773 PoCs | 119 CISA KEV

tag

Gadget-Chain

Roundcube Webmail Post-Auth RCE via PHP Object Deserialization (CVE-2025-49113) KEV EPSS 99%

CVE-2025-49113 web Patched

CVE-2025-49113webCRITICAL 9.9Patched2026-07-06Laravel Livewire Remote Code Execution via Known APP_KEY (CVE-2025-54068) KEV EPSS 96%

CVE-2025-54068 web Patched

CVE-2025-54068webCRITICAL 9.8Patched2026-07-06GiveWP Unauthenticated PHP Object Injection via Weak Serialized-Data Regex Check (CVE-2025-22777)

CVE-2025-22777 web Patched

CVE-2025-22777webCRITICAL 9.8Patched2026-07-06Apache Camel `camel-consul` ConsulRegistry Deserialization RCE (CVE-2026-27172)

CVE-2026-27172 web Patched

CVE-2026-27172webCRITICAL 9.8Patched2026-07-06WP Activity Log Unauthenticated PHP Object Injection — CVE-2026-54806

CVE-2026-54806 web Patched

CVE-2026-54806webCRITICAL 9.8Patched2026-07-05SP LMS PHP Object Injection → Unauthenticated RCE (CVE-2026-48909)

CVE-2026-48909 (GHSA-gf8c-xmwj-whrh) web Patched

CVE-2026-48909webCRITICAL 9.5Patched2026-07-05OpenAM Pre-Authentication RCE via `jato.clientSession` Deserialization (CVE-2026-33439) EPSS 10%

CVE-2026-33439 web Patched

CVE-2026-33439webCRITICAL 9.8Patched2026-07-05Group-Office PHP Deserialization Remote Code Execution (CVE-2026-34838)

CVE-2026-34838 (GHSA-h22j-frrf-5vxq) web Patched

CVE-2026-34838webCRITICALPatched2026-07-05Apache Tomcat Tribes EncryptInterceptor Fail-Open Unauthenticated RCE (CVE-2026-34486) KEV EPSS 99%

CVE-2026-34486 web Patched

CVE-2026-34486webCRITICALPatched2026-07-05Apache MINA acceptMatchers Deserialization Filter Bypass to RCE (CVE-2026-42779)

CVE-2026-42779 network Patched

CVE-2026-42779networkCRITICAL 9.8Patched2026-07-05