Every new exploit,
on the radar.

CVE-2025-69214 - OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)

CVE-2025-69213 - OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)

CVE-2025-69215 - OpenSTAManager has an SQL Injection in the Stampe Module

CVE-2025-69216 - OpenSTAManager has a SQL Injection in Scadenzario Print Template

CVE-2026-22243 - EGroupware has SQL Injection in Nextmatch Filter Processing

CVE-2025-65950 - WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameter

CVE-2025-68400 - ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php

CVE-2026-33340: Critical SSRF in lollms-webui /api/proxy - Unauthenticated arbitrary request forgery (CVSS 9.1)

Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1

Full unauthenticated RCE proof of concept for Rocket.Chat 3.12.1 CVE-2021-22911

CVE-2021-22911 Rocket.Chat NoSQL Injection RCE Exploit - Educational Purpose

Modifed ver of the original exploit to save some times on password reseting for unprivileged user

exploit for CVE-2021-22911 in rust

CVE-2026-4350 - Perfmatters WordPress Arbitrary File Deletion

CVE-2026-30862 | appsmith Privilege Escalation(xss)

PoC for CVE-2026-4660: arbitrary file read via git checkout in hashicorp/go-getter

A Bluetooth Classic RFCOMM service is exposed without enforcing secure authentication or proper access control. Once within range, any device can: Establish …

Security advisory for CVE-2026-31048

A security assessment of the Beat XP VEGA Smartwatch (Firmware RB303ATV006229) focused on Bluetooth Low Energy (BLE) connectivity revealed a design and impleme…

Advisory for basic-ftp ⌯⌲ 20 mill weekly downloads

CVE-2026-39376(Infinite redirect loop DoS via meta-refresh chain)

POC for CVE-2026-5530 - SSRF via Ollama Pull/Push API

A PoC script for demonstrating CVE-2026-33033