https://vulnerability.circl.lu/sightings/feed 2026-09-02T23:06:11.017516+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/05625443-6adc-44e8-addd-e4b3e1f954d6/export 2026-09-02T23:06:11.043984+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "05625443-6adc-44e8-addd-e4b3e1f954d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-55315", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17056", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE Discovered \u2013 Weekly Report\nEvery week, new vulnerability research and exploit Proof-of-Concepts are published on GitHub by security researchers around the world.\nBelow are some notable CVE PoC repositories discovered this week, useful for vulnerability research, exploit analysis, and security education.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-24061\n\ud83c\udfaf GNU inetutils-telnetd Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/JayGLXR/CVE-2026-24061-POC\n\n\ud83e\udde0 Overview\nA critical vulnerability affecting GNU inetutils telnetd allows attackers to bypass authentication and gain root shell access.\nThe exploit abuses the NEW_ENVIRON telnet option to inject crafted environment variables that result in authentication bypass.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Remote root access\n\u2022 CVSS 9.8 (Critical)\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-27831\n\ud83c\udfaf rldns DNS Server Heap Out-of-Bounds Read\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/bluedragonsecurity/CVE-2026-27831-POC\n\n\ud83e\udde0 Overview\nA memory safety vulnerability in rldns DNS server 1.3 allows attackers to trigger a heap out-of-bounds read, which may crash the server and cause denial-of-service conditions.\n\n\u2699\ufe0f Impact\n\u2022 DNS server crash\n\u2022 Denial of Service\n\u2022 Memory corruption issue\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-1731\n\ud83c\udfaf BeyondTrust Remote Support \u2013 Command Injection\n\n\ud83d\udd17 Research / PoC\nhttps://github.com/win3zz/CVE-2026-1731\n\n\ud83e\udde0 Overview\nA command injection vulnerability affecting BeyondTrust Remote Support / Privileged Remote Access allows attackers to execute commands due to unsafe Bash arithmetic evaluation in a WebSocket-accessible script.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Enterprise remote access compromise\n\u2022 Privileged system access\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-55315\n\ud83c\udfaf ASP.NET Core Kestrel \u2013 HTTP Request Smuggling\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ZemarKhos/CVE-2025-55315-PoC-Exploit\n\n\ud83e\udde0 Overview\nA request smuggling vulnerability in ASP.NET Core Kestrel allows attackers to manipulate HTTP request parsing and potentially bypass authentication mechanisms or hijack user sessions.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Session hijacking\n\u2022 SSRF / potential RCE scenarios\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-66478\n\ud83c\udfaf Next.js Server Actions \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/namest504/CVE-2025-66478-Exploit-Poc\n\n\ud83e\udde0 Overview\nA vulnerability in Next.js Server Actions allows attackers to trigger remote code execution through insecure deserialization and prototype pollution in the React Server Components protocol.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 Application takeover\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Why This Matters\nThese PoC repositories help security researchers and defenders:\n\u2022 Understand how modern vulnerabilities are exploited\n\u2022 Study exploit development techniques\n\u2022 Perform patch diff analysis\n\u2022 Improve defensive security strategies\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive purposes only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:08.109059Z"} 2026-08-28T00:00:08.109059+00:00 https://vulnerability.circl.lu/sighting/6efcb5cb-9994-4c0a-9950-142fec1bc478/export 2026-09-02T23:06:11.046171+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "6efcb5cb-9994-4c0a-9950-142fec1bc478", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-55315", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17051", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today)\nBelow are several recent vulnerabilities with publicly available PoC repositories on GitHub that are useful for vulnerability research and exploit analysis.