PoC mới public
Repo GitHub mới tạo có chứa mã CVE trong tên. Cập nhật 7 giờ trước.
-
CVE-2026-109619 Nghiêm trọng 9.2 1 ngày trước
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
-
CVE-2026-109618 Nghiêm trọng 9.2 1 ngày trước
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
-
CVE-2026-109618 Nghiêm trọng 9.2 1 ngày trước
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
-
CVE-2026-109618 Nghiêm trọng 9.2 1 ngày trước
CVE-2026-109618 and CVE-2026-109619
-
CVE-2026-109618 Nghiêm trọng 9.2 1 ngày trước
Initial version of custom CrowdSec rule for CVE-2026-109618 and CVE-2026-109619
-
CVE-2026-63030 Nghiêm trọng 9.8 1 ngày trước
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
-
CVE-2026-109618 Nghiêm trọng 9.2 1 ngày trước
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
-
CVE-2026-109618 Nghiêm trọng 9.2 1 ngày trước
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
-
CVE-2026-109618 Nghiêm trọng 9.2 1 ngày trước
PHP session.upload_progress attack-surface PoC/verification toolkit (php2shell claims, CVE-2026-109618/109619); for authorized lab testing
-
CVE-2026-109618 Nghiêm trọng 9.2 1 ngày trước
CVE-2026-109618
-
CVE-2025-27509 Nghiêm trọng 9.3 1 ngày trước
fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time (JIT) provisioning is enabled, or create new accounts tied to forged assertions if f MDM enrollment is enabled. This vulnerability is fixed in 4.64.2, 4.63.2, 4.62.4, and 4.58.1.
-
CVE-2026-11645 Cao 8.8 1 ngày trước
homegrown poc for CVE-2026-11645
-
CVE-2026-23744 Nghiêm trọng 9.8 1 ngày trước
exploit RCE (MCPJam Inspector) <= v1.4.2
-
CVE-2026-110899 Cao 7.1 1 ngày trước
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.
-
CVE-2026-88900 Cao 8.8 1 ngày trước
Reproducer for CVE-2026-88900 — Apache Camel camel-jgroups unsafe Java deserialization of cluster messages (CWE-502, HIGH). Camel Spring Boot.