Catálogo de exploits

CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9

CVE-2026-41940 authentication bypass vulnerability proof-of-concept

Why-Shell/CVE-2026-38751

Unauthenticated RCE PoC for CVE-2026-48908 SP Page Builder (Joomla) arbitrary file upload and remote code execution exploit with mass scaning support.

Double-free in Apache httpd mod_http2 stream cleanup leading to pre-auth RCE

CVE-2026-49048 — JoomCCK 6.4.0 Unauthenticated SQL Injection (CVSS 9.8)

CVE-2026-12485

DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503

PoC for CVE-2026-5366: git argument injection in Prefect's GitRepository leading to RCE on the worker.

Educational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only — no exploit code. TLP:CLEAR.

WP Full Stripe Free <= 8.4.3 - Missing Authorization

cve-2026-48907 scanner

CVE-2026-48907 is a CVSS 10.0 pre-auth RCE in Joomla Content Editor affecting all versions ≤ 2.9.99.4. The Grayxploit team breaks down the 3-weakness chain — missing auth, no extension validation, and an unsafe upload flag — that lets attackers pop a shell in 3 HTTP requests.

patched ffmpeg-tools for jellyfin to patch CVE-2026-8461 aka PixelSmash

CVE-2026-43499 PoC

SugiB3o/CVE-2026-31431

CVE-2026-0073-Android-ADBD-bypass-POC汉化版

CVE-2026-46331 - Draft

Hunt-Benito/traefik-stripprefix-auth-bypass-cve-2026-48020-path-normalization

OpenSTAManager-RCE-Exploit-CVE-2026-38751

A low-privileged Docmost user could supply a victim attachmentId to the generic upload endpoint and overwrite another page's stored attachment inside the same workspace.

CVE-2026-8461

CVE-2026-54807 WooCommerce Privilege Escalation ║ ║ Unauthenticated Admin Role Assignment via Reg. Form

A local package installation helper trusted caller-supplied package names too much. In yeoman-environment, missing generators could be installed without user confirmation, turning attacker-controlled project metadata into a package-install and code-execution path.

CVE-2026-46331

CVE-2026-8932

Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin SSRF because attacker-controlled URLs crossed into a redirect-following server fetch path without destination filtering.

Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin.

A public share looked clean in the page tree, but the search endpoint told a different story. In Docmost, restricted child pages hidden from public share viewers could still leak through public share search results.

Plane’s V2 asset subsystem trusted workspace slugs and asset UUIDs without enforcing the right membership checks, which let one authenticated user read, copy, delete, and overwrite assets in other workspaces.