{"pocs":[{"id":"1308385759","cve_id":"CVE-2026-50055","name":"CVE-2026-50055","owner":"HORKimhab","full_name":"HORKimhab\/CVE-2026-50055","html_url":"https:\/\/github.com\/HORKimhab\/CVE-2026-50055","description":"CVE-2026-50055 - Draft","stargazers_count":"0","vuln_description":null,"created_at":"2026-07-22 13:42:46","updated_at":"2026-07-22 13:43:26","pushed_at":"2026-07-22 13:42:49","inserted_at":"2026-07-22 16:37:00"},{"id":"1308342298","cve_id":"CVE-2026-43499","name":"CVE-2026-43499-PoC-Scanner","owner":"gagaltotal","full_name":"gagaltotal\/CVE-2026-43499-PoC-Scanner","html_url":"https:\/\/github.com\/gagaltotal\/CVE-2026-43499-PoC-Scanner","description":"CVE-2026-43499 PoC Scanner","stargazers_count":"0","vuln_description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n  1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n  2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n     dangling pointer primed for UAF around.\n\n  3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n     task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n  \tchangelog ]","created_at":"2026-07-22 12:34:16","updated_at":"2026-07-22 12:56:35","pushed_at":"2026-07-22 12:56:16","inserted_at":"2026-07-22 16:37:00"},{"id":"1308251389","cve_id":"CVE-2026-50522","name":"CVE-2026-50522","owner":"HORKimhab","full_name":"HORKimhab\/CVE-2026-50522","html_url":"https:\/\/github.com\/HORKimhab\/CVE-2026-50522","description":"CVE-2026-50522 - Draft","stargazers_count":"0","vuln_description":null,"created_at":"2026-07-22 10:04:53","updated_at":"2026-07-22 10:05:08","pushed_at":"2026-07-22 10:04:58","inserted_at":"2026-07-22 16:37:00"},{"id":"1308211212","cve_id":"CVE-2025-64512","name":"CVE-2025-64512-exploit","owner":"MehdiChyhab","full_name":"MehdiChyhab\/CVE-2025-64512-exploit","html_url":"https:\/\/github.com\/MehdiChyhab\/CVE-2025-64512-exploit","description":"CVE-2025-64512 - pdfminer.six Remote Code Execution Exploit","stargazers_count":"0","vuln_description":"Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the `cmap\/` directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the issue.","created_at":"2026-07-22 08:46:37","updated_at":"2026-07-22 08:55:48","pushed_at":"2026-07-22 08:54:57","inserted_at":"2026-07-22 10:37:00"},{"id":"1308188860","cve_id":"CVE-2026-25632","name":"CVE-2026-25632","owner":"lazarus0x1337","full_name":"lazarus0x1337\/CVE-2026-25632","html_url":"https:\/\/github.com\/lazarus0x1337\/CVE-2026-25632","description":"CVE-2026-25632 \u2014 Fix Unsafe JSON Deserialization Leading to Remote Code Execution","stargazers_count":"1","vuln_description":"EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow\u2019s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module\/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files. This vulnerability is fixed in 0.16.1.","created_at":"2026-07-22 08:00:44","updated_at":"2026-07-22 08:08:42","pushed_at":"2026-07-22 08:02:53","inserted_at":"2026-07-22 10:37:00"},{"id":"1308162212","cve_id":"CVE-2026-45585","name":"YellowKey-Bitlocker-CVE-2026-45585","owner":"boobalover7","full_name":"boobalover7\/YellowKey-Bitlocker-CVE-2026-45585","html_url":"https:\/\/github.com\/boobalover7\/YellowKey-Bitlocker-CVE-2026-45585","description":"Manage BitLocker recovery keys, monitor drive encryption status, and unlock volumes through a portable interface for Windows.","stargazers_count":"0","vuln_description":"Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices.