw was found in MLflow. This vulnerability allows a remote attacker to achieve arbitrary code execution on an end user's system. This occurs when a maliciously crafted model artifact is loaded by the MLflow platform, enabling the execution of unauthorized code. Mitigation Avoid loading,...
CVE-2026-93643
The Zimbra Collaboration Suite is vulnerable to a critical security flaw when OnlyOffice/Document Editing is enabled. An unauthenticated remote attacker with access to a supported public Briefcase document can exploit unsigned save fields to perform path-traversal writes . This vulnerability can ...
CVE-2026-93643 Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...
CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...
CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...
CVE-2026-85750
Versions of Piwigo prior to v16.4.0 are vulnerable to arbitrary file read and remote code execution (RCE) during image upload handling when utilizing the Imagick library . The root cause is insufficient validation and unsafe processing of user-supplied image files. Specifically, an attacker can e...
EUVD-2026-87094
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...
CVE-2026-35194
CVE-2026-35194 — Apache Flink SQL Code Injection Remote code execution on Apache Flink TaskManagers via SQL code generation injection...
CVE-2026-35031
CVE-2026-35031: Jellyfin Subtitle Upload Path Traversal to RCE -darkred?style=flat-square -orange?style=flat-square TL;DR A critical path traversal vulnerability in Jellyfin Media Server allows authenticated users with "Upload Subtitles" permission to upload files to arbitrary locations on disk. ...