Security Articles & Writeups - Page 10

infosecwriteups.com May 29, 2026

CVE-2026-42043: Axios v1.15.0 NO_PROXY SSRF Patch Bypassed via 127.0.0.0/8 Loopback Range

The Axios v1.15.0 patch for CVE-2025-62718 introduced a hardcoded set of only three recognized loopback addresses ('localhost', '127.0.0.1', '::1'), leaving 16+ million valid loopback IPs in the…

CVE-2026-42043

bleepingcomputer.com May 28, 2026

CVE-2026-35616: FortiClient EMS Auth Bypass Exploited to Deploy EKZ Infostealer

Threat actors are actively exploiting an authentication bypass flaw (CVE-2026-35616) in Fortinet's FortiClient Enterprise Management Server to deploy a previously undocumented credential-stealing…

CVE-2026-35616

medium.com May 28, 2026

CVE-2026-42945: Critical Heap Buffer Overflow in NGINX HTTP Rewrite Module (NGINX Rift)

CVE-2026-42945, dubbed 'NGINX Rift', is a critical heap buffer overflow vulnerability in NGINX's ngx_http_rewrite_module.

CVE-2026-42945

POC github.com/friparia May 27, 2026

NGINX Rift: Heap Buffer Overflow in ngx_http_rewrite_module Affects Versions 0.6.27-1.30.1 (CVE-2026-42945, CVE-2026-9256)

Two heap-corruption vulnerabilities in NGINX's ngx_http_rewrite_module affect Open Source versions 0.6.27-1.30.1 and Plus R32-R36.

CVE-2026-42945 CVE-2026-9256

POC github.com/0xBlackash Apr 28, 2026

CVE-2026-41462: Critical Unauthenticated SQL Injection in ProjeQtor ≤ 12.4.3 (CVSS 9.8)

A critical unauthenticated stacked SQL injection vulnerability in ProjeQtor's login functionality allows remote attackers to execute arbitrary SQL without any credentials, affecting versions 7.0…

CVE-2026-41462

POC github.com/nkopylov May 26, 2026

CVE-2026-45321: Mini Shai-Hulud Two-Wave npm Supply Chain Attack Hits TanStack, AntV, and 950+ Packages

The Mini Shai-Hulud campaign (CVE-2026-45321) by threat actor TeamPCP executed two distinct supply chain waves: Wave 1 (May 11, 2026) compromised 42 @tanstack/* packages by exploiting…

CVE-2026-45321

POC github.com/HORKimhab May 24, 2026

CVE-2026-48172: LiteSpeed cPanel Plugin Redis TLS Remote Code Execution via Reverse Shell

CVE-2026-48172 is a remote code execution vulnerability in the LiteSpeed cPanel plugin, exploitable via Redis TLS to establish a reverse shell on affected servers.

CVE-2026-48172

thecyberexpress.com May 27, 2026

CERT-In Mandates 12-Hour Patch Window for Critical Vulnerabilities as AI Accelerates Exploit Development (CVE-2026-0300)

India's CERT-In has published a 38-page cybersecurity framework requiring organizations to patch critical internet-facing vulnerabilities within 12 hours of detection, driven by evidence that AI and…

CVE-2026-0300

POC github.com/Chocapikk Apr 09, 2026

POC: Xboard / V2Board Unauth Account Takeover - Magic Link Token Leak (CVE-2026-39912)

Proof-of-concept for CVE-2026-39912. Xboard / V2Board Unauth Account Takeover - Magic Link Token Leak (CVE-2026-39912) Language: Python

CVE-2026-39912

POC github.com/DepthFirstDisclosures May 13, 2026

POC: exploit for CVE-2026-42945

Proof-of-concept for CVE-2026-42945. exploit for CVE-2026-42945 Language: Python | Stars: 813

CVE-2026-42945

POC github.com/7h30th3r0n3 May 21, 2026

POC: Drupal Core PostgreSQL SQL Injection PoC - CVE-2026-9082. Ethical PoC for the Drupal vulnerability allowing anonymous SQ

Proof-of-concept for CVE-2026-9082. Drupal Core PostgreSQL SQL Injection PoC - CVE-2026-9082.

CVE-2026-9082

sentinelone.com May 22, 2026

First VPN Seized by Europol, 506 Cybercriminals Identified; Microsoft Defender Zero-Days CVE-2026-41091 & CVE-2026-45498 Exploited

Europol dismantled First VPN, a service used by ransomware actors and cybercriminals, seizing 33 servers across 27 countries and identifying 506 users tied to ongoing fraud and ransomware…

CVE-2026-41091 CVE-2026-45498

POC github.com/HORKimhab May 22, 2026

CVE-2026-34926: Proof-of-Concept Repository Published (Insufficient Detail Available)

A proof-of-concept repository for CVE-2026-34926 has been published, but the available content contains no technical details about the affected software, vulnerability class, attack vector, or…

CVE-2026-34926

POC github.com/fangbarristerbar May 15, 2026

CVE-2026-20182: Cisco Catalyst SD-WAN Auth Bypass via DTLS Handshake Enables Unauthenticated Remote Access

CVE-2026-20182 is a critical authentication bypass in the vdaemon service (UDP/12346) of Cisco Catalyst SD-WAN Controller and Manager, exploitable via a malformed DTLS peering handshake to gain…

CVE-2026-20182

POC github.com/0xBlackash May 21, 2026

CVE-2026-41091: Microsoft Defender Elevation of Privilege via Link-Following Flaw (RedSun PoC)

CVE-2026-41091 (CVSS 7.8) is an actively exploited local privilege escalation vulnerability in Microsoft Defender's Malware Protection Engine, where improper link resolution during cloud-tagged file…

CVE-2026-41091

medium.com May 19, 2026

CVE-2026-47092: CVSS 7.8 RCE Vulnerability in Popular Claude Code Developer Tool, Patched in Commit 234d9aa

CVE-2026-47092 is a remote code execution vulnerability (CVSS 7.8) affecting a tool widely used by Claude Code developers, potentially exposing thousands of development environments to arbitrary code…

CVE-2026-47092

medium.com May 19, 2026

CVE-2026-45430: Critical OAuth Trust Vulnerability in Backdrop CMS Salesforce Module

CVE-2026-45430 is a critical vulnerability affecting the Salesforce OAuth integration module in Backdrop CMS, enabling attackers to exploit flaws in OAuth trust handling.

CVE-2026-45430

geochen.medium.com May 20, 2026

CVE-2026-5511: Improper Input Validation in TP-Link Archer AX72 Diagnostic Interface

CVE-2026-5511 is an improper input validation vulnerability affecting the TP-Link Archer AX72 router, exploitable via its diagnostic interface.

CVE-2026-5511

medium.com May 14, 2026

CVE-2026-46300 Fragnesia: Linux Kernel Privilege Escalation to Root

CVE-2026-46300, dubbed Fragnesia, is a critical Linux kernel vulnerability that enables unauthenticated attackers to escalate privileges and gain root access.

CVE-2026-46300

medium.com May 14, 2026

CVE-2026-42945: Critical NGINX Vulnerability Discovered After 18 Years

A critical security flaw was identified in NGINX on May 13, 2026, that had remained undetected since 2008, affecting one of the internet's most widely deployed web servers.

CVE-2026-42945