\nWe are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is made available.","created_at":"2026-07-22 07:11:28","updated_at":"2026-07-22 07:14:21","pushed_at":"2026-07-22 07:11:52","inserted_at":"2026-07-22 10:37:00"},{"id":"1308132950","cve_id":"CVE-2024-27867","name":"pspgo-airpods-802F0130","owner":"Hirador","full_name":"Hirador\/pspgo-airpods-802F0130","html_url":"https:\/\/github.com\/Hirador\/pspgo-airpods-802F0130","description":"Why AirPods stopped pairing with the PSP Go (error 0x802F0130): full reverse-engineering root-cause writeup \u2014 CVE-2024-27867","stargazers_count":"0","vuln_description":"An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8. When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones.","created_at":"2026-07-22 06:22:52","updated_at":"2026-07-22 06:23:08","pushed_at":"2026-07-22 06:22:56","inserted_at":"2026-07-22 10:36:59"},{"id":"1308124406","cve_id":"CVE-2022-35914","name":"CVE-2022-35914","owner":"YumeSecurity","full_name":"YumeSecurity\/CVE-2022-35914","html_url":"https:\/\/github.com\/YumeSecurity\/CVE-2022-35914","description":"my exploit for GLPI","stargazers_count":"0","vuln_description":"\/vendor\/htmlawed\/htmlawed\/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.","created_at":"2026-07-22 06:08:58","updated_at":"2026-07-22 06:12:23","pushed_at":"2026-07-22 06:11:52","inserted_at":"2026-07-22 10:36:58"},{"id":"1308066974","cve_id":"CVE-2026-0059","name":"bootlicka-POC","owner":"paul-goon","full_name":"paul-goon\/bootlicka-POC","html_url":"https:\/\/github.com\/paul-goon\/bootlicka-POC","description":"a shitty poc utilizing CVE-2026-0059.","stargazers_count":"1","vuln_description":"In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overflow. This could lead to remote (proximal\/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","created_at":"2026-07-22 04:44:45","updated_at":"2026-07-22 04:46:10","pushed_at":"2026-07-22 04:44:46","inserted_at":"2026-07-22 10:37:00"},{"id":"1308007362","cve_id":"CVE-2026-43499","name":"Ace3-GhostLock-Preload","owner":"DistrictBlauw","full_name":"DistrictBlauw\/Ace3-GhostLock-Preload","html_url":"https:\/\/github.com\/DistrictBlauw\/Ace3-GhostLock-Preload","description":"OnePlus Ace 3 preload.so for CVE-2026-43499 (GhostLock)","stargazers_count":"0","vuln_description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n  1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n  2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n     dangling pointer primed for UAF around.\n\n  3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n     task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n  \tchangelog ]","created_at":"2026-07-22 03:25:42","updated_at":"2026-07-22 03:38:07","pushed_at":"2026-07-22 03:37:38","inserted_at":"2026-07-22 04:37:00"},{"id":"1307998002","cve_id":"CVE-2026-57588","name":"CVE-2026-57588-Nessus-XML-Import-SQL-Injection-PoC","owner":"CerberusMrXi","full_name":"CerberusMrXi\/CVE-2026-57588-Nessus-XML-Import-SQL-Injection-PoC","html_url":"https:\/\/github.com\/CerberusMrXi\/CVE-2026-57588-Nessus-XML-Import-SQL-Injection-PoC","description":"PoC for CVE-2026-57588 - SQL injection in Nessus 10.12.0 XML import. Generates malicious .nessus files to enumerate databases, exfiltrate credentials, and test time-based blind injection. For authorized security research. Author: Sudeepa Wanigarathna. Patched in 10.12.1.","stargazers_count":"0","vuln_description":"A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.","created_at":"2026-07-22 03:13:53","updated_at":"2026-07-22 03:25:43","pushed_at":"2026-07-22 03:25:12","inserted_at":"2026-07-22 04:37:00"},{"id":"1307993029","cve_id":"CVE-2026-6875","name":"CVE-2026-6875-PoC-Exploit","owner":"tc4dy","full_name":"tc4dy\/CVE-2026-6875-PoC-Exploit","html_url":"https:\/\/github.com\/tc4dy\/CVE-2026-6875-PoC-Exploit","description":"CVE-2026-6875 ServiceNow Pre-Auth RCE Framework \ud83d\udd25 JS Injection \u2192 Sandbox Escape \u2192 RCE \u2192 Root. Features: --detect, --exec, reverse\/interactive shell, batch threading, WAF bypass, persistence, lateral movement, credential dump, fileless exec, clean tracks. \ud83d\udee1\ufe0f CVSS 9.5 actively exploited. Authorized & Legal use only. Stay Legal. \ud83d\udd12","stargazers_count":"0","vuln_description":null,"created_at":"2026-07-22 03:07:36","updated_at":"2026-07-22 03:47:06","pushed_at":"2026-07-22 03:45:13","inserted_at":"2026-07-22 