\n\n1\ufe0f\u20e3 CVE-2026-24061\n\ud83c\udfaf GNU inetutils-telnetd Authentication Bypass \u2192 Root Access\n\n\ud83d\udd17 PoC\nhttps://github.com/JayGLXR/CVE-2026-24061-POC\n\n\ud83e\udde0 Overview\nA critical vulnerability in GNU inetutils telnetd allows attackers to bypass authentication and obtain a root shell.\nThe exploit abuses the NEW_ENVIRON telnet option and injects a crafted environment variable (USER=-f root) that results in authentication bypass.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Remote root access\n\u2022 CVSS 9.8 (Critical)\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-27831\n\ud83c\udfaf rldns DNS Server Heap Out-of-Bounds Read\n\n\ud83d\udd17 PoC\nhttps://github.com/bluedragonsecurity/CVE-2026-27831-POC\n\n\ud83e\udde0 Overview\nA heap-based out-of-bounds read vulnerability in rldns version 1.3 can be triggered during DNS request handling, leading to memory access violations and denial-of-service.\n\n\u2699\ufe0f Impact\n\u2022 DNS server crash\n\u2022 Denial of Service\n\u2022 Memory safety vulnerability\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-1731\n\ud83c\udfaf BeyondTrust Remote Support \u2013 Command Injection\n\n\ud83d\udd17 PoC\nhttps://github.com/win3zz/CVE-2026-1731\n\n\ud83e\udde0 Overview\nA command injection vulnerability in BeyondTrust Remote Support / Privileged Remote Access allows remote attackers to execute commands due to unsafe Bash arithmetic evaluation in a WebSocket-reachable script.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Enterprise remote-access compromise\n\u2022 Privileged system access\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-55315\n\ud83c\udfaf ASP.NET Core Kestrel \u2013 HTTP Request Smuggling\n\n\ud83d\udd17 PoC\nhttps://github.com/ZemarKhos/CVE-2025-55315-PoC-Exploit\n\n\ud83e\udde0 Overview\nA critical HTTP request smuggling vulnerability in ASP.NET Core Kestrel allows attackers to bypass authentication, steal session tokens, and perform SSRF attacks.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Session hijacking\n\u2022 Remote code execution scenarios\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-66478\n\ud83c\udfaf Next.js Server Actions \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC\nhttps://github.com/namest504/CVE-2025-66478-Exploit-Poc\n\n\ud83e\udde0 Overview\nAn RCE vulnerability in Next.js Server Actions caused by insecure deserialization and prototype pollution through the proto property in the RSC Flight protocol.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 Application takeover\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese PoC repositories are useful for:\n\u2022 Vulnerability research\n\u2022 Exploit development study\n\u2022 Patch diff analysis\n\u2022 Red team / blue team training\n\u2022 Security tool testing\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:07.830180Z"} 2026-08-28T00:00:07.830180+00:00 https://vulnerability.circl.lu/sighting/3a72dd70-2eb2-41fb-b0d1-2a60a96a5ad7/export 2026-09-02T23:06:11.046310+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "3a72dd70-2eb2-41fb-b0d1-2a60a96a5ad7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-55315", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17051", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today)\nBelow are several recent vulnerabilities with publicly available PoC repositories on GitHub that are useful for vulnerability research and exploit analysis.\n\n1\ufe0f\u20e3 CVE-2026-24061\n\ud83c\udfaf GNU inetutils-telnetd Authentication Bypass \u2192 Root Access\n\n\ud83d\udd17 PoC\nhttps://github.com/JayGLXR/CVE-2026-24061-POC\n\n\ud83e\udde0 Overview\nA critical vulnerability in GNU inetutils telnetd allows attackers to bypass authentication and obtain a root shell.\nThe exploit abuses the NEW_ENVIRON telnet option and injects a crafted environment variable (USER=-f root) that results in authentication bypass.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Remote root access\n\u2022 CVSS 9.8 (Critical)\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-27831\n\ud83c\udfaf rldns DNS Server Heap Out-of-Bounds Read\n\n\ud83d\udd17 PoC\nhttps://github.com/bluedragonsecurity/CVE-2026-27831-POC\n\n\ud83e\udde0 Overview\nA heap-based out-of-bounds read vulnerability in rldns version 1.3 can be triggered during DNS request handling, leading to memory access violations and denial-of-service.