Уязвимости и эксплойты

Каталог эксплойтов

Zero-day из наших собственных исследований и n-day, извлечённые из вторжений. В каждом разборе указаны класс, последствия, способ обнаружения и ссылка на публичный proof-of-concept.

Эксплойты

целей: 21

С CVE

присвоен

В CISA KEV

подтверждённая эксплуатация

С полным отчётом

со ссылкой на разбор

djangorestframework 1

djangorestframework remote code execution (CVE-2026-114137) CVSS 7.4 HighEPSS 0.35% (p27) CVE-2026-114137 n-day Arbitrary code execution against the vulnerable build October 21, 2026

org.http4s:http4s-scala-xml_2.12 1

org.http4s:http4s-scala-xml_2.12 remote code execution (CVE-2026-61741) CVSS 9.3 CriticalEPSS 0.29% (p20) CVE-2026-61741 n-day Arbitrary code execution against the vulnerable build September 24, 2026

io.moquette:moquette-broker 1

io.moquette:moquette-broker remote code execution (CVE-2026-85724) CVSS 9.6 CriticalEPSS 0.27% (p17) CVE-2026-85724 n-day Arbitrary code execution against the vulnerable build September 23, 2026

lightrag-hku 1

lightrag-hku remote code execution (CVE-2026-85734) CVSS 9.1 CriticalEPSS 0.36% (p27) CVE-2026-85734 n-day Arbitrary code execution against the vulnerable build September 22, 2026

mcp-atlassian 1

mcp-atlassian remote code execution (CVE-2026-77244) CVSS 10.0 CriticalEPSS 0.50% (p42) CVE-2026-77244 n-day Arbitrary code execution against the vulnerable build September 22, 2026

lmdeploy 2

lmdeploy remote code execution (CVE-2025-66455) CVSS 9.8 CriticalEPSS 0.70% (p52) CVE-2025-66455 n-day Arbitrary code execution from loading untrusted input September 18, 2026
lmdeploy remote code execution (CVE-2026-33625) CVSS 8.8 HighEPSS 0.24% (p16) CVE-2026-33625 n-day Arbitrary code execution against the vulnerable build September 18, 2026

org.opencastproject:opencast-engage-paella-player-7 1

org.opencastproject:opencast-engage-paella-player-7 remote code execution (CVE-2026-77615) CVSS 8.7 HighEPSS 0.39% (p33) CVE-2026-77615 n-day Arbitrary code execution against the vulnerable build September 17, 2026

@vendure/core 1

@vendure/core remote code execution (CVE-2026-63472) CVSS 9.1 Critical CVE-2026-63472 n-day Arbitrary code execution against the vulnerable build September 17, 2026

djust 1

djust remote code execution (CVE-2026-61594) CVSS 9.1 CriticalEPSS 0.43% (p36) CVE-2026-61594 n-day Arbitrary code execution against the vulnerable build September 16, 2026

org.http4s:http4s-ember-core_2.12 1

org.http4s:http4s-ember-core_2.12 remote code execution (CVE-2026-69204) CVSS 9.2 CriticalEPSS 0.33% (p26) CVE-2026-69204 n-day Arbitrary code execution against the vulnerable build September 15, 2026

@zereight/mcp-gitlab 1

@zereight/mcp-gitlab remote code execution (CVE-2026-61568) CVSS 9.6 CriticalEPSS 0.32% (p25) CVE-2026-61568 n-day Arbitrary code execution against the vulnerable build September 15, 2026

yayson 1

yayson remote code execution (CVE-2026-61534) CVSS 9.1 Critical CVE-2026-61534 n-day Arbitrary code execution against the vulnerable build September 14, 2026

morgan 1

morgan remote code execution (CVE-2026-87859) CVSS 5.3 MediumEPSS 0.41% (p33) CVE-2026-87859 n-day Arbitrary code execution against the vulnerable build September 11, 2026

open-webui 1

open-webui remote code execution (CVE-2026-88006) CVSS 6.5 Medium CVE-2026-88006 n-day Arbitrary code execution against the vulnerable build September 10, 2026

httpx2 3

httpx2 remote code execution (CVE-2026-84378) CVSS 5.9 Medium CVE-2026-84378 n-day Arbitrary code execution against the vulnerable build September 2, 2026
httpx2 remote code execution (CVE-2026-84380) CVSS 5.6 Medium CVE-2026-84380 n-day Arbitrary code execution against the vulnerable build September 2, 2026
httpx2 remote code execution (CVE-2026-84382) CVSS 7.5 High CVE-2026-84382 n-day Arbitrary code execution against the vulnerable build September 2, 2026

gitpython 1

gitpython remote code execution (CVE-2026-78676) CVSS 9.8 Critical CVE-2026-78676 n-day Arbitrary code execution against the vulnerable build August 25, 2026

nltk 2

nltk remote code execution (CVE-2026-78683) CVSS 9.6 Critical CVE-2026-78683 n-day Arbitrary code execution from loading untrusted input August 25, 2026
nltk remote code execution (CVE-2026-79657) CVSS 9.8 Critical CVE-2026-79657 n-day Arbitrary code execution from loading untrusted input August 25, 2026

vllm 4

vllm remote code execution (CVE-2026-71486) CVSS 4.3 Medium CVE-2026-71486 n-day Arbitrary code execution from loading untrusted input August 17, 2026
vllm remote code execution (CVE-2026-73560) CVSS 6.5 Medium CVE-2026-73560 n-day Arbitrary code execution against the vulnerable build August 17, 2026
vllm remote code execution (CVE-2026-73557) CVSS 6.3 Medium CVE-2026-73557 n-day Arbitrary code execution from loading untrusted input August 13, 2026
vllm remote code execution (CVE-2026-73558) CVSS 5.3 Medium CVE-2026-73558 n-day Arbitrary code execution against the vulnerable build August 13, 2026

@mockoon/commons-server 1

@mockoon/commons-server remote code execution (CVE-2026-59148) CVSS 8.8 High CVE-2026-59148 n-day Arbitrary code execution against the vulnerable build July 9, 2026

Linux kernel 1

getroot — AF_ALG page-cache LPE and container escape CVSS 8.8 High CVE-2026-31431 n-day Local privilege escalation to root, with escape from a container to the host June 15, 2026

PyYAML 1

PyYAML FullLoader deserialization RCE (CVE-2020-14343) CVSS 9.8 Critical CVE-2020-14343 n-day Arbitrary code execution from loading untrusted input February 9, 2021

Доказательство концепции и правила обращения

Там, где proof-of-concept уже опубликован, разбор ссылается прямо на него. Всё в этом каталоге реально, и часть материалов является рабочим кодом эксплойтов, поэтому запускайте что бы то ни было только в одноразовой VM без маршрута в сеть, которой вы пользуетесь. По всему, что без публичной ссылки, пишите на [email protected], указав, кто вы и для чего вам это нужно.