[POC] CVE-2026-47429 — cve-lite-on-piJun 9, 2026
pocexploitCVE-2026-47429
Running OWASP cve-lite-cli against the pi monorepo: scan journey and key finding (vitest CVE-2026-47429).
Disclosed on June 3, 2026, the "HTTP/2 Bomb" is an unauthenticated remote DoS that combines an HPACK compression bomb with a Slowloris-style hold to exhaust server memory. It affects default HTTP/2 configurations of **nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora**.
Mitigation scripts for CVE-2026-50751
Drupal Core PostgreSQL SQLi to RCE via /user/login (CVE-2026-9082 / SA-CORE-2026-004)
Redacted cPanel/WHM authentication bypass analysis and authorized checker
Apache ActiveMQ RCE via Jolokia vulnerability analysis and reproduction notes
CVE-2026-20245 - Cisco SD-WAN - Draft
react2shell - CVE-2025-55182 (Next.js: CVE-2025-66478) - Unauthenticated RCE in React Server Components (Flight Protocol) - PoC Exploit
Safely detect whether a UniFi OS Server is vulnerable to CVE-2026-34908
Nginx RCE chain PoC with CVE-2026-9256 and CVE-2026-42945
Modern Events Calendar Lite <= 7.33.0 — Unauthenticated SQL Injection
ARMember Premium <= 7.3.1 Full Admin Account Takeover