pocexploitCVE-2026-76504
EUVD-2026-89950 Improper Handling of URL Encoding (Hex Encoding) (CWE-177)
Sanitized report summary and local PoC for CVE-2026-103446
CVE-2026-102427 is an unauthenticated remote code execution flaw in OrdaSoft Joomla Content Construction Kit (OS CCK) — Joomla component com_os_cck.
CVE-2026-76570 PoC (PoCbit) — Joomla JCTables (com_jctables) <1.21.1: unauth SQL read/write via front-end JSON API getdatarow/getrow (CVSS 4.0 10.0 AT:N). check + exploit + mass. https://www.cve.org/CVERecord?id=CVE-2026-76570
Teltonika_RutOS 00.07.06.21 - command injection
TigerGraph_Community_Edition 4.2.4 - arbitrary file write
Ecava_ntegraXor IGX_16.0.701.10 - RCE
SuiteCRM 8.10.1 - Authenticated SSRF
POMS oretnom23v1.0 - SQLi vulnerabilities
CVE-2026-102425 PoC (PoCbit) — Joomla Balbooa Forms (com_baforms) <2.4.3.4 unauth RCE via field shortcode injection in post-submission PHP eval(). check + exploit + mass bulk. https://pocbit.org/pocs/cve-2026-102425
Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC
Authlib 1.7.2: Signature Verification Bypass - General JSON JWS Accepts Unsigned Payload when `signatures` is Empty
CVE-2026-8065 PoC: Hitachi Energy RTU500 unauth firmware update bypass (CWE-306, CVSS 9.1). IoT/OT colored check + mass exploit — RTU500 fingerprint, firmware endpoint probe, lab-safe upload test. https://pocbit.org/pocs/cve-2026-8065
CVE-2026-8065 PoC: Hitachi Energy RTU500 unauth firmware update bypass (CWE-306, CVSS 9.1). IoT/OT colored check + mass exploit — RTU500 fingerprint, firmware endpoint probe, lab-safe upload test. https://pocbit.org/pocs/cve-2026-8065
container escape POCs for CVE-2026-80521 and CVE-2026-52910