Exploits

CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

Reproducer for CVE-2026-63621 (Apache Camel camel-knative structured CloudEvent header injection) — Camel Spring Boot + Camel Quarkus

Reproducer for CVE-2026-59230 (Apache Camel camel-mail MimeMultipart headersInline header injection) — Camel Spring Boot + Camel Quarkus

SIMPLE EXPOIT FOR CVE-2025-55182 FOR RCE , COMMAND INJECTIONS AND OTHER VULNERABILITIES

Patch: Credential exposure (AWS CLI)

Patch: Deserialization RCE (Veeam Backup)

Patch: Authentication bypass (VMware vCenter)

Patch: Privilege escalation via web UI (Cisco IOS XE)

Reproducible lab for CVE-2026-10053 (GitLab npm package-registry path traversal -> arbitrary file write as git). Vulnerable 19.2.1 vs patched 19.2.2, deterministic oracle.

IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery

Password-Protected Category Bypass via JSON Format in JoomGallery

Apple MacOS Screen Sharing Arbitrary File read/write -> RCE

Read-only PoC for CVE-2026-65400 — macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file read. Patched in macOS 26.6.1 / 15.7.9 / 14.8.9.

Security research and technical analysis of CVE-2026-69191 affecting FileRise up to version 3.20.0.

Analyze and reproduce CVE-2025-55182.

aarch64 race condition checker

Original research and non-destructive PoC for a pre-auth stack buffer overflow via unbounded sscanf scanset in the Netis NC63 ipFilterList handler

Original research and non-destructive PoC for a pre-auth Base64-decoded password stack buffer overflow in Netis NC63 login.cgi