04:37:00"},{"id":"1307987855","cve_id":"CVE-2025-8110","name":"CVE-2025-8110","owner":"ixZODiAK","full_name":"ixZODiAK\/CVE-2025-8110","html_url":"https:\/\/github.com\/ixZODiAK\/CVE-2025-8110","description":"Gogs service Exploit and get the root user","stargazers_count":"0","vuln_description":"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.","created_at":"2026-07-22 03:01:04","updated_at":"2026-07-22 03:04:13","pushed_at":"2026-07-22 03:02:13","inserted_at":"2026-07-22 04:36:59"},{"id":"1307980098","cve_id":"CVE-2026-63030","name":"WP2Shell-CVE-2026-63030-POC","owner":"Bhanunamikaze","full_name":"Bhanunamikaze\/WP2Shell-CVE-2026-63030-POC","html_url":"https:\/\/github.com\/Bhanunamikaze\/WP2Shell-CVE-2026-63030-POC","description":"PoC detector & safe validator for the WP2Shell WordPress vulnerability chain: CVE-2026-63030 (REST batch-route confusion) + CVE-2026-60137 (author__not_in SQL injection). For authorized security testing only.","stargazers_count":"0","vuln_description":null,"created_at":"2026-07-22 02:51:33","updated_at":"2026-07-22 02:51:48","pushed_at":"2026-07-22 02:51:37","inserted_at":"2026-07-22 04:37:00"},{"id":"1307978559","cve_id":"CVE-2026-60137","name":"wp2shell-poc","owner":"Colere-Sys","full_name":"Colere-Sys\/wp2shell-poc","html_url":"https:\/\/github.com\/Colere-Sys\/wp2shell-poc","description":"Analysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030","stargazers_count":"0","vuln_description":null,"created_at":"2026-07-22 02:49:41","updated_at":"2026-07-22 03:27:26","pushed_at":"2026-07-22 03:26:13","inserted_at":"2026-07-22 04:37:00"},{"id":"1307974019","cve_id":"CVE-2026-60137","name":"Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress","owner":"mrmtwoj","full_name":"mrmtwoj\/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress","html_url":"https:\/\/github.com\/mrmtwoj\/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress","description":"CVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)","stargazers_count":"0","vuln_description":null,"created_at":"2026-07-22 02:44:09","updated_at":"2026-07-22 02:49:07","pushed_at":"2026-07-22 02:45:43","inserted_at":"2026-07-22 04:37:00"},{"id":"1307928144","cve_id":"CVE-2025-32432","name":"CVE-2025-32432","owner":"c0gnit00","full_name":"c0gnit00\/CVE-2025-32432","html_url":"https:\/\/github.com\/c0gnit00\/CVE-2025-32432","description":"Exploit, POC for CVE-2025-32432, CraftCMS2Shell","stargazers_count":"0","vuln_description":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.","created_at":"2026-07-22 01:52:22","updated_at":"2026-07-22 01:56:02","pushed_at":"2026-07-22 01:55:37","inserted_at":"2026-07-22 04:36:59"},{"id":"1307864027","cve_id":"CVE-2026-33697","name":"dugganusa-ietf","owner":"pduggusa","full_name":"pduggusa\/dugganusa-ietf","html_url":"https:\/\/github.com\/pduggusa\/dugganusa-ietf","description":"DugganUSA threat-intelligence contributions to the IETF Hackathon \u2014 real-world agentic-attack benchmark vectors, CVE-2026-33697 attestation analysis, MCP verification. Empirical grounding for standards work.","stargazers_count":"0","vuln_description":"Cocos AI is a confidential computing system for AI. The current implementation of attested TLS (aTLS) in CoCoS is vulnerable to a relay attack affecting all versions from v0.4.0 through v0.8.2. This vulnerability is present in both the AMD SEV-SNP and Intel TDX deployment targets supported by CoCoS. In the affected design, an attacker may be able to extract the ephemeral TLS private key used during the intra-handshake attestation. Because the attestation evidence is bound to the ephemeral key but not to the TLS channel, possession of that key is sufficient to relay or divert the attested TLS session. A client will accept the connection under false assumptions about the endpoint it is communicating with \u2014 the attestation report cannot distinguish the genuine attested service from the attacker's relay. This undermines the intended authentication guarantees of