\n\n\u2699\ufe0f Impact\n\u2022 DNS server crash\n\u2022 Denial of Service\n\u2022 Memory safety vulnerability\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-1731\n\ud83c\udfaf BeyondTrust Remote Support \u2013 Command Injection\n\n\ud83d\udd17 PoC\nhttps://github.com/win3zz/CVE-2026-1731\n\n\ud83e\udde0 Overview\nA command injection vulnerability in BeyondTrust Remote Support / Privileged Remote Access allows remote attackers to execute commands due to unsafe Bash arithmetic evaluation in a WebSocket-reachable script.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Enterprise remote-access compromise\n\u2022 Privileged system access\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-55315\n\ud83c\udfaf ASP.NET Core Kestrel \u2013 HTTP Request Smuggling\n\n\ud83d\udd17 PoC\nhttps://github.com/ZemarKhos/CVE-2025-55315-PoC-Exploit\n\n\ud83e\udde0 Overview\nA critical HTTP request smuggling vulnerability in ASP.NET Core Kestrel allows attackers to bypass authentication, steal session tokens, and perform SSRF attacks.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Session hijacking\n\u2022 Remote code execution scenarios\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-66478\n\ud83c\udfaf Next.js Server Actions \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC\nhttps://github.com/namest504/CVE-2025-66478-Exploit-Poc\n\n\ud83e\udde0 Overview\nAn RCE vulnerability in Next.js Server Actions caused by insecure deserialization and prototype pollution through the proto property in the RSC Flight protocol.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 Application takeover\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese PoC repositories are useful for:\n\u2022 Vulnerability research\n\u2022 Exploit development study\n\u2022 Patch diff analysis\n\u2022 Red team / blue team training\n\u2022 Security tool testing\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:08.371284Z"} 2026-08-27T20:00:08.371284+00:00 https://vulnerability.circl.lu/sighting/046da987-0626-4742-9355-17e223795802/export 2026-09-02T23:06:11.046418+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "046da987-0626-4742-9355-17e223795802", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-55315", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17056", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE Discovered \u2013 Weekly Report\nEvery week, new vulnerability research and exploit Proof-of-Concepts are published on GitHub by security researchers around the world.\nBelow are some notable CVE PoC repositories discovered this week, useful for vulnerability research, exploit analysis, and security education.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-24061\n\ud83c\udfaf GNU inetutils-telnetd Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/JayGLXR/CVE-2026-24061-POC\n\n\ud83e\udde0 Overview\nA critical vulnerability affecting GNU inetutils telnetd allows attackers to bypass authentication and gain root shell access.\nThe exploit abuses the NEW_ENVIRON telnet option to inject crafted environment variables that result in authentication bypass.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Remote root access\n\u2022 CVSS 9.8 (Critical)\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-27831\n\ud83c\udfaf rldns DNS Server Heap Out-of-Bounds Read\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/bluedragonsecurity/CVE-2026-27831-POC\n\n\ud83e\udde0 Overview\nA memory safety vulnerability in rldns DNS server 1.3 allows attackers to trigger a heap out-of-bounds read, which may crash the server and cause denial-of-service conditions.\n\n\u2699\ufe0f Impact\n\u2022 DNS server crash\n\u2022 Denial of Service\n\u2022 Memory corruption issue\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-1731\n\ud83c\udfaf BeyondTrust Remote Support \u2013 Command Injection\n\n\ud83d\udd17 Research / PoC\nhttps://github.com/win3zz/CVE-2026-1731\n\n\ud83e\udde0 Overview\nA command injection vulnerability affecting BeyondTrust Remote Support / Privileged Remote Access allows attackers to execute commands due to unsafe Bash arithmetic evaluation in a WebSocket-accessible script.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Enterprise remote access compromise\n\u2022 Privileged system access\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-55315\n\ud83c\udfaf ASP.NET Core Kestrel \u2013 HTTP Request Smuggling\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ZemarKhos/CVE-2025-55315-PoC-Exploit\n\n\ud83e\udde0 Overview\nA request smuggling vulnerability in ASP.NET Core Kestrel allows attackers to manipulate HTTP request parsing and potentially bypass authentication mechanisms or hijack user sessions.