PoC Archive PoC Archive

tag

Self-Hosted

  • CVE-2026-60004 web HIGH 8.8

    Gitea — diffpatch API Git Hook Remote Code Execution (CVE-2026-60004)

    CVE-2026-60004 is an authenticated remote code execution vulnerability in the Gitea diffpatch API. The endpoint applies a supplied patch with git apply --cached, which should only update the index and never write files to disk. However, by sending the same…

    Patched 2026-08-09
  • CVE-2026-26012 web MEDIUM 6.5

    Vaultwarden Organization Collection Permissions Bypass & Cipher Enumeration (CVE-2026-26012)

    CVE-2026-26012 is a broken access control vulnerability in Vaultwarden's organization cipher endpoint. The /api/ciphers/organization-details endpoint is reachable by any organization member regardless of their assigned collection permissions, and internally…

    Patched 2026-07-05
  • CVE-2026-35037 web HIGH

    Unauthenticated SSRF in Ech0 via /api/website/title (CVE-2026-35037)

    Ech0's GET /api/website/title endpoint fetches a URL supplied by the (unauthenticated) caller to extract a website's title, without restricting the target to safe, external hosts. This allows an unauthenticated attacker to force the Ech0 server to make…

    Patched 2026-07-05
  • CVE-2026-27626 / GHSA-49gm-hh7w-wfvf web CRITICAL 9.9

    OliveTin OS Command Injection via Shell Mode Arguments (CVE-2026-27626)

    OliveTin lets administrators expose predefined shell commands ("Actions") to end users via a web UI or webhooks, relying on checkShellArgumentSafety() to sanitize user-supplied argument values before they are templated into a command string and passed to sh…

    Unverified 2026-07-05
  • None assigned as of 2026-07-03 web CRITICAL

    Gogs Admin User Edit CSRF to Git Hook RCE

    Gogs' admin user-edit route (POST /admin/users/:userid) performs the state-changing grant of IsAdmin/AllowGitHook without a CSRF token, so an authenticated site administrator can be induced (e.g., via a cross-site form submission) to grant those rights to an…

    Unverified 2026-07-03
  • CVE-2026-44578 web HIGH 8.6 EPSS 39%

    Next.js WebSocket Upgrade SSRF (Self-Hosted) (CVE-2026-44578)

    CVE-2026-44578 is a server-side request forgery (SSRF) vulnerability in self-hosted Next.js WebSocket upgrade handling. A crafted HTTP request with Upgrade: websocket can coerce vulnerable versions into proxying to attacker-chosen internal targets on port 80…

    Patched 2026-05-17
  • CVE-2026-44577 web MEDIUM 5.9

    Next.js Image Optimization API OOM DoS (Self-Hosted) (CVE-2026-44577)

    CVE-2026-44577 is a denial-of-service issue in Next.js Image Optimization on self-hosted deployments. In vulnerable builds, /next/image can fetch very large local assets into memory without an effective size cap and then perform expensive image…

    Patched 2026-05-17