CVE-2025-55182

CVE-2025-55182 Proof of concept for a Remote Code Execution RCE vulnerability in React Server Functions Next.js, etc.. Exploits prototype pollution to execute arbitrary code on the server without authentication. Warning : This repository is for educational and research purposes only. Unauthorized...

CVE-2024-6387

cve-2024-6387-poc a signal handler race condition in OpenSSH's server sshd...

CVE-2025-55182

CVE-2025-55182 Nextjs POC A small repository containing: test-app/: a Next.js 16 React 19 test application using the App Router. exploit.js: a local proof-of-concept script used to demonstrate and test server behavior around multipart/Next-Action handling. Intended for local testing only...

CVE-2026-88858

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression uncontrolled recursion. A user with permission to provision alert rules can make the outage persist across restarts...

CVE-2026-88858 Server-side expression parser denial of service

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression uncontrolled recursion. A user with permission to provision alert rules can make the outage persist across restarts...

CVE-2026-88858

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression uncontrolled recursion. A user with permission to provision alert rules can make the outage persist across restarts...

CVE-2026-88858

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression uncontrolled recursion. A user with permission to provision alert rules can make the outage persist across restarts...

EUVD-2026-112198

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression uncontrolled recursion. A user with permission to provision alert rules can make the outage persist across restarts...

CVE-2026-88858

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression, leading to a denial of service via uncontrolled recursion . If a user also possesses permissions to provision alert rules, they can ensure the outage persists across restarts. This vul...

CVE-2026-67187

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NFAbstractsList falls through to a validat...

CVE-2026-67187

The Ninja Forms plugin for WordPress (before version 3.15.4 ) is vulnerable to a server-side validation bypass in various list fields, including Checkbox List, Multi-Select List, Image List, Country, and State. The root cause is that NF_Abstracts_List falls through to a validate() method that fai...

CVE-2026-67187 Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NFAbstractsList falls through to a validat...

CVE-2026-67077

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or...

CVE-2026-67077 HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or...

EUVD-2026-112033

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or...

CVE-2026-67077

HCL BigFix AEX is impacted by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918, CWE-441, CWE-610). This flaw allows an attacker to force the application to transmit unauthorized requests to external resources. Consequences of successful exploitation include sensitive information disclo...

EUVD-2026-111603

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users wpajaxnopriv that fail to implemen...

Security Bulletin: IBM Engineering Requirements Management DOORS Next for J2EE File Disclosure Rule (CVE-2024-41786)

Summary IBM Engineering Requirements Management DOORS Next could allow an attacker to access sensitive files and application resources due to improper validation of user-controlled input in server-side forward/include operations. An attacker could exploit this vulnerability to view configuration...

Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)

Keycloak 12.0.1 and below allows an attacker to force the server to request an unverified URL using the OIDC parameter requesturi. This allows an attacker to execute a server-side request forgery SSRF attack. id: CVE-2020-10770 info: name: Keycloak = 12.0.1 - requesturi Blind Server-Side Request...

VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...