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Session hijacking\n\u2022 SSRF / potential RCE scenarios\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-66478\n\ud83c\udfaf Next.js Server Actions \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/namest504/CVE-2025-66478-Exploit-Poc\n\n\ud83e\udde0 Overview\nA vulnerability in Next.js Server Actions allows attackers to trigger remote code execution through insecure deserialization and prototype pollution in the React Server Components protocol.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 Application takeover\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Why This Matters\nThese PoC repositories help security researchers and defenders:\n\u2022 Understand how modern vulnerabilities are exploited\n\u2022 Study exploit development techniques\n\u2022 Perform patch diff analysis\n\u2022 Improve defensive security strategies\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive purposes only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:07.969104Z"} 2026-08-27T20:00:07.969104+00:00 https://vulnerability.circl.lu/sighting/96bf7cbd-9c69-47b1-b3b9-58ebd0438889/export 2026-09-02T23:06:11.046519+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "96bf7cbd-9c69-47b1-b3b9-58ebd0438889", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-55315", "type": "published-proof-of-concept", "source": "https://t.me/breachdetect/913909", "content": "{\n \"Source\": \"https://gerki.pw/\",\n \"Content\": \"CVE-2025-55315: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0434\u044b\u0440\u0430 \u0432 Kestrel \u0434\u0430\u0432\u0430\u043b\u0430 \u0432\u043e\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u0441\u0441\u0438\u0438 \u0438 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0444\u0438\u043b\u044c\u0442\u0440\u044b \u2014 Microsoft \u0441\u0440\u043e\u0447\u043d\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447\", \n \"author\": \"\",\n \"Detection Date\": \"19 Oct 2025\",\n \"Type\": \"Data leak\"\n}\n\ud83d\udd39 t.me/breachdetector \ud83d\udd39", "creation_timestamp": "2026-08-23T00:00:39.590176Z"} 2026-08-23T00:00:39.590176+00:00 https://vulnerability.circl.lu/sighting/9171205b-397a-49e5-bca9-c315d8ef0a74/export 2026-09-02T23:06:11.046619+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9171205b-397a-49e5-bca9-c315d8ef0a74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-55315", "type": "published-proof-of-concept", "source": "https://t.me/breachdetect/913909", "content": "{\n \"Source\": \"https://gerki.pw/\",\n \"Content\": \"CVE-2025-55315: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0434\u044b\u0440\u0430 \u0432 Kestrel \u0434\u0430\u0432\u0430\u043b\u0430 \u0432\u043e\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u0441\u0441\u0438\u0438 \u0438 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0444\u0438\u043b\u044c\u0442\u0440\u044b \u2014 Microsoft \u0441\u0440\u043e\u0447\u043d\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447\", \n \"author\": \"\",\n \"Detection Date\": \"19 Oct 2025\",\n \"Type\": \"Data leak\"\n}\n\ud83d\udd39 t.me/breachdetector \ud83d\udd39", "creation_timestamp": "2026-08-22T14:00:14.361915Z"} 2026-08-22T14:00:14.361915+00:00 https://vulnerability.circl.lu/sighting/efa50629-da67-4192-99d5-b5c812621e41/export 2026-09-02T23:06:11.046699+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "efa50629-da67-4192-99d5-b5c812621e41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-55315", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30149", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE Discovered \u2013 Weekly Report\nEvery week, new vulnerability research and exploit Proof-of-Concepts are published on GitHub by security researchers around the world.\nBelow are some notable CVE PoC repositories discovered this week, useful for vulnerability research, exploit analysis, and security education.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-24061\n\ud83c\udfaf GNU inetutils-telnetd Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/JayGLXR/CVE-2026-24061-POC\n\n\ud83e\udde0 Overview\nA critical vulnerability affecting GNU inetutils telnetd allows attackers to bypass authentication and gain root shell access.\nThe exploit abuses the NEW_ENVIRON telnet option to inject crafted environment variables that result in authentication bypass.