PT-2026-123348

The MongoDB Shell mongosh relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell mongosh versions prior to 2.14.0 and can be resolved by updating ...

CentOS Linux 7 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792804368)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792804368 advisory. - A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the...

ghostlock-firetv-tank

GhostLock — one-shot root for the Fire TV Stick 2 tank Buil...

cse509-hw2

CSE 509 — Computer System Security, Assignment 2 Coursework f...

Exploit for Incorrect Implementation of Authentication Algorithm in Google Android

CVE-2026-0073 CVE-2026-0073: Android adbd TLS auth bypass PoC...

CVE-2026-0073-Android-ADBD-bypass-POC

CVE-2026-0073 — Android ADBD TLS Auth Bypass EVPPKEYcmp type confusion → unauthorized ADB shell 🔥 Overview A critical authentication bypass in Android's ADB daemon adbd allows any attacker on the local network to obtain a full shell on a target device without user authorization. The vulnerability...

Exploit for CVE-2026-112900

Pillow Ghostscript Argument Injection PoC CVE-2026-112900 P...

Exploit for CVE-2026-112900

Pillow Ghostscript Argument Injection PoC CVE-2026-112900 P...

CLSA-2026-1792935277 openssh: Fix of 4 CVEs

CVE-2026-106585: a compressed packet could inflate far beyond the maximum packet size and exhaust memory; reject it once the decompressed payload reaches PACKETMAXSIZE. Backport upstream commit e0f85d83. - CVE-2026-106555: sshd kept GSSAPI client state from a partially completed authentication...

CLSA-2026-1792933338 openssh: Fix of 4 CVEs

CVE-2026-106555: sshd kept GSSAPI client state from a partially completed authentication attempt and could reuse it in a later attempt; reset it before each attempt. Backport upstream commits 670510d1 and d549f99d. - CVE-2026-106553: sshd stored delegated GSSAPI credentials even when GSSAPI user...

CLSA-2026-1792932827 openssh: Fix of 4 CVEs

CVE-2026-106555: sshd kept GSSAPI client state from a partially completed authentication attempt and could reuse it in a later attempt; reset it before each attempt. Backport upstream commits 670510d1 and d549f99d. - CVE-2026-106553: sshd stored delegated GSSAPI credentials even when GSSAPI user...

poc-sky

CVE-2019-2215 on Skyworth / Coocaa TVs 9S60, Android 8.0 Te...

SharpPolarBear

SharpPolarBear This is a weaponized version for one of the Exploits published by SandboxEscaper from here https://github.com/SandboxEscaper/polarbearrepo. Most of the code comes from rasta-mouse CollectorService repository https://github.com/rasta-mouse/CollectorService. I just changed the...

ConfluenceMemshell

ConfluenceMemshell Confluence CVE 2021, 2022, 2023 exploitation tool, supports command execution, Godzilla, Behinder memory shell injection Supported Confluence versions: CVE-2021-26084, CVE-2022-26134, CVE202322515, CVE-2023-22527 If it helps you and you think it's good, please give it a big ⭐️❗️...

gcat

Gcat A stealthy Python based backdoor that uses Gmail as a command and control server This project was inspired by the original PoC code from Benjamin Donnelly This is PoC code... ... that was released for orginazations to test their defenses against these type of attacks. In order to detect them...

CVE-2018-17431-PoC

CVE-2018-17431-PoC Proof of consept for CVE-2018-17431 Exploit Title: Comodo Firewall & Central Manager UTM All Release before 2.7.0 & 1.5.0 Remote Command Execution Web Shell based Exploit Author: Milad Fadavvi Vendor Homepage: https://www.comodo.com/ Software Link:...

CVE-2020-0796-RCE-POC

CVE-2020-0796 Remote Code Execution POC c 2020 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes Remote Code Execution POC for CVE-2020-0796 / "SMBGhost" Expected outcome: Reverse shell with system access. Intended only for educational and testing in corporate environments. ZecOps...

Amazon Linux 2023 : edk2-aarch64, edk2-ovmf, edk2-shell-aa64 (ALAS2023-2026-3227)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3227 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes disproportionate heap growth when OpenSSL cachesX.509 extensions. Impact summary: Receiving a craft...

Krayin CRM 2.2.x Authenticated Shell Upload

Krayin CRM version 2.2.x contains an authenticated arbitrary file upload vulnerability in its TinyMCE upload endpoint that may allow server-side PHP code execution. This proof of concept authenticates to the application and uploads a supplied file. https://packetstorm.news/download/237475...

Heroinn

Heroinn A cross platform C2/post-exploitation framework implementation by Rust. This project is for research and study purposes only, and any illegal behavior using this project has nothing to do with this project. Features GUI Interactive PTY shell System infomations collect File manager support...