attested TLS. A successful attack may allow an attacker to impersonate an attested CoCoS service and access data or operations that the client intended to","created_at":"2026-07-22 00:44:44","updated_at":"2026-07-22 01:11:14","pushed_at":"2026-07-22 01:09:16","inserted_at":"2026-07-22 04:36:59"},{"id":"1307840308","cve_id":"CVE-2026-52813","name":"CVE-2026-52813-Gogs-RCE","owner":"iqx6889","full_name":"iqx6889\/CVE-2026-52813-Gogs-RCE","html_url":"https:\/\/github.com\/iqx6889\/CVE-2026-52813-Gogs-RCE","description":"CVE-2026-52813 (Gogs Path Traversal \u2192 Git Hooks RCE) defensive writeup: root-cause & patch analysis, Sigma\/SIEM detection rules, IOCs, non-intrusive version scanner. No weaponized PoC.","stargazers_count":"1","vuln_description":"Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (..\/) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing\/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.","created_at":"2026-07-22 00:19:49","updated_at":"2026-07-22 00:33:45","pushed_at":"2026-07-22 00:20:00","inserted_at":"2026-07-22 04:37:00"},{"id":"1307694175","cve_id":"CVE-2026-53913","name":"CVE-2026-53913","owner":"oscerd","full_name":"oscerd\/CVE-2026-53913","html_url":"https:\/\/github.com\/oscerd\/CVE-2026-53913","description":"PoC reproducer for CVE-2026-53913 (Apache Camel camel-keycloak): KeycloakSecurityPolicy fails open in the Basic Setup \u2014 with no required roles\/permissions the token is never verified, so any forged\/garbage bearer token bypasses authentication (unauthenticated RCE). Fixed in 4.18.3\/4.21.0.","stargazers_count":"0","vuln_description":"Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component.\n\nThe KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess(), which performs three checks in sequence: it rejects a request that carries no access token, then - only if requiredRoles is non-empty - validates the roles, and - only if requiredPermissions is non-empty - validates the permissions. The actual cryptographic verification of the bearer access token (signature, issuer and expiry for a local JWT, or active-state and issuer for token introspection) is performed exclusively inside those role and permission checks. KeycloakSecurityPolicy defaults requiredRoles and requiredPermissions to empty - which is the documented 'Basic Setup' - so on a route configured that way the role and permission checks are skipped and the access token is therefore never verified. The token-presence check still rejects ","created_at":"2026-07-21 21:46:27","updated_at":"2026-07-21 21:48:08","pushed_at":"2026-07-21 21:46:30","inserted_at":"2026-07-21 22:37:00"},{"id":"1307657196","cve_id":"CVE-2026-27654","name":"CVE-2026-27654-PoC","owner":"Debajyoti0-0","full_name":"Debajyoti0-0\/CVE-2026-27654-PoC","html_url":"https:\/\/github.com\/Debajyoti0-0\/CVE-2026-27654-PoC","description":"Proof-of-Concept and technical analysis for CVE-2026-27654, a heap-based buffer overflow vulnerability in the NGINX HTTP WebDAV module, including root cause analysis, reproduction, and mitigation.","stargazers_count":"0","vuln_description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","created_at":"2026-07-21 21:05:07","updated_at":"2026-07-21 21:39:40","pushed_at":"2026-07-21 21:37:38","inserted_at":"2026-07-21 22:37:00"},{"id":"1307647536","cve_id":"CVE-2024-3094","name":"xz","owner":"x-cmd-build","full_name":"x-cmd-build\/xz","html_url":"https:\/\/github.com\/x-cmd-build\/xz","description":"Vendored xz-utils @ 5.8.3 (post-CVE-2024-3094) \u2014 portable binary distribution for x-cmd, musl-static + macOS + Windows MSYS","stargazers_count":"0","vuln_description":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The tarballs included extra .m4 files, which contained instructions for building with automake that did not exist in the repository. These instructions, through a series of complex obfuscations, extract a prebuilt object file from one of the test archives, which is then used