Exploits

CVE-2026-34486 Apache Tomcat EncryptInterceptor 绕过漏洞复现（使用GLM5.1复现完成）

CVE labs

CVE-2026-34197: Apache ActiveMQ Classic RCE via Jolokia API (CVSS 8.8). Python & Nmap NSE detection scripts. A 13-year-old vulnerability allows remote code execution through the addNetworkConnector MBean operation. Unauthenticated on versions 6.0.0 to 6.1.1. Fixed in 5.19.4 and 6.2.3.

Axios CRLF Injection (CVE-2026-40175) 취약점 대응 가이드 및 fetch 기반 마이그레이션 분석

Scan local repos for vulnerable axios versions (CVE-2026-40175) and patch interactively

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user.

CVE-2026-39987 - Marimo < 0.23.0 Pre-Auth RCE (WebSocket) PoC de explotación - Conecta a /terminal/ws sin autenticación Author: Fevar54 Date: 2026-04-13 Severity: CRITICAL CVSS: 9.3

This is a special panel that is used to send POC requests with the output of responses.

[First-Blood-XO] React Server Component endpoint vulnerable to CVE-2025-55182 (RCE) → enumerated SUID binaries → /usr/bin/perl had SUID set → used Perl's POSIX setuid(0) to escalate to root → read /root/flag.txt

CVE-2026-39987

Firefox extension for detecting and exploiting CVE-2025-55182 — Prototype Pollution RCE in Next.js React Server Actions

Found 200+ vulnerabilities on scanme.nmap.org including CVE-2023-38408 (9.8 critical)

CVE-2026-40175

Vulnerability in NitroShare Desktop v0.3.4

CVE-2025-66024 - XWiki Blog Application home page vulnerable to Stored XSS via Post Title

Proof-of-concept exploit for CVE-2019-15107 (Webmin <= 1.920) enabling unauthenticated RCE via command injection.

Real-world incident response for CVE-2025-55182 (React2Shell) — script injection, server remediation, and post-incident report

CVE-2026-4350 - Perfmatters WordPress Arbitrary File Deletion