CVE-2026-119977: WordPress Foundation WordPress: WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window...

CVE-2026-76010: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code…

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the renderimage function. This is due to unrestricted mass assignment of caller-supplied metadata keys onto the image model...

Linear eMerge E3-Series 1.00-06 Command Injection

Linear eMerge E3-Series version 1.00-06 and earlier contain an unauthenticated command injection in cardscandecoder.php. This proof of concept uses the hard-coded root credentials tracked as CVE-2019-7261 to execute a benign marker command. https://packetstorm.news/download/238664...

FreePBX Endpoint Manager 17.0.2 SQL Injection / Remote Code Execution

FreePBX Endpoint Manager versions before 15.0.66, 16.0.89, and 17.0.3 contain an unauthenticated SQL injection vulnerability that allows database manipulation and remote code execution. Included proof of concept inserts a cron job to execute commands as asterisk...

React 19.2.0 React Server Components Remote Code Execution

React Server Components version 19.2.0 and earlier affected releases contain an unsafe deserialization issue that permits unauthenticated remote code execution. This proof of concept sends a crafted Flight payload to execute a supplied command. https://packetstorm.news/download/238687...

Delinea Privilege Manager 13.0.1058 Unauthenticated Remote Code Execution

Delinea Privilege Manager agent versions 10.1.0 through 12.0.5796 and 13.0.0 through 13.0.1058 allow unauthenticated code execution as LocalSystem through an improperly validated callback endpoint. https://packetstorm.news/download/238674...

KLA91385 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Denial of service vulnerability in SVG can be exploited...

RockyLinux 8 : hplip (RLSA-2026:82295)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82295 advisory. hplip: potential memory buffer overflow CVE-2020-6923 hplip: HP Linux Imaging and Printing Software - Use of DSA Key CVE-2025-43023 hplip: HPLIP: Multip...

Security update for python-Brotli (important)

openSUSE security update: security update for python-brotli ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22183-1 Rating: important References: bsc1252945 bsc1287779 Cross-References: CVE-2025-6176 CVE-2026-111497 CVSS scores: CVE-2025-6176 SUSE :...

CVE-2024-10629

🛠️ GPX Viewer Exploit CVE-2024-10629 This repository contains a proof-of-concept exploit for the GPX Viewer plugin for WordPress, which is vulnerable to arbitrary file creation CVE-2024-10629. The vulnerability allows authenticated attackers with subscriber-level access and above to create...

CVE-2026-23744

CVE-2026-23744 MCPJam inspector Remote-Code-Execution: Proof Of Concept POC usage: python3 cve-2026-23744.py --target https:// --att-ip --att-p...

Blackash-CVE-2025-54574

🛑 CVE-2025-54574 — Heap Buffer Overflow in Squid ≤ 6.3 🛑 Severity: Critical CVSS 9.3 Affected Software: Squid Proxy versions 6.3 and earlier Vulnerability Type: Heap-based buffer overflow Discovered in: URN Uniform Resource Name processing Impact: Possible remote code execution or denial-of-servi...

Torito-R2S

Torito React2Shell Scanner & Exploit Tool CVE-2025-55182 / 66478 Detection-first scanner for Next.js RSC targets with optional PoC confirm and exploit/shell modes. Use only on systems you are authorized to test. Requirements Python 3.9+ pip install -r requirements.txt Subfinder binary in PATH for...

Burp_CVE-2025-31324

CVE-2025-31324 Burp Suite Extension Overview This Python-based Burp Suite extension is designed to detect the presence of CVE-2025-31324 , a critical vulnerability in SAP NetWeaver Visual Composer’s Metadata Uploader component. The vulnerability allows unauthenticated remote code execution via fi...

CVE-2020-14882-WebLogic-Analysis

Vulnerability Research: Exploitation of the CVE-2020-14882 and CVE-2020-14883 Chain in Oracle WebLogic Server The repository contains a technical report Write-up and a conceptual Proof of Concept PoC demonstrating the chained Authentication Bypass and Remote Code Execution RCE vulnerabilities in...

CVE-2025-53770

CVE-2025-53770 SharePoint Description The deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an attacker to execute code remotely and compromise the system. Microsoft is aware of active exploitation and is preparing a comprehensive update. Ensure that mitigations...

CVE-2025-59528.yaml

CVE-2025-59528.yaml Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses...

oieh-router-checker

OIEH Router Checker A Windows program that checks with a single click whether your router is affected by the Chinese backdoor ENDLESSDOORS No installation required · No administrator rights required · No external data transmission What Is This? In August 2026, security firm VulnCheck discovered a...

log4shell-exploitation-detection

Log4Shell CVE-2021-44228 Exploitation, Detection & Remediation A hands-on offensive and defensive security project simulating the full lifecycle of the Log4Shell vulnerability: exploitation from an attacker-controlled VM, detection engineering in Splunk, and validated remediation. Why This Projec...

Linksys-WRT54GL-Exploitation

From Solder to Shell: Full Hardware Exploitation of the Linksys WRT54GL Router CVE-2022-43973 A 10-phase embedded security research journey — from JTAG pin discovery to remote code execution on a MIPS-based consumer router. | ---|--- Author| Umberto Della Monica Role| MSc Cybersecurity Student —...