CVE-2026-40897

CVE-2026-40897 Ejecución Remota de Código en el Analizador de Expresiones de Math.js ★ CVE-2026-40897 Ejecución Remota de Código en Math.js PoC ★ https://github.com/user-attachments/assets/8c394039-f00a-4875-991a-fb5f40bc6898 Resumen CVE-2026-40897 es una vulnerabilidad de Omisión de Sandbox que...

CVE-2026-44789-n8n-PrototypePollution-RCE

CVE-2026-44789 — n8n HTTP 请求节点分页原型污染 → RCE 一个已认证的 n8n 1.123.43 工作流创建者通过 HTTP 请求节点的分页设置，在 n8n 服务端 进程中污染 Object.prototype，然后通过滥用 n8n 生成任务运行器的方式，将污染的 NODEOPTIONS 泄漏给子 node 进程并绕过代码节点沙箱，进而升级为远程代码执行 。...

React2Shell_CVE-2025-55182

Exploit modular CVE-2025-55182 con bypass de WAF Un script de Python que proporciona un shell interactivo para explotar la vulnerabilidad crítica de RCE CVE-2025-55182 en aplicaciones vulnerables de React Server Components y Next.js. Este exploit apunta a la falla de deserialización que permite l...

ROOT-OS-DEBIAN-13-CVE-2026-55973 CVE-2026-55973 in unbound - Patched by Root

Root has patched CVE-2026-55973 in the unbound package for Root:Debian:13. Multiple fixed versions available...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web

React2Shell（CVE-2025-55182）：打破网络的反序列化漏洞 ⚡ React2Shell，CVE-2025-55182，RCE漏洞：对React服务器组件中不安全的反序列化缺陷的深入分析，该缺陷能够在默认的React/Next.js环境中实现未经身份验证的远程代码执行。 ⏩ 快速总结 React2Shell（CVE-2025-55182）是一个严重远程代码执行（RCE）漏洞，影响React 19.x中的React服务器组件（RSC）以及Next.js等框架。该漏洞源于对“Flight”协议块的 不安全反序列化，允许攻击者注入恶意结构，这些结构会解析为Function构造...

Important: Red Hat Security Advisory: valkey security, bug fix, and enhancement update

An update for valkey is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free

A flaw was found in Valkey. An authenticated client can trigger a CLIENT KILL command while the tlsProcessPendingData function iterates a pending list. This action causes connTLSClose to delete the iterator's cached next node, leading to a use-after-free vulnerability. This flaw, when Transport...

redis: Redis: Remote Code Execution via specially crafted RESTORE payload

A flaw was found in Redis. An authenticated attacker, in an unusual configuration where they can execute the RESTORE command, could exploit a double free vulnerability. This occurs when a specially crafted RESTORE payload references the same NACK pending entry by multiple consumers, and both...

valkey: Valkey: Remote code execution via use-after-free in stream deserialization

A flaw was found in Valkey, a distributed key-value database. A remote attacker could exploit a use-after-free vulnerability in the RESTORE command. This occurs when a malformed data stream is processed during stream deserialization, causing a shared resource to be improperly managed. If...

VTIGER-CRM-RCE-CVE-2026-23698

Este repositorio no tiene un README...

CVE-2026-27475

CVE-2026-27475 CVSS-B 9.2 CRÍTICO Deserialización insegura autenticada en SPIP 4.4.8 Explicaciones y más en mi sitio web RCE Gadget Attacker plugins/rcegadget/rcegadgetoptions.php root@kitploit: DEBUG:\n"; echo "File: "; vardump$this-file; echo "Data: "; vardump$this-data; echo "";...

CVE-2026-23744

CVE-2026-23744 Descripción MCPJam inspector es una plataforma de desarrollo local-first para servidores MCP. Las versiones =1.4.2 son vulnerables a una vulnerabilidad de ejecución remota de código, que permite a un atacante enviar una solicitud HTTP manipulada que desencadena la instalación de un...

CVE-2026-12485

🚨 CVE-2026-12485 - 严重未授权远程代码执行 RCE GeoVision GV-I/O Box 4E – 固件 v2.09 披露日期： 2026年6月23日 CWE： CWE-121 – 基于栈的缓冲区溢出 攻击向量： 网络（未授权） GeoVision GV-I/O Box 4E 的 DVRSearch 服务中存在一个未授权的基于栈的缓冲区溢出漏洞，允许远程攻击者实现任意代码执行并完全控制受影响的设备。 📋 概述 字段| 值 ---|--- CVE ID| CVE-2026-12485 CVSS v3.1| 10.0（严重） CWE| CWE-121 受影响产品|...

CVE-2026-63030

🚨 CVE-2026-63030 — WP2Shell Confusión de rutas en la API REST de WordPress → Ejecución remota de código Una vulnerabilidad crítica del núcleo de WordPress que permite la confusión de rutas en la API REST y que puede encadenarse con inyección SQL para lograr ejecución remota de código sin...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update 越权访问漏洞 Broken Access Control LiteLLM 的 /config/update 端点未检查调用者的角色权限 。任何持有有效 API Key 的已认证用户（无需管理员权限）均可修改代理配置，注册恶意 Pass-Through 端点以实现 环境变量窃取、任意文件读取、远程代码执行 等攻击。...

CVE-2026-23744

CVE-2026-23744 CVE-2026-23744 RCE Mientras analizaba esta vulnerabilidad, descubrí que MCPJam Inspector exponía el endpoint /api/mcp/connect a la red vinculándose a 0.0.0.0. Este endpoint acepta un objeto JSON que contiene serverConfig, incluidos los campos command y args. La aplicación tenía la...

CVE-2026-46817

🚨 CVE-2026-46817 - 关键远程代码执行 Oracle E-Business Suite – Oracle Payments（文件传输） 影响Oracle Payments（文件传输）的关键未认证远程漏洞，可能通过HTTP完全攻破该应用。 📌 概述 CVE-2026-46817 是 Oracle E-Business Suite 中 Oracle Payments 组件的一个 关键 漏洞。该缺陷影响 文件传输 功能，可通过 HTTP 远程利用，无需认证 。 成功利用后，攻击者可完全攻破易受攻击的 Oracle Payments 应用，导致以下全部损失： 🔓 保密性 ✏️ 完整...

CVE-2025-52970

CVE-2025-52970 FortiWeb Authentication Bypass to Remote Code Execution Exploit Features Weaponized by adding interactive shell to enable remote code execution Usage root@kitploit: python CVE-2025-52970.py -t target.com Demo References...