EUVD-2026-80052

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE component: Compiler. The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows...

EUVD-2026-80007

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol DHCP relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to...

EUVD-2026-80014

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...

CVE-2019-0708

Existe una vulnerabilidad de ejecución remota de código en los Servicios de Escritorio Remoto, anteriormente conocidos como Servicios de Terminal, cuando un atacante no autenticado se conecta al sistema objetivo mediante RDP y envía solicitudes especialmente diseñadas. Esta vulnerabilidad es prev...

CVE-2025-52691

CVE-2025-52691 SmarterMail 未授权任意文件上传远程代码执行 概述 严重未授权任意文件上传，允许远程代码执行。 字段| 值 ---|--- 产品| SmarterMail 受影响版本| Build 9406 及更早 CVSS| 10.0（严重） 类型| 任意文件上传 攻击向量| HTTP（未授权） 影响| 远程代码执行 攻击流程 root@kitploit: flowchart LR AAttacker -- B"Find Upload Endpoint" B -- C"/api/upload" C -- D"Upload ASPX Shell" D --...

CVE-2025-69460

CVE-2025-69460 – Simple Image Gallery 1.0 Ejecución Remota de Código RCE No Autenticado WriteUp CVE-2025-69460 – ExploitDB 50214...

CVE-2026-73446

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit PDU that causes the device to tear down an established IS-IS adjacency. This may result in traffic disruption and loss of IP...

CVE-2026-73460

On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate prematurely. This may result in traffic loss following a restart event...

CVE-2026-73459

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss...

CVE-2026-15638

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed...

exploit-CVE-2015-3306

ProFTPd 1.3.5 - modcopy Remote Command Execution ProFTPD is a highly configurable FTP daemon for Unix and Unix-like operating systems. ProFTPD grew from a desire for a secure and configurable FTP server. It was inspired by a significant admiration of the Apache web server. Unlike most other Unix...

cve-2026-82329-jfrog-artifactory

CVE-2026-82329 — Bypass de autenticación no autenticado en JFrog Artifactory → toma de control de administrador CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-287 · divulgado el 2026-08-28 · explotado activamente. Un atacante no autenticado y adyacente a la red genera un token de acceso de...

CVE-2026-33017

CVE-2025-62593 — Ray Unauthenticated RCE Exploit Overview CVE-2025-62593 is an unauthenticated remote code execution vulnerability in the Ray distributed AI compute engine. The root cause is the absence of authentication on critical HTTP endpoints /api/jobs, /api/jobagent/jobs. An attacker can...

CVE-2018-14667

CVE-2018-14667 Después de pasar mucho tiempo para entender y explotar correctamente este CVE, decidí construir un repositorio sobre el bug RCE de RichFaces 3.X y compartir los HOWTOs paso a paso con la comunidad. 0x00 : Introducción sobre el bug de RichFaces 3.X El lunes 19 de noviembre, Joao F M...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

CVE-2022-46169_unauth_remote_code_execution

CVE-2022-46169 - Ejecución remota de código no autenticado en Cacti Ejecución remota de código no autenticado a través de omisión de autenticación e inyección de comandos en Cacti 1.2.23 y 1.3.0 DESCARGO DE RESPONSABILIDAD: Este script está diseñado para auditar la seguridad de los sistemas. Solo...

GitLab 18.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-85706)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authenticatio...

PT-2026-93272

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

Linux Distros Unpatched Vulnerability : CVE-2026-92039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

Linux Distros Unpatched Vulnerability : CVE-2026-63128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in...