Exploit for CVE-2026-118238

Tenda W18E - Unauthenticated Root Command Injection diagnose...

CVE-2026-58205 GRR has a Reflected XSS issue

GRR is a resource management and reservation application. Prior to version 4.5.0, maj.php reflects the forcemaj parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in...

CVE-2026-58205 GRR has a Reflected XSS issue

GRR is a resource management and reservation application. Prior to version 4.5.0, maj.php reflects the forcemaj parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in...

EUVD-2026-111361

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers...

MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in...

GHSA-M65P-9J7Q-6W33 MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in...

GHSA-5H93-6WHR-6Q8J Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

Summary In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin: - custom headers set on the client for example an X-API-Key credential were sent to that origin, an...

Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

Summary In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin: - custom headers set on the client for example an X-API-Key credential were sent to that origin, an...

GHSA-RJH2-4XGW-P2HJ Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...

Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...

FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

Summary File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope for example to...

GHSA-MGQF-5MF5-PRFJ FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

Summary File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope for example to...

Linux-Kernel-Copy-Fail-CVE-2026-31431-

Copy Fail CVE-2026-31431 Vulnerability Analysis and Response Practice This project analyzes the operational principle of the Linux Kernel Copy Fail CVE-2026-31431 vulnerability and compares the pre-patch and post-patch state using the non-destructive checker from the public PoC repository. It doe...

dumpguard_bof

DumpGuard BOF Beacon Object File BOF port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems. About This Project This repository contains a Beacon Object File BOF implementation of DumpGuard, ported from the original C/.NET implementation to pure C for use with Havo...

WordPress-Path-Traversal-CVE-2019-11447

Penetration Test Report WordPress Path Traversal - CVE-2019-11447 Document Information Item| Details ---|--- Document Title| Penetration Test Report - WordPress Path Traversal Client/Exam| HackTheBox Lab - CPTS Exercise 1 Date| August 22, 2026 Assessor| Fernando Viana Penetration Tester Assessmen...

GhostLock-for-OnePlus

GhostLock — OnePlus Kernel exploit targeting locked-bootloader OnePlus devices. Uses CVE-2026-43499 to obtain root access without unlocking the bootloader or modifying boot.img. Authorized security research and educational purposes only. Table of Contents Vulnerability Overview Supported Devices...

nDPI

nDPI What is nDPI ? nDPI® is an open source LGPLv3 library for deep-packet inspection. Some dissectors are released under a dual-license: please refer to README.license.md for more information. A generic FAQ about nDPI is available here How To Compile nDPI In order to compile this project do...

ESCepcion

🛡️ ESCepcion Active Directory Certificate Services Auditor ESCepcion is an open-source tool for auditing and assessing vulnerabilities in Active Directory Certificate Services AD CS infrastructures. It is designed to automate the detection of privilege escalation paths ESC with a strict focus on...

rscrypto

rscrypto rscrypto is a Rust library of cryptographic primitives, hashes, password hashing, and checksums. One feature model controls all of them. Portable Rust is the reference implementation. SIMD and assembly backends make it faster on supported targets. Production builds do not depend on C, FF...

CVE-2025-2620-poc

CVE-2025-2620 Proof-of-Concept Exploit Overview This repository contains an advanced proof-of-concept PoC exploit for CVE-2025-2620 , a critical stack-based buffer overflow vulnerability discovered in the D-Link DAP-1620 router running firmware version 1.03. This vulnerability allows...