Exploits

CVE-2026-19089 WooCommerce Tych Remote Command Execution

Validated GhostLock CVE-2026-43499 port for NVIDIA Shield TV Pro mdarcy 9.2.4

CVE-2025-8110 - Gogs <=0.13.x symlink bypass -> arbitrary file write as the Gogs process user

CVE-2025-58434 - Flowise (CVE-2025-58434) unauthenticated account takeover via password-reset token disclosure

CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight deserialization

Serpstat fork of housepower/ClickHouse-Native-JDBC 2.7.1. Fixes the CityHash128 checksum defect behind "Checksum doesn't match: corrupted data" on INSERT, upgrades aircompressor to 0.27 (CVE-2024-36114). Drop-in: com.serpstat:clickhouse-native-jdbc-shaded:2.7.1-serpstat.1. Apache 2.0.

Writeup/finding of CVE-2026-24061 within the Cyberhawks lab

Marimo Pre Authentication RCE

Security-hardened fork of sift 17.1.3 for CVE-2026-85625. Not affiliated with crcn/sift.js.

⚡ GHOSTLYR00T - CVE-2026-82222 GiveWP RCE Exploit Framework Unauthenticated RCE on GiveWP <= 4.16.7.1. Mass scanning, auto-detection (form/gateway/amount), multi-threading, JSON/TXT output, interactive shell. CVSS 9.8 Critical. ⚠️ Authorized testing only.

CVE-2026-85046 | Chrome V8 Type Confusion in Inline Array.prototype.sort (Maglev/Turbofan) | CVSS 8.8 | CWE-843 | Chrome < 152.0.7977.82

Sanitized XenForo write-up and proof of concept for CVE-2026-74239.

Sanitized XenForo write-up and proof of concept for CVE-2026-73321.

Sanitized XenForo write-up and proof of concept for CVE-2026-73320.

Sanitized XenForo write-up and proof of concept for CVE-2026-73319.

Sanitized XenForo write-up and proof of concept for CVE-2026-73318.

Sanitized XenForo write-up and proof of concept for CVE-2026-73317.

Sanitized XenForo write-up and proof of concept for CVE-2026-73316.