Tag: poc-public
All entries tagged poc-public.
- CVE-2026-85706, GitLab CE/EE: unauthenticated path traversal in the repository commits API reads arbitrary server files, and honeypots caught exploitation attempts one day after the patch (CVSS 10.0)
- Chaotic Eclipse turns its zero-day drops on third-party security products: local privilege escalation in CrowdStrike Falcon and Avast, with working proof-of-concept code public; all three vendors have since remediated
- CVE-2026-63219 / CVE-2026-58400, GeoNetwork opensource: chained unauthenticated formatter upload plus unsafe Saxon XSLT processing reaches unauthenticated RCE (CVSS 8.6 / 9.1)
- CVE-2026-60004: Gitea's diffpatch endpoint turns an attacker-supplied patch into a live Git hook, giving command execution as the service account; KEV-listed after miner deployment
- CVE-2026-21962: an unauthenticated request bypasses access control in the Oracle WebLogic Server Proxy Plug-in, CISA KEV-listed on 24 August with exploitation running since January
- CVE-2026-62911, Microsoft Exchange Server MRSProxy: a missing channel-binding check lets a relayed Negotiate authentication take over every mailbox, public exploit code now live sixteen days after the patch
- miniOrange's SAML2Core library ships the same openssl_verify() tri-state authentication bypass across both its WordPress and Joomla SAML SSO products, one vendor code defect, two ecosystems, exploitation already attempted against the WordPress line
- Windows Defender ships its own kernel write primitive: BTR.sys, the signed boot-time remediation driver, takes an encrypted job list from an alternate data stream and will delete or create any file or registry value asked of it
- CVE-2026-19490, Citrix NetScaler: an authentication bypass on Gateway and AAA virtual servers (CVSS 9.3), and on older builds no SAML configuration is needed to be exposed
- GeoServer: an unauthenticated SQL injection in the jsonArrayContains filter is being exploited with no CVE and no patch, and NCSC-CH has put it in front of Swiss operators
- ShieldBreak, a public proof-of-concept defeats Microsoft's July fix for the RoguePlanet Defender flaw, claims 100% reliability where the original was a coin flip, and now covers Windows Server 2025
- Linux kernel bridge STP timer use-after-free, a control-flow hijack primitive with a published exploit, no CVE, and no confirmed stable backport
- FreeBSD CTL HA, three independent pre-authentication remote kernel-code-execution primitives behind an unauthenticated failover port, and the project's answer is a manpage warning rather than a patch
- CVE-2026-64638 (XSS2Shell), WordPress Core: a sanitiser disagreement on the login screen chains through DOM clobbering and a JSONP callback into administrator-minted Application Passwords and plugin upload
- CVE-2026-65400, macOS Screen Sharing lets a network attacker authenticate without valid credentials, the second severe defect in the same daemon in two releases
- CVE-2026-66066, Ruby on Rails Active Storage: an unauthenticated image upload reaches arbitrary file read through libvips' unfuzzed loaders, exposing every application secret (CVSS 4.0 9.5)
- LegacyHive: a public Windows technique that redirects a profile's Local AppData into the NT Object Manager namespace via offline hive edits, reproduced on fully patched systems
- CVE-2025-15467, Siemens Desigo CC: a vendored OpenSSL CMS parsing overflow gives pre-auth code execution, and the V7 family still has no fix (CVSS 9.8)
- CVE-2026-61511, vBulletin: an arithmetic-only regex filter in front of eval() yields unauthenticated RCE, with a working exploit now public
