Recent Advisories

Severity ID Title Vendor Product Date Type
CRITICAL 9.4 CVE-2026-28496

FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE_CVE-2026-28496

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection (SSTI) vulne...

FOSSBilling FOSSBilling < 0.8.0 CVE
CRITICAL 10 CVE-2026-27604

FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions_CVE-2026-27604

FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization byp...

FOSSBilling FOSSBilling >= 0.5.4, < 0.8.0 CVE
CRITICAL 9.8 TRENDMICROBLOG:...

From Langflow to Monero: Inside CVE-2026-33017 Cryptominer_TRENDMICROBLOG:D6D82F6102E243699FEABC242F869EE4

We tracked a cryptocurrency-mining campaign exploiting CVE-2026-33017, which revealed how threat actors are now scanning exposed AI application inf...

N/A N/A TRENDMICROBLOG
CRITICAL 9.3 CVE-2026-56315

picklescan – Remote Code Execution via Unblocked Standard Library Modules_CVE-2026-56315

picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, a...

picklescan picklescan CVE
CRITICAL 9.2 CVE-2026-56258

Crawl4AI – Arbitrary File Write via output_path Symlink and TOCTOU_CVE-2026-56258

Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to w...

Crawl4AI Crawl4AI 0.8.8 CVE
CRITICAL 9.4 CVE-2026-44089

Buffer Overflow in Totolink EX1200L router_CVE-2026-44089

Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. This vulnerability could be ex...

Totolink EX1200L 9.3.5u.6146_B20201023 CVE
CRITICAL 9 CVE-2026-11374

Account Takeover via Predictable SSO Ticket Generation_CVE-2026-11374

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that sessi...

zohocorp manageengine_adselfservice_plus CVE
CRITICAL 9.9 0D199316-3A4E-

exploit-arsenal_0D199316-3A4E-538E-8E6B-0CDCCF55C354

CVE Proof-of-Concept Collection Clean, dependency-free Python 3 proof-of-concept exploits for recent CVEs — each with a concise write-up and a scre...

N/A N/A GITHUBEXPLOIT
CRITICAL 9.8 CVE-2026-12866

CVE-2026-12866_CVE-2026-12866

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by ...

silentmatt expr-eval CVE
CRITICAL 9.8 E92487F1-C41D-

Exploit for CVE-2020-11651_E92487F1-C41D-50E2-969D-FE49942DB8B4

This is an updated verison original git clone https://github.com/jasperla/CVE-2020-11651-poc.git cd CVE-2020-11651-poc when i was using original i ...

N/A N/A GITHUBEXPLOIT