Remote Code Execution - 20 analyses

Root cause analyses and proof-of-concepts for remote code execution flaws, from the patch diff to a working exploit.

Published work on this topic

2026-08-20	CVE-2026-47686	CVE-2026-47686: vm2 Sandbox Escape - RCE	PoC
2026-08-15	CVE-2026-34486	CVE-2026-34486: Tomcat Tribes RCE	PoC
2026-08-13	CVE-2026-67282	CVE-2026-67282: Fabrik Unauthenticated RCE	PoC
2026-08-13	CVE-2026-18391	CVE-2026-18391: WooCommerce Subscriptions - RCE	PoC
2026-08-11	CVE-2026-66915	CVE-2026-66915: Fabrik Calc Element RCE	PoC
2026-08-11	CVE-2026-72899	CVE-2026-72899: Metabase Unauthenticated SQL Injection	PoC
2026-08-11	CVE-2025-24813	CVE-2025-24813: Apache Tomcat Partial PUT RCE	PoC
2026-08-10	CVE-2026-13001	CVE-2026-13001: Podlove Podcast Publisher RCE	PoC
2026-08-08	CVE-2026-14364	CVE-2026-14364: TrueBooker Auth Bypass	PoC
2026-08-07	CVE-2026-64638	CVE-2026-64638: WordPress XSS2Shell Pre-Auth RCE	PoC
2026-08-04	CVE-2026-42208	CVE-2026-42208: LiteLLM Pre-Auth SQL Injection	PoC
2026-08-04	CVE-2026-9082	CVE-2026-9082: Drupal SQL Injection	PoC
2026-08-04	CVE-2026-69251	CVE-2026-69251: Flowise Authenticated RCE	PoC
2026-08-01	CVE-2025-8110	CVE-2025-8110: Gogs Symlink-Following RCE	PoC
2026-07-30	CVE-2026-44966	CVE-2026-44966: Velocity.js Prototype Pollution	PoC
2026-07-28	CVE-2026-45668	CVE-2026-45668: Trilium Notes - RCE via Path Traversal	PoC
2026-07-24	CVE-2026-63030	CVE-2026-63030: WordPress wp2shell Pre-Auth RCE	PoC
2026-07-22	CVE-2026-47668	CVE-2026-47668: DbGate Unauthenticated RCE	PoC
2026-05-08	CVE-2026-37709	CVE-2026-37709: Snipe-IT - Auth Bypass	PoC
2026-01-26	CVE-2026-24061	CVE-2026-24061: GNU Inetutils - Auth Bypass	PoC

Other topics