PoC Archive PoC Archive

tag

Root

  • CVE-2026-36355 network CRITICAL

    Realtek rtl819x Jungle SDK Unauthenticated Kernel Memory R/W via Debug IOCTLs (CVE-2026-36355)

    The rtl8192cd Wi-Fi kernel driver in Realtek's out-of-tree rtl819x "Jungle SDK" exposes two IOCTLs — writemem (0x89F5) and readmem (0x89F6) — with no access-control checks. These debug handlers are gated only by a macro (IOCTLDEBUGCMD) that is defined…

    Unverified 2026-07-05
  • CVE-2026-39842 / GHSA-7mqr-33rv-p3mp web CRITICAL 10

    OpenRemote — Expression Injection RCE in Rules Engine (CVE-2026-39842)

    OpenRemote's Rules Engine evaluates user-supplied JavaScript rule expressions using the Java Nashorn scripting engine with no sandboxing, SecurityManager, or ClassFilter restrictions. While the API layer explicitly blocks non-superusers from creating Groovy…

    Patched 2026-07-05
  • CVE-2026-41900 cloud HIGH 8.6

    OpenLearnX Unauthenticated RCE via Container Volume Mount (CVE-2026-41900)

    OpenLearnX's /api/compiler/execute endpoint runs untrusted user-submitted code inside a sibling Docker container, but the blueprint carries no authentication decorator, so any unauthenticated request can trigger it. The pre-patch executeincontainer() function…

    Patched 2026-07-05
  • CVE-2026-36356 network CRITICAL EPSS 14%

    MeiG Smart FORGE_SLT711 GoAhead Unauthenticated OS Command Injection (CVE-2026-36356)

    The GoAhead web server bundled with MeiG Smart FORGESLT711 4G LTE CPE devices exposes an unauthenticated HTTP endpoint, /action/SetRemoteAccessCfg, that interpolates user-controlled JSON input into a shell command without sanitization. A single…

    Unverified 2026-07-05
  • CVE-2026-20245 network HIGH 7.8 KEV EPSS 25%

    Cisco Catalyst SD-WAN Manager Privilege Escalation (CVE-2026-20245)

    CVE-2026-20245 is the seventh Cisco SD-WAN zero-day exploited in 2026. An authenticated attacker with netadmin privileges on Cisco Catalyst SD-WAN Manager can upload a specially crafted file to the CLI subsystem, triggering insufficient input validation and…

    Unpatched 2026-06-28
  • N/A network CRITICAL

    TossUp — TerraMaster TOS Unauthenticated Redis Root RCE + NFS LPE

    TossUp is a pair of bugs against TerraMaster TOS NAS devices. The primary issue is that Redis 4.0.10 runs as root and listens on 0.0.0.0:6379 with no authentication — despite /etc/redis.conf containing bind 127.0.0.1, the init script starts Redis as…

    Unpatched 2026-05-18