Advanced Search

CVE-2026-71518 — Typemill 2.26.0 unauthenticated authorization bypass in media file download (path-equivalent URL variants). Advisory + PoC.

Python proof of concept for CVE-2026-20079 affecting Cisco Secure Firewall Management Center.

A poc and write-up for CVE-2026-40345

POC for CVE-2026-41042

Isolated Docker lab, static detection scanner, and PoC validation for React2Shell (CVE-2025-55182).

CVE-2026-68138 Linux Local Privilege Escalation Exploit

CVE-2018-8611 PrivEsc Exploit

GeoServer Unauthenticated SQL injection to complete RCE

CVE-2026-73678 — MindsDB Minds Platform unauthenticated RCE via scratchpad exec (CVSS 10.0). Verified end-to-end with real LLM

PoC: Shiori JWT CheckToken never re-validates account state (CVE-2026-71206, High 8.2)

PoC: Grafana Editor role deletes protected contact points (CVE-2026-72585, Medium 6.5)

PoC: changedetection.io unlimited login brute-force, no rate limiting (CVE-2026-71205, Medium 6.5)

PoC: changedetection.io settings blind-merge mass assignment (CVE-2026-71204, Medium 6.3)

PoC: changedetection.io unauthenticated OpenAPI schema disclosure (CVE-2026-71203, Medium 5.3)

Public writeup, PoC, and emulation materials for CVE-2026-6837 affecting Zyxel export-cgi PKCS#12 export handling.

Public writeup, PoC, and emulation materials for CVE-2026-8508 affecting Zyxel captive-portal social login.

In August 2025, a critical vulnerability was disclosed in the FreePBX Endpoint module. CVE-2025–57819 allows an unauthenticated attacker to exploit SQ...

PoC for CVE-2026-73519 - WolfStack hardcoded cluster secret leads to unauthenticated RCE (CVSS 9.8)

PoC for CVE-2026-73847 - emlog AI Assistant CSRF to SQL execution to admin takeover (CVSS 6.8)