Exploit Security News

Public exploit code, proof-of-concept releases, and technical exploitation write-ups for known vulnerabilities.

Once a vulnerability is disclosed, the risk changes sharply the moment working exploit code goes public: a theoretical bug turns into something any attacker can weaponize. Proof-of-concept releases, exploitation write-ups and additions to exploit frameworks show up here as they appear. A published exploit is usually the signal that patching moves from "should" to "urgent".

Recent Exploit items

CVE-2026-127211 MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to ac...
@cveNotify · Nov 12, 2026
CVE-2026-127209 Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExter...
@cveNotify · Nov 12, 2026
CVE-2026-126346 basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, line feed, or NUL characters, but calls made from response han...
@cveNotify · Nov 12, 2026
CVE-2026-126209 Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.3, Loofah::HTML5::Scrub.allowed_uri? st...
@cveNotify · Nov 12, 2026
CVE-2026-116317 Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector con...
@cveNotify · Nov 12, 2026
CVE-2026-116315 Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexe...
@cveNotify · Nov 12, 2026
CVE-2026-116314 Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive....
@cveNotify · Nov 12, 2026
CVE-2026-114031 Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Win...
@cveNotify · Nov 12, 2026
CVE-2026-113970 A use-after-free issue was addressed with improved memory management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7....
@cveNotify · Nov 12, 2026
CVE-2026-102643 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.m...
@cveNotify · Nov 12, 2026
CVE-2026-123804 SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a p...
@cveNotify · Nov 12, 2026
CVE-2026-124015 XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login b...
@cveNotify · Nov 12, 2026
CVE-2026-124013 XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related serve...
@cveNotify · Nov 12, 2026
CVE-2026-124010 XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xw...
@cveNotify · Nov 12, 2026
CVE-2026-124009 XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell m...
@cveNotify · Nov 12, 2026
CVE-2026-124008 XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrar...
@cveNotify · Nov 12, 2026
CVE-2026-124007 XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell met...
@cveNotify · Nov 12, 2026
CVE-2026-124003 XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers ca...
@cveNotify · Nov 12, 2026
CVE-2026-124002 XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS comma...
@cveNotify · Nov 12, 2026
CVE-2026-127235 A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS Meridian and Horizon. Several web UI pages copy request parameter values...
@cveNotify · Nov 12, 2026
CVE-2026-127203 AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace members to upload blobs with unvalidated Content-Type values that...
@cveNotify · Nov 12, 2026
CVE-2026-127058 WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password w...
@cveNotify · Nov 12, 2026
CVE-2026-126571 Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt lim...
@cveNotify · Nov 12, 2026
CVE-2026-126569 Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escapi...
@cveNotify · Nov 12, 2026
CVE-2026-126567 Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject scrip...
@cveNotify · Nov 12, 2026
CVE-2026-126559 Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject marku...
@cveNotify · Nov 12, 2026
CVE-2026-126498 WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to inject HTML by supplying a malicious post slug via the CreatePost AP...
@cveNotify · Nov 12, 2026
CVE-2026-126495 MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered u...
@cveNotify · Nov 12, 2026
CVE-2026-104060 Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQ...
@cveNotify · Nov 12, 2026
CVE-2026-125383 INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and a...
@cveNotify · Nov 12, 2026

Other topics

CVE
Recent CVE identifiers and vulnerability disclosures aggregated from security feeds: new IDs, published advisories, and the vendors and products they affect.
Ransomware
Ransomware attacks, extortion group activity, victim disclosures and decryptor releases.
Phishing
Phishing campaigns, credential-harvesting kits, and social-engineering techniques used to compromise users and organizations.
Zero-Day
Zero-day vulnerabilities being actively exploited before a patch exists, and the fixes that follow.
Data Breach
Confirmed and reported data breaches: what was exposed, which organizations were affected, and how the incident came to light.
Patch
Vendor patches, security updates and fix releases for previously disclosed vulnerabilities.