to modify specific functions in the code while building the liblzma package. This issue results in liblzma being used by additional software, like sshd, to provide functionality that will be interpreted by the modified functions.","created_at":"2026-07-21 20:53:38","updated_at":"2026-07-21 21:38:37","pushed_at":"2026-07-21 21:37:25","inserted_at":"2026-07-21 22:36:58"},{"id":"1307625965","cve_id":"CVE-2026-43499","name":"CVE-2026-43499-Redmi-Turbo5","owner":"Petalrain224","full_name":"Petalrain224\/CVE-2026-43499-Redmi-Turbo5","html_url":"https:\/\/github.com\/Petalrain224\/CVE-2026-43499-Redmi-Turbo5","description":"Use CVE-2026-43499 on Redmi Turbo 5 to escalate privilege","stargazers_count":"0","vuln_description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n  1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n  2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n     dangling pointer primed for UAF around.\n\n  3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n     task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n  \tchangelog ]","created_at":"2026-07-21 20:28:41","updated_at":"2026-07-21 20:49:58","pushed_at":"2026-07-21 20:49:00","inserted_at":"2026-07-21 22:37:00"},{"id":"1307599424","cve_id":"CVE-2026-30623","name":"mcpshield","owner":"csinexus","full_name":"csinexus\/mcpshield","html_url":"https:\/\/github.com\/csinexus\/mcpshield","description":"Drop-in fix for the unpatched MCP STDIO command-injection flaw (CVE-2026-30623 family)","stargazers_count":"0","vuln_description":null,"created_at":"2026-07-21 19:57:26","updated_at":"2026-07-21 20:09:09","pushed_at":"2026-07-21 20:08:51","inserted_at":"2026-07-21 22:37:00"},{"id":"1307584544","cve_id":"CVE-2025-20352","name":"CVE-2025-20352","owner":"sentinel-aidefense","full_name":"sentinel-aidefense\/CVE-2025-20352","html_url":"https:\/\/github.com\/sentinel-aidefense\/CVE-2025-20352","description":"CVE-2025-20352 Research writeup","stargazers_count":"0","vuln_description":"A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following:\r\n\r \r An authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software. To cause the DoS, the attacker must have the SNMPv2c or earlier read-only community string or valid SNMPv3 user credentials. \r An authenticated, remote attacker with high privileges could execute code as the root user on an affected device that is running Cisco IOS XE Software. To execute code as the root user, the attacker must have the SNMPv1 or v2c read-only community string or valid SNMPv3 user credentials and administrative or privilege 15 credentials on the affected device. \r \r An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks. \r\n\r This vulnerability is due to a stack overflow condition in the ","created_at":"2026-07-21 19:39:27","updated_at":"2026-07-21 19:39:55","pushed_at":"2026-07-21 19:39:51","inserted_at":"2026-07-21 22:36:59"},{"id":"1307547618","cve_id":"CVE-2025-64512","name":"CVE-2025-64512","owner":"BardLaudian","full_name":"BardLaudian\/CVE-2025-64512","html_url":"https:\/\/github.com\/BardLaudian\/CVE-2025-64512","description":"CLI wrapper around the official PoC for CVE-2025-64512 \u2014 pdfminer.six insecure pickle deserialization via crafted PDF (RCE)","stargazers_count":"0","vuln_description":"Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the `cmap\/` directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the issue.","created_at":"2026-07-21 18:56:44","updated_at":"2026-07-21 19:08:37","pushed_at":"2026-07-21 19:06:51","inserted_at":"2026-07-21 22:37:00"},{"id":"1307546940","cve_id":"CVE-2026-49365","name":"CVE-2026-49365","owner":"oscerd","full_name":"oscerd\/CVE-2026-49365","html_url":"https:\/\/github.com\/oscerd\/CVE-2026-49365","description":"PoC reproducer for CVE-2026-49365 (Apache Camel camel-netty-http \/ camel-undertow): muteException defaults to false, so an uncaught exception's full Java stack trace is returned to the HTTP client (CWE-209). Fixed in 4.14.8\/4.18.3\/4.21.0.","stargazers_count":"0","vuln_description":"Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component.