Drive-By — PoC Archivehttps://poc.intelseclab.com/tags/drive-by/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Nhost Local MCP Server Unauthenticated CORS Bypass Leading to Full Project Takeover (CVE-2026-34200)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34200-nhost-mcp-cors-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34200-nhost-mcp-cors-takeover/Critical severity (CVSS 9.6) — web · CVE-2026-34200 (GHSA-6c5x-3h35-vvw2). Status: PoC. Affects: Nhost CLI local MCP server (nhost mcp start). Tags: mcp, cors, csrf, drive-by, cors-bypass, credential-theft, hasura, dns-rebinding.webCriticalmcpcorscsrfdrive-bycors-bypasscredential-thefthasuradns-rebindingChrome CSSFontFeatureValuesMap Use-After-Free (CVE-2026-2441)https://poc.intelseclab.com/pocs/web/2026-05-16_chrome-cssfontfeaturevaluesmap-use-after-free/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-16_chrome-cssfontfeaturevaluesmap-use-after-free/High severity (CVSS 8.8) — web · CVE-2026-2441. Status: Weaponized. Affects: Google Chrome / Chromium-based browsers (Blink CSS engine). Tags: use-after-free, Chrome, Blink, CSSOM, renderer-rce, unauthenticated, drive-by.webHighuse-after-freeChromeBlinkCSSOMrenderer-rceunauthenticateddrive-by