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Remote root access\n\u2022 CVSS 9.8 (Critical)\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-27831\n\ud83c\udfaf rldns DNS Server Heap Out-of-Bounds Read\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/bluedragonsecurity/CVE-2026-27831-POC\n\n\ud83e\udde0 Overview\nA memory safety vulnerability in rldns DNS server 1.3 allows attackers to trigger a heap out-of-bounds read, which may crash the server and cause denial-of-service conditions.\n\n\u2699\ufe0f Impact\n\u2022 DNS server crash\n\u2022 Denial of Service\n\u2022 Memory corruption issue\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-1731\n\ud83c\udfaf BeyondTrust Remote Support \u2013 Command Injection\n\n\ud83d\udd17 Research / PoC\nhttps://github.com/win3zz/CVE-2026-1731\n\n\ud83e\udde0 Overview\nA command injection vulnerability affecting BeyondTrust Remote Support / Privileged Remote Access allows attackers to execute commands due to unsafe Bash arithmetic evaluation in a WebSocket-accessible script.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Enterprise remote access compromise\n\u2022 Privileged system access\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-55315\n\ud83c\udfaf ASP.NET Core Kestrel \u2013 HTTP Request Smuggling\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ZemarKhos/CVE-2025-55315-PoC-Exploit\n\n\ud83e\udde0 Overview\nA request smuggling vulnerability in ASP.NET Core Kestrel allows attackers to manipulate HTTP request parsing and potentially bypass authentication mechanisms or hijack user sessions.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Session hijacking\n\u2022 SSRF / potential RCE scenarios\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-66478\n\ud83c\udfaf Next.js Server Actions \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/namest504/CVE-2025-66478-Exploit-Poc\n\n\ud83e\udde0 Overview\nA vulnerability in Next.js Server Actions allows attackers to trigger remote code execution through insecure deserialization and prototype pollution in the React Server Components protocol.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 Application takeover\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Why This Matters\nThese PoC repositories help security researchers and defenders:\n\u2022 Understand how modern vulnerabilities are exploited\n\u2022 Study exploit development techniques\n\u2022 Perform patch diff analysis\n\u2022 Improve defensive security strategies\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive purposes only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:34.696587Z"} 2026-08-16T00:00:34.696587+00:00 https://vulnerability.circl.lu/sighting/33bc377d-f7b9-4b42-9e54-619f52f44598/export 2026-09-02T23:06:11.046804+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "33bc377d-f7b9-4b42-9e54-619f52f44598", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-55315", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30117", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today)\nBelow are several recent vulnerabilities with publicly available PoC repositories on GitHub that are useful for vulnerability research and exploit analysis.\n\n1\ufe0f\u20e3 CVE-2026-24061\n\ud83c\udfaf GNU inetutils-telnetd Authentication Bypass \u2192 Root Access\n\n\ud83d\udd17 PoC\nhttps://github.com/JayGLXR/CVE-2026-24061-POC\n\n\ud83e\udde0 Overview\nA critical vulnerability in GNU inetutils telnetd allows attackers to bypass authentication and obtain a root shell.\nThe exploit abuses the NEW_ENVIRON telnet option and injects a crafted environment variable (USER=-f root) that results in authentication bypass.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Remote root access\n\u2022 CVSS 9.8 (Critical)\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-27831\n\ud83c\udfaf rldns DNS Server Heap Out-of-Bounds Read\n\n\ud83d\udd17 PoC\nhttps://github.com/bluedragonsecurity/CVE-2026-27831-POC\n\n\ud83e\udde0 Overview\nA heap-based out-of-bounds read vulnerability in rldns version 1.3 can be triggered during DNS request handling, leading to memory access violations and denial-of-service.\n\n\u2699\ufe0f Impact\n\u2022 DNS server crash\n\u2022 Denial of Service\n\u2022 Memory safety vulnerability\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-1731\n\ud83c\udfaf BeyondTrust Remote Support \u2013 Command Injection\n\n\ud83d\udd17 PoC\nhttps://github.com/win3zz/CVE-2026-1731\n\n\ud83e\udde0 Overview\nA command injection vulnerability in BeyondTrust Remote Support / Privileged Remote Access allows remote attackers to execute commands due to unsafe Bash arithmetic evaluation in a WebSocket-reachable script.