חולשות ואקספלויטים

קטלוג אקספלויטים

חולשות zero-day מהמחקר שלנו וחולשות n-day ששוחזרו מפריצות. כל ניתוח מפרט את הסיווג, את ההשפעה, כיצד לזהות אותה, וקישור להוכחת היתכנות ציבורית.

אקספלויטים

21 מטרות

עם CVE

הוקצה

ב-CISA KEV

מנוצלות בפועל

עם דוח מלא

ניתוח מקושר

djangorestframework 1

djangorestframework remote code execution (CVE-2026-114137) CVSS 7.4 HighEPSS 0.35% (p27) CVE-2026-114137 n-day Arbitrary code execution against the vulnerable build October 21, 2026

org.http4s:http4s-scala-xml_2.12 1

org.http4s:http4s-scala-xml_2.12 remote code execution (CVE-2026-61741) CVSS 9.3 CriticalEPSS 0.29% (p20) CVE-2026-61741 n-day Arbitrary code execution against the vulnerable build September 24, 2026

io.moquette:moquette-broker 1

io.moquette:moquette-broker remote code execution (CVE-2026-85724) CVSS 9.6 CriticalEPSS 0.27% (p17) CVE-2026-85724 n-day Arbitrary code execution against the vulnerable build September 23, 2026

lightrag-hku 1

lightrag-hku remote code execution (CVE-2026-85734) CVSS 9.1 CriticalEPSS 0.36% (p27) CVE-2026-85734 n-day Arbitrary code execution against the vulnerable build September 22, 2026

mcp-atlassian 1

mcp-atlassian remote code execution (CVE-2026-77244) CVSS 10.0 CriticalEPSS 0.50% (p42) CVE-2026-77244 n-day Arbitrary code execution against the vulnerable build September 22, 2026

lmdeploy 2

lmdeploy remote code execution (CVE-2025-66455) CVSS 9.8 CriticalEPSS 0.70% (p52) CVE-2025-66455 n-day Arbitrary code execution from loading untrusted input September 18, 2026
lmdeploy remote code execution (CVE-2026-33625) CVSS 8.8 HighEPSS 0.24% (p16) CVE-2026-33625 n-day Arbitrary code execution against the vulnerable build September 18, 2026

org.opencastproject:opencast-engage-paella-player-7 1

org.opencastproject:opencast-engage-paella-player-7 remote code execution (CVE-2026-77615) CVSS 8.7 HighEPSS 0.39% (p33) CVE-2026-77615 n-day Arbitrary code execution against the vulnerable build September 17, 2026

@vendure/core 1

@vendure/core remote code execution (CVE-2026-63472) CVSS 9.1 Critical CVE-2026-63472 n-day Arbitrary code execution against the vulnerable build September 17, 2026

djust 1

djust remote code execution (CVE-2026-61594) CVSS 9.1 CriticalEPSS 0.43% (p36) CVE-2026-61594 n-day Arbitrary code execution against the vulnerable build September 16, 2026

org.http4s:http4s-ember-core_2.12 1

org.http4s:http4s-ember-core_2.12 remote code execution (CVE-2026-69204) CVSS 9.2 CriticalEPSS 0.33% (p26) CVE-2026-69204 n-day Arbitrary code execution against the vulnerable build September 15, 2026

@zereight/mcp-gitlab 1

@zereight/mcp-gitlab remote code execution (CVE-2026-61568) CVSS 9.6 CriticalEPSS 0.32% (p25) CVE-2026-61568 n-day Arbitrary code execution against the vulnerable build September 15, 2026

yayson 1

yayson remote code execution (CVE-2026-61534) CVSS 9.1 Critical CVE-2026-61534 n-day Arbitrary code execution against the vulnerable build September 14, 2026

morgan 1

morgan remote code execution (CVE-2026-87859) CVSS 5.3 MediumEPSS 0.41% (p33) CVE-2026-87859 n-day Arbitrary code execution against the vulnerable build September 11, 2026

open-webui 1

open-webui remote code execution (CVE-2026-88006) CVSS 6.5 Medium CVE-2026-88006 n-day Arbitrary code execution against the vulnerable build September 10, 2026

httpx2 3

httpx2 remote code execution (CVE-2026-84378) CVSS 5.9 Medium CVE-2026-84378 n-day Arbitrary code execution against the vulnerable build September 2, 2026
httpx2 remote code execution (CVE-2026-84380) CVSS 5.6 Medium CVE-2026-84380 n-day Arbitrary code execution against the vulnerable build September 2, 2026
httpx2 remote code execution (CVE-2026-84382) CVSS 7.5 High CVE-2026-84382 n-day Arbitrary code execution against the vulnerable build September 2, 2026

gitpython 1

gitpython remote code execution (CVE-2026-78676) CVSS 9.8 Critical CVE-2026-78676 n-day Arbitrary code execution against the vulnerable build August 25, 2026

nltk 2

nltk remote code execution (CVE-2026-78683) CVSS 9.6 Critical CVE-2026-78683 n-day Arbitrary code execution from loading untrusted input August 25, 2026
nltk remote code execution (CVE-2026-79657) CVSS 9.8 Critical CVE-2026-79657 n-day Arbitrary code execution from loading untrusted input August 25, 2026

vllm 4

vllm remote code execution (CVE-2026-71486) CVSS 4.3 Medium CVE-2026-71486 n-day Arbitrary code execution from loading untrusted input August 17, 2026
vllm remote code execution (CVE-2026-73560) CVSS 6.5 Medium CVE-2026-73560 n-day Arbitrary code execution against the vulnerable build August 17, 2026
vllm remote code execution (CVE-2026-73557) CVSS 6.3 Medium CVE-2026-73557 n-day Arbitrary code execution from loading untrusted input August 13, 2026
vllm remote code execution (CVE-2026-73558) CVSS 5.3 Medium CVE-2026-73558 n-day Arbitrary code execution against the vulnerable build August 13, 2026

@mockoon/commons-server 1

@mockoon/commons-server remote code execution (CVE-2026-59148) CVSS 8.8 High CVE-2026-59148 n-day Arbitrary code execution against the vulnerable build July 9, 2026

Linux kernel 1

getroot — AF_ALG page-cache LPE and container escape CVSS 8.8 High CVE-2026-31431 n-day Local privilege escalation to root, with escape from a container to the host June 15, 2026

PyYAML 1

PyYAML FullLoader deserialization RCE (CVE-2020-14343) CVSS 9.8 Critical CVE-2020-14343 n-day Arbitrary code execution from loading untrusted input February 9, 2021

הוכחת היתכנות וטיפול

כאשר הוכחת היתכנות כבר פומבית, הניתוח מקשר אליה ישירות. כל מה שמקוטלג כאן אמיתי, וחלקו קוד אקספלויט עובד, לכן הריצו כל פריט רק ב-VM חד-פעמי ללא נתיב לרשת שאתם משתמשים בה. לכל פריט ללא קישור ציבורי, כתבו אל [email protected] וציינו מי אתם ולמה אתם צריכים אותו.