\n\nThe camel-netty-http HTTP server consumer exposes a muteException option that controls what is returned to the client when a route processing error occurs. This option defaulted to false because the backing field was an uninitialised primitive boolean (Java's default of false), whereas the other Camel HTTP server components (camel-http \/ camel-jetty \/ camel-servlet and camel-platform-http) default it to true. With muteException=false, when a request triggers an exception during route processing the consumer writes the full Throwable stack trace into the HTTP response body as text\/plain (via DefaultNettyHttpBinding) instead of returning an empty body. Any unauthenticated client that can reach the endpoint and cause a processing error - for example by sending a malformed request body, an invalid parameter, or otherwise triggering a route-internal failure - therefore receives a complete Java stack tr","created_at":"2026-07-21 18:55:57","updated_at":"2026-07-21 18:56:56","pushed_at":"2026-07-21 18:56:01","inserted_at":"2026-07-21 22:37:00"},{"id":"1307521110","cve_id":"CVE-2026-13233","name":"drupal-openai-provider-ssrf-cve-2026-13233","owner":"KuniNogu","full_name":"KuniNogu\/drupal-openai-provider-ssrf-cve-2026-13233","html_url":"https:\/\/github.com\/KuniNogu\/drupal-openai-provider-ssrf-cve-2026-13233","description":"CVE-2026-13233 (Drupal OpenAI Provider, SA-CONTRIB-2026-053): response-URL SSRF \/ local file read. Untrusted upstream, not the prompt. Safe reproducer + detections. Fixed in 1.1.1\/1.2.2.","stargazers_count":"0","vuln_description":null,"created_at":"2026-07-21 18:27:25","updated_at":"2026-07-21 18:42:22","pushed_at":"2026-07-21 18:42:15","inserted_at":"2026-07-21 22:37:00"},{"id":"1307514155","cve_id":"CVE-2026-49099","name":"CVE-2026-49099","owner":"oscerd","full_name":"oscerd\/CVE-2026-49099","html_url":"https:\/\/github.com\/oscerd\/CVE-2026-49099","description":"PoC reproducer for CVE-2026-49099 (Apache Camel camel-salesforce): the non-Camel-prefixed sObjectQuery header escapes the HTTP header filter and overrides the producer's configured SOQL (SOQL injection \/ broken access control). Fixed in 4.14.8\/4.18.3\/4.21.0.","stargazers_count":"0","vuln_description":"Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component.\n\nThe camel-salesforce producer resolves its operation parameters - the SOQL query, the SOSL search, the target SObject name and id, the Apex REST URL and method, and the Apex query parameters - from Exchange message headers, reading the header in preference to the value configured on the endpoint (AbstractSalesforceProcessor.getParameter() reads the header first and uses the endpoint configuration only as a fallback). The control-header constants in SalesforceEndpointConfig (for example SOBJECT_QUERY = sObjectQuery, SOBJECT_SEARCH = sObjectSearch, SOBJECT_NAME = sObjectName, SOBJECT_ID = sObjectId, APEX_URL = apexUrl, APEX_METHOD = apexMethod, and the apexQueryParam. prefix) used plain, non-Camel-prefixed values. Because these names do not start with the Camel \/ camel prefix, HttpHeaderFilterStrategy - which blo","created_at":"2026-07-21 18:20:20","updated_at":"2026-07-21 18:20:39","pushed_at":"2026-07-21 18:20:23","inserted_at":"2026-07-21 22:37:00"},{"id":"1307487661","cve_id":"CVE-2025-68613","name":"n8n-cve-2026-21858","owner":"qianlijaingshan","full_name":"qianlijaingshan\/n8n-cve-2026-21858","html_url":"https:\/\/github.com\/qianlijaingshan\/n8n-cve-2026-21858","description":"CVE-2026-21858 + CVE-2025-68613 \u2014 n8n unauthenticated file read to RCE exploit","stargazers_count":"0","vuln_description":"n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should cons","created_at":"2026-07-21 17:56:03","updated_at":"2026-07-21 18:04:35","pushed_at":"2026-07-21 18:03:26","inserted_at":"2026-07-21 22:37:00"}]}