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Enterprise remote-access compromise\n\u2022 Privileged system access\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-55315\n\ud83c\udfaf ASP.NET Core Kestrel \u2013 HTTP Request Smuggling\n\n\ud83d\udd17 PoC\nhttps://github.com/ZemarKhos/CVE-2025-55315-PoC-Exploit\n\n\ud83e\udde0 Overview\nA critical HTTP request smuggling vulnerability in ASP.NET Core Kestrel allows attackers to bypass authentication, steal session tokens, and perform SSRF attacks.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Session hijacking\n\u2022 Remote code execution scenarios\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-66478\n\ud83c\udfaf Next.js Server Actions \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC\nhttps://github.com/namest504/CVE-2025-66478-Exploit-Poc\n\n\ud83e\udde0 Overview\nAn RCE vulnerability in Next.js Server Actions caused by insecure deserialization and prototype pollution through the proto property in the RSC Flight protocol.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 Application takeover\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese PoC repositories are useful for:\n\u2022 Vulnerability research\n\u2022 Exploit development study\n\u2022 Patch diff analysis\n\u2022 Red team / blue team training\n\u2022 Security tool testing\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:34.205862Z"} 2026-08-16T00:00:34.205862+00:00 https://vulnerability.circl.lu/sighting/46a915d2-106b-479c-b99b-8d95c69f1bb8/export 2026-09-02T23:06:11.046903+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "46a915d2-106b-479c-b99b-8d95c69f1bb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-55315", "type": "seen", "source": "https://t.me/CyberSecurityExploit/30117", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today)\nBelow are several recent vulnerabilities with publicly available PoC repositories on GitHub that are useful for vulnerability research and exploit analysis.\n\n1\ufe0f\u20e3 CVE-2026-24061\n\ud83c\udfaf GNU inetutils-telnetd Authentication Bypass \u2192 Root Access\n\n\ud83d\udd17 PoC\nhttps://github.com/JayGLXR/CVE-2026-24061-POC\n\n\ud83e\udde0 Overview\nA critical vulnerability in GNU inetutils telnetd allows attackers to bypass authentication and obtain a root shell.\nThe exploit abuses the NEW_ENVIRON telnet option and injects a crafted environment variable (USER=-f root) that results in authentication bypass.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Remote root access\n\u2022 CVSS 9.8 (Critical)\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-27831\n\ud83c\udfaf rldns DNS Server Heap Out-of-Bounds Read\n\n\ud83d\udd17 PoC\nhttps://github.com/bluedragonsecurity/CVE-2026-27831-POC\n\n\ud83e\udde0 Overview\nA heap-based out-of-bounds read vulnerability in rldns version 1.3 can be triggered during DNS request handling, leading to memory access violations and denial-of-service.\n\n\u2699\ufe0f Impact\n\u2022 DNS server crash\n\u2022 Denial of Service\n\u2022 Memory safety vulnerability\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-1731\n\ud83c\udfaf BeyondTrust Remote Support \u2013 Command Injection\n\n\ud83d\udd17 PoC\nhttps://github.com/win3zz/CVE-2026-1731\n\n\ud83e\udde0 Overview\nA command injection vulnerability in BeyondTrust Remote Support / Privileged Remote Access allows remote attackers to execute commands due to unsafe Bash arithmetic evaluation in a WebSocket-reachable script.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Enterprise remote-access compromise\n\u2022 Privileged system access\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-55315\n\ud83c\udfaf ASP.NET Core Kestrel \u2013 HTTP Request Smuggling\n\n\ud83d\udd17 PoC\nhttps://github.com/ZemarKhos/CVE-2025-55315-PoC-Exploit\n\n\ud83e\udde0 Overview\nA critical HTTP request smuggling vulnerability in ASP.NET Core Kestrel allows attackers to bypass authentication, steal session tokens, and perform SSRF attacks.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Session hijacking\n\u2022 Remote code execution scenarios\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-66478\n\ud83c\udfaf Next.js Server Actions \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC\nhttps://github.com/namest504/CVE-2025-66478-Exploit-Poc\n\n\ud83e\udde0 Overview\nAn RCE vulnerability in Next.js Server Actions caused by insecure deserialization and prototype pollution through the proto property in the RSC Flight protocol.