← CVE

PoC mới public

Repo GitHub mới tạo có chứa mã CVE trong tên. Cập nhật 11 giờ trước.

• CVE-2026-87690 Chưa chấm 2 ngày trước
  h00die/CVE-2026-87690-POC ★ 0

  Exploit and writeup for CVE-2026-87690

• CVE-2026-10961 Cao 8.3 2 ngày trước
  dinosn/php-cve-2026-10961x-lab-poc ★ 79

  PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12

• CVE-2026-113468 Trung bình 6.9 2 ngày trước
  yuwkaaa/CVE-2026-113468 ★ 0

  forgeable PayPal payment callback in TYPO3 EXT:shop

• CVE-2026-112071 Trung bình 6.9 2 ngày trước
  yuwkaaa/CVE-2026-112071 ★ 0

  unauthenticated order cancellation in TYPO3 EXT:shop

• CVE-2026-64638 Cao 8.9 2 ngày trước
  OFRPurpose/poc-cve-2026-64638 ★ 0

  WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).

• CVE-2025-5243 Nghiêm trọng 10.0 2 ngày trước
  ersinerenler/CVE-2025-5243-SMG-Software-Information-Portal-Arbitrary-File-Upload-Vulnerability ★ 0

  CVE-2025-5243 - Arbitrary File Upload / OS Command Injection in SMG Software Information Portal (CVSS 10.0)

• CVE-2026-105810 Cao 8.5 2 ngày trước
  M0ud4/CVE-2026-105810 ★ 2

  CVE-2026-105810 TP-Link Tapo C320WS authenticated connectAp stack overflow (RCE as root)

• CVE-2026-108097 Chưa chấm 2 ngày trước
  ExDev994/CVE-2026-108097 ★ 0

  CVE-2026-108097

• CVE-2026-106173 Nghiêm trọng 9.8 2 ngày trước
  0xBlackash/CVE-2026-106173 ★ 1

  CVE-2026-106173

• CVE-2026-85314 Trung bình 6.5 2 ngày trước
  oscerd/CVE-2026-85314 ★ 0

  Reproducer for CVE-2026-85314 — Apache Camel camel-mail MimeMultipart mail.smtp header injection (CWE-20). Camel Spring Boot + Camel Quarkus.

• CVE-2026-85313 Chưa chấm 2 ngày trước
  oscerd/CVE-2026-85313 ★ 0

  Reproducer for CVE-2026-85313 — Apache Camel camel-jetty enableCORS credentialed any-origin CORS (CWE-942). Camel Spring Boot.

• CVE-2026-106173 Nghiêm trọng 9.8 2 ngày trước
  horizon3ai/CVE-2026-106173 ★ 9

  Proof of concept exploit for CVE-2026-106173, a path traversal file write leading to RCE for Fortinet FortiSIEM

• CVE-2026-85312 Chưa chấm 2 ngày trước
  oscerd/CVE-2026-85312 ★ 0

  Reproducer for CVE-2026-85312 — Apache Camel camel-core saga hijacking via the Long-Running-Action header (CWE-20). Camel Spring Boot + Camel Quarkus.

• CVE-2026-93300 Cao 7.5 2 ngày trước
  Datxzzz/CVE-2026-93300 ★ 0

  The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CVE-2026-85301 Chưa chấm 2 ngày trước
  oscerd/CVE-2026-85301 ★ 0

  Reproducer for CVE-2026-85301 — Apache Camel camel-keycloak issuer validation bypass (CWE-287). Camel Spring Boot + Camel Quarkus.