- GitLab CE/EE RCE via the Jupyter-notebook diff renderer and two ~5-year-old Oj Ruby-parser memory-corruption bugs, public PoC, silent patch, no CVE
- CVE-2026-54121, Windows Server AD CS 'Certighost': low-priv domain user forges a DC certificate to DCSync, full PoC public (CVSS 8.8)
- CVE-2026-16232, Check Point SmartConsole: authentication bypass to full admin, exploited in the wild (CVSS 9.1)
- CVE-2026-2291; dnsmasq DNS-cache heap overflow is a pre-auth RCE, not just a DoS (Exodus exploit-dev write-up)
- WP2Shell: pre-auth RCE chain in stock WordPress core (CVE-2026-63030 + CVE-2026-60137), out-of-band 7.0.2 patch, exploitation expected short-term
- Firefox 152.0.6, chained WebAssembly memory-safety and DOM-navigation site-isolation flaws with public exploit code (CVE-2026-15718, CVE-2026-15719)
- Microsoft July 2026 Patch Tuesday ships two actively-exploited zero-days, AD FS local EoP (CVE-2026-56155) and unauthenticated SharePoint EoP (CVE-2026-56164)
- PraisonAI agent framework: three CVEs, unsandboxed LLM code execution, tool-call RCE, and vector-store DDL injection
- Joomla file-upload RCE wave adds RSFiles! (CVE-2026-57827, unauth, CVSS 10.0) and Phoca Download (CVE-2026-57828, CVSS 9.0)
- CVE-2026-48939, iCagenda for Joomla: unauthenticated file-upload-to-RCE, exploited as a zero-day, added to CISA KEV (CVSS 4.0 10.0)
- Cisco Talos batch disclosure: wolfSSL PKI name-constraint bypasses, GeoVision command injection, and a VTK-DICOM heap overflow (41 CVEs)
- CVE-2026-50656, Microsoft Defender engine 'RoguePlanet' local privilege escalation now patched; NCSC-CH tracks the ongoing 'Nightmare Eclipse' zero-day series
- Git commit-signature malleability mints a second "Verified" GitHub commit with a different hash, defeating hash-based blocklists
- GhostApproval (CVE-2026-12958, CVE-2026-50549), symlink + confirmation-UI misrepresentation lets a malicious repo write outside six AI coding assistants' workspace sandbox
- CVE-2026-53359, Linux KVM/x86 "Januscape": shadow-MMU use-after-free enables guest-to-host VM escape on Intel and AMD
- GhostLock (CVE-2026-43499), Linux kernel rtmutex use-after-free with a public, 97%-reliable root and container-escape exploit
- CVE-2026-8451, Citrix NetScaler ADC/Gateway: pre-auth SAML memory overread (CitrixBleed lineage), public PoC
- CVE-2026-8037, Progress Kemp LoadMaster: pre-auth RCE via uninitialized heap in the /accessv2 API
- CVE-2026-55200, libssh2 heap out-of-bounds write in ssh2_transport_read() with public PoC; companion pre-auth DoS CVE-2026-55199
- CVE-2026-58053, Gitea act_runner Docker backend: container-hardening bypass to host escape (CVSS 9.4, public PoC)
- CVE-2026-46331, Linux kernel "pedit COW": out-of-bounds write in the tc act_pedit module (public weaponised PoC)
- CVE-2026-43503, Linux kernel "DirtyClone": page-cache corruption via XFRM/IPsec skb cloning (working PoC)
- CVE-2026-20230, Cisco Unified CM: WebDialer SSRF to arbitrary file write to root, reconnaissance-stage exploitation observed
- CVE-2026-12789, ILIAS 11.0: unpatched, PoC-public SQL injection in the learning-progress subsystem (DACH education exposure)
- CVE-2026-20896, Gitea (Docker): trust-all reverse-proxy default lets an unauthenticated attacker impersonate any user via X-WEBAUTH-USER
- AutoJack; Microsoft shows a single web page can drive host RCE through an AI agent's local MCP server
- usbliter8, a permanent SecureROM boot-chain exploit for Apple A12/A13 silicon
- Nightmare/Chaotic Eclipse zero-day wave; the Defender LPE now carries a CVE, a public PoC, and Microsoft's "Exploitation More Likely" rating, with no patch
- Obsidian Security: a three-CVE chain turns any LiteLLM user into root on the AI gateway
- CVE-2026-10795, UpdraftPlus WordPress backup plugin: unauthenticated authentication bypass to RCE
- CVE-2026-48558, SimpleHelp RMM: unauthenticated OIDC authentication bypass yields a full technician session
- CVE-2026-25089, Fortinet FortiSandbox: unauthenticated OS command injection in the web UI's VNC-launch handler (CVSS 9.8)
- "GreatXML": unpatched BitLocker bypass via crafted XML on the recovery partition, PoC public, practical severity contested
- "RoguePlanet" Microsoft Defender zero-day: TOCTOU race in the scan engine yields a SYSTEM shell, no CVE, no patch
- CVE-2026-47291, Microsoft June Patch Tuesday: HTTP.sys pre-auth RCE (CVSS 9.8) headlines the largest-ever release (198 CVEs)
- CVE-2026-10520 / CVE-2026-10523, Ivanti Sentry: pre-auth OS command injection to root (CVSS 10.0), public PoC published today
- Exodus Intelligence publishes working exploit for a one-character Linux kernel nf_tables use-after-free (CVE-2026-23111)
- CVE-2026-50751, Check Point Security Gateway: IKEv1 VPN authentication bypass, actively exploited by a Qilin affiliate
- An autonomous AI agent finds 21 zero-days in FFmpeg for ~$1,000, nine numbered (CVE-2026-39210 to -39218), parser bugs up to 23 years old
- Redis CVE-2026-23479: a public use-after-free→GOT-overwrite RCE in a database 80% of cloud estates run passwordless
- HTTP/2 Bomb (CVE-2026-49975): a single-connection memory-exhaustion DoS against every major web server
- CVE-2026-20230, Cisco Unified Communications Manager: unauthenticated SSRF to OS-root file write
- CVE-2026-48710 "BadHost", Starlette (FastAPI / vLLM / LiteLLM / MCP SDK): Pre-Auth Auth Bypass via Malformed Host Header
- Rapid7 publishes unpatched Gogs argument-injection RCE with a Metasploit module; maintainer non-responsive
- CVE-2026-46333 ssh-keysign-pwn: a 9-year ptrace race in the Linux kernel reaching root and SSH host keys
- PinTheft, Linux kernel local-privilege-escalation primitive (RDS zerocopy double-free + io_uring fixed-buffer page-cache overwrite), PoC public, Arch Linux default-loaded
- CVE-2026-45829, ChromaDB Python FastAPI server: pre-auth RCE via embedding-function model loading before auth check (CVSS 4.0 = 10.0; still unpatched in v1.5.9)
- vm2 Node.js sandbox, 12 critical CVEs (CVE-2026-43997 / 43999 / 44005 / 44006 / 44008 / 44009 et al.), sandbox escape to host RCE, upgrade to ≥ 3.11.4
- CVE-2026-31635 ("DirtyDecrypt"), Linux kernel RxGK page-cache write, public PoC; Fedora, Arch, openSUSE Tumbleweed affected
- Sparx Enterprise Architect / Pro Cloud Server, five-CVE chain (pre-auth SQL injection + WebEA race-condition RCE), public PoC, no vendor patch
- Chaotic Eclipse Windows zero-days; MiniPlasma is third PoC in series; cldflt.sys CfAbortHydration path, claimed re-exploitable CVE-2020-17103 regression
- CVE-2026-46300, Linux kernel: local privilege escalation via xfrm ESP-in-TCP ("Fragnesia"), PoC public
- CVE-2026-42945, NGINX Open Source / Plus / F5 WAF products: 18-year-old heap buffer overflow in rewrite module ("NGINX Rift"), PoC public
- Windows BitLocker "YellowKey" and CTFMON "GreenPlasma" zero-days: public PoC, no patch, TPM-only BitLocker bypassed
- Microsoft Semantic Kernel CVE-2026-26030 / CVE-2026-25592: Prompt-Injection-to-RCE in an AI Agent Orchestration Framework
- CVE-2026-26030 / CVE-2026-25592, Microsoft Semantic Kernel: prompt-injection-to-RCE in the Python and .NET SDKs of Microsoft's AI agent orchestration framework (CVSS 9.9 each)
- CVE-2026-43284 / CVE-2026-43500, Linux "Dirty Frag": deterministic LPE chain via page-cache write primitives in xfrm-ESP and RxRPC, active exploitation confirmed