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 Application takeover\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese PoC repositories are useful for:\n\u2022 Vulnerability research\n\u2022 Exploit development study\n\u2022 Patch diff analysis\n\u2022 Red team / blue team training\n\u2022 Security tool testing\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:07.114267Z"} 2026-08-15T11:00:07.114267+00:00 https://vulnerability.circl.lu/sighting/96da6dac-90f7-473a-9409-8a0c08d7855a/export 2026-09-02T23:06:11.047006+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "96da6dac-90f7-473a-9409-8a0c08d7855a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-55315", "type": "seen", "source": "https://t.me/CyberSecurityExploit/30149", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE Discovered \u2013 Weekly Report\nEvery week, new vulnerability research and exploit Proof-of-Concepts are published on GitHub by security researchers around the world.\nBelow are some notable CVE PoC repositories discovered this week, useful for vulnerability research, exploit analysis, and security education.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-24061\n\ud83c\udfaf GNU inetutils-telnetd Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/JayGLXR/CVE-2026-24061-POC\n\n\ud83e\udde0 Overview\nA critical vulnerability affecting GNU inetutils telnetd allows attackers to bypass authentication and gain root shell access.\nThe exploit abuses the NEW_ENVIRON telnet option to inject crafted environment variables that result in authentication bypass.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Remote root access\n\u2022 CVSS 9.8 (Critical)\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-27831\n\ud83c\udfaf rldns DNS Server Heap Out-of-Bounds Read\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/bluedragonsecurity/CVE-2026-27831-POC\n\n\ud83e\udde0 Overview\nA memory safety vulnerability in rldns DNS server 1.3 allows attackers to trigger a heap out-of-bounds read, which may crash the server and cause denial-of-service conditions.\n\n\u2699\ufe0f Impact\n\u2022 DNS server crash\n\u2022 Denial of Service\n\u2022 Memory corruption issue\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-1731\n\ud83c\udfaf BeyondTrust Remote Support \u2013 Command Injection\n\n\ud83d\udd17 Research / PoC\nhttps://github.com/win3zz/CVE-2026-1731\n\n\ud83e\udde0 Overview\nA command injection vulnerability affecting BeyondTrust Remote Support / Privileged Remote Access allows attackers to execute commands due to unsafe Bash arithmetic evaluation in a WebSocket-accessible script.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Enterprise remote access compromise\n\u2022 Privileged system access\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-55315\n\ud83c\udfaf ASP.NET Core Kestrel \u2013 HTTP Request Smuggling\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ZemarKhos/CVE-2025-55315-PoC-Exploit\n\n\ud83e\udde0 Overview\nA request smuggling vulnerability in ASP.NET Core Kestrel allows attackers to manipulate HTTP request parsing and potentially bypass authentication mechanisms or hijack user sessions.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Session hijacking\n\u2022 SSRF / potential RCE scenarios\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-66478\n\ud83c\udfaf Next.js Server Actions \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/namest504/CVE-2025-66478-Exploit-Poc\n\n\ud83e\udde0 Overview\nA vulnerability in Next.js Server Actions allows attackers to trigger remote code execution through insecure deserialization and prototype pollution in the React Server Components protocol.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 Application takeover\n\n\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Why This Matters\nThese PoC repositories help security researchers and defenders:\n\u2022 Understand how modern vulnerabilities are exploited\n\u2022 Study exploit development techniques\n\u2022 Perform patch diff analysis\n\u2022 Improve defensive security strategies\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive purposes only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:06.815046Z"} 2026-08-15T11:00:06.815046+00:00