PoC Week 2026-09-27
The most featured CVEs in this week’s security newsletters, with public Proof-of-Concepts, ordered by mention count.
For the most up-to-date and accurate info, visit the NIST links. Always audit PoCs thoroughly before running them. I don’t vouch for any links in this list: follow them with caution.
CVE-2026-21962
- Severity: 10.0 CRITICAL
- Impacted Products: Oracle HTTP Server, Oracle WebLogic Server Proxy Plug-in, Oracle Fusion Middleware 12.2.1.4.0, Oracle Fusion Middleware 14.1.1.0.0, Oracle Fusion Middleware 14.1.2.0.0
- Description: Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in are affected by an improper access control vulnerability that allows an unauthenticated remote attacker to compromise the server. This flaw enables unauthorized access to data and the potential execution of arbitrary commands via the network.
- Remediation:
- More Info: NVD - CVE-2026-21962
- PoC:
CVE-2026-87491
- Severity: 8.8 HIGH
- Impacted Products: Google Chrome prior to version 153.0.8010.36, Google Chrome prior to version 153.0.8010.35, Chromium-based web browsers
- Description: Google Chrome and other Chromium-based web browsers contain an out-of-bounds memory write vulnerability in the V8 JavaScript and WebAssembly engine. An unauthenticated remote attacker can exploit this flaw by enticing a user to view a specially crafted HTML page.
- Remediation:
- More Info: NVD - CVE-2026-87491
- PoC:
CVE-2026-85046
- Severity: 8.8 HIGH
- Impacted Products: Google Chrome prior to version 152.0.7977.82
- Description: Google Chrome is affected by a type confusion vulnerability within its V8 JavaScript and WebAssembly engine prior to version 152.0.7977.82. An unauthenticated remote attacker can exploit this flaw by convincing a user to view a specially crafted HTML page.
- Remediation:
- More Info: NVD - CVE-2026-85046
- PoC:
CVE-2026-87902 NEW
- Severity: 8.1 HIGH
- Impacted Products: WordPress
- Description: WordPress contains a path traversal vulnerability in its page template resolution mechanism that allows an unauthenticated remote attacker to include arbitrary local PHP files. Under specific server and theme configurations, this local file inclusion can be escalated to remote code execution.
- Remediation:
- More Info: NVD - CVE-2026-87902
- PoC:
CVE-2026-76461
- Severity: 9.8 CRITICAL
- Impacted Products: Cisco Secure Email Gateway, Cisco AsyncOS Software
- Description: Cisco Secure Email Gateway running Cisco AsyncOS Software contains a SQL injection vulnerability in its email parsing logic that allows an unauthenticated, remote attacker to execute arbitrary commands. The issue stems from improper neutralization of user-supplied data in processed email messages.
- Remediation:
- More Info: NVD - CVE-2026-76461
- PoC:
CVE-2026-76460
- Severity: 9.8 CRITICAL
- Impacted Products: Cisco Identity Services Engine, Cisco ISE Passive Identity Connector
- Description: Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an authentication bypass vulnerability within their API gateway component. An unauthenticated remote attacker can exploit this flaw by sending crafted HTTP or HTTPS requests to an affected API endpoint to bypass access controls on the web-based management interface.
- Remediation:
- More Info: NVD - CVE-2026-76460
- PoC:
CVE-2026-94127 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: F5 BIG-IP Access Policy Manager (APM)
- Description: F5 BIG-IP Access Policy Manager (APM) contains a heap-based buffer overflow vulnerability in its OAuth implementation. When a virtual server is configured with an APM access policy and an OAuth profile acting as an OAuth Authorization Server, an unauthenticated remote attacker can exploit the issue to achieve arbitrary code execution.
- Remediation:
- More Info: NVD - CVE-2026-94127
- PoC:
CVE-2026-93616 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: Check Point Security Management Server
- Description: Check Point Security Management Server and associated management components are affected by a path traversal and arbitrary file upload vulnerability. An unauthenticated remote attacker can exploit this flaw to upload arbitrary files and execute code on the management server.
- Remediation:
- More Info: NVD - CVE-2026-93616
- PoC:
CVE-2026-89026 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: Issabel PBX software, before commit b97dbaf
- Description: The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. Exploitation evidence was …
- Remediation:
- More Info: NVD - CVE-2026-89026
- PoC:
CVE-2026-83549
- Severity: 7.2 HIGH
- Impacted Products: SonicWall Secure Mobile Access (SMA) 1000 Series
- Description: SonicWall Secure Mobile Access (SMA) 1000 Series appliances contain an OS command injection vulnerability in the Appliance Management Console (AMC). An authenticated remote administrator can exploit this vulnerability to execute arbitrary operating system commands on the device.
- Remediation:
- More Info: NVD - CVE-2026-83549
- PoC:
CVE-2026-65400
- Severity: 9.8 CRITICAL
- Impacted Products: Apple macOS
- Description: Apple macOS contains an authentication bypass vulnerability in its Screen Sharing component that allows a network-based attacker to authenticate without providing valid credentials. This issue is caused by improper state management during the authentication protocol.
- Remediation:
- More Info: NVD - CVE-2026-65400
- PoC:
CVE-2026-57148 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: praisