CVE-2026-95365

A flaw was found in chromium-browser. A type confusion vulnerability in the IndexedDB component allows a remote attacker to execute arbitrary code within the browser sandbox. To exploit this flaw, an attacker must convince a user to open a specially crafted HTML page...

CVE-2026-95356

A flaw was found in chromium-browser. A use-after-free memory vulnerability in the WindowDialog component allows a remote attacker to execute arbitrary code outside the browser sandbox. By convincing a user to open a specially crafted HTML page, an attacker can exploit this flaw to compromise the...

CVE-2026-95335

A flaw was found in chromium-browser. A use-after-free vulnerability in the Human Interface Device HID component allows a remote attacker to execute arbitrary code outside the browser sandbox. By convincing a user to visit a specially crafted web page, an attacker who has already compromised the...

CVE-2026-95322

A flaw was found in chromium-browser. An out-of-bounds write vulnerability in the graphics processing unit GPU component allows a remote attacker to execute arbitrary code outside the browser sandbox. By enticing a user to view a specially crafted HTML page, an attacker who has already compromise...

CVE-2026-95299

A flaw was found in chromium-browser. A use-after-free memory corruption vulnerability exists within the Graphics Processing Unit GPU component. A remote attacker could exploit this flaw by enticing a user to visit a specially crafted web page. Successful exploitation could allow the attacker to...

CVE-2026-95283

A flaw was found in the Tint component of chromium-browser. This buffer overflow allows a remote attacker to execute arbitrary code outside the browser sandbox by convincing a user to view a specially crafted web page. Successful exploitation could compromise the host system by bypassing standard...

CVE-2018-16763

CVE-2018-16763 CVE-2018-16763 FuelCMS 1.4 Remote Code Execution, this version of FuelCMS is still vulnerable until now...

CVE-2026-95375

A flaw was found in chromium-browser. An incorrect authorization issue in the BrowserTag component allows a remote attacker who has compromised a renderer process to bypass the web origin policy via a crafted HTML page. This allows the attacker to circumvent the security boundary that isolates da...

CVE-2026-95361

A flaw was found in chromium-browser. A confused deputy issue in the DevTools feature allows a remote attacker to bypass the browser's web origin policy. By using social engineering to trick a user into viewing a specially crafted HTML page, an attacker can exploit this vulnerability to improperl...

CVE-2019-18935

CVE-2019-18935 Proof-of-concept exploit for a .NET JSON deserialization vulnerability in Telerik UI for ASP.NET AJAX allowing remote code execution. Description Telerik UI for ASP.NET AJAX is a widely used suite of UI components for web applications. It insecurely deserializes JSON objects in a...

CVE-2026-95312

A flaw was found in chromium-browser. A remote attacker who has compromised the browser's renderer process could exploit this vulnerability by convincing a user to visit a crafted HTML page. Successful exploitation allows the attacker to bypass cross-origin security boundaries and access sensitiv...

CVE-2023-27997-POC

Usage: python3 cve-2022-42475.py rhost rport lhost lport Exemple: python3 exploit.py 192.168.106.142 10443 192.168.106.143 9999 Disclaimer: This project is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal...

CVE-2021-46422

CVE-2021-46422 SDT-CW3B1 1.1.0 - OS Command Injection Exploit Title: SDT-CW3B1 1.1.0 - OS Command Injection Vendor Homepage: http://telesquare.co.kr/ CVE : CVE-2021-46422 CVE Description: Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker...

CVE-2026-102616 risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

EUVD-2026-89335

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

CVE-2026-102616 risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

CVE-2026-102616

A SQL injection vulnerability exists in risesoft-y9 WorkFlow-Engine up to version 9.6.10 . The flaw is located within the getByIdAndYear function of the CustomHistoricProcessServiceImpl.java file in the OAuth2 Resource Filter component. By manipulating the year/processInstanceId arguments, an att...

CVE-2026-95345

A flaw was found in chromium-browser. This vulnerability allows a remote attacker to achieve arbitrary code execution inside the restricted sandbox environment by enticing a user to open a specially crafted HTML page. The issue is caused by a use-after-free condition in the Actor component, where...

CVE-2026-79657

A flaw was found in NLTK. This vulnerability allows a remote attacker to achieve arbitrary code execution by supplying a specially crafted model or tokenizer artifact for the application to process. The issue occurs because the deserialization allowlist mechanism permits entire software namespace...

CVE-2017-8046

DISCLAIMER: This repository is supplementary to the VGS blog post, How to Avoid "Using Components with Known Vulnerabilities". It contains an application with a known security vulnerability namely, CVE-2017-8046, as well as the description of how to exploit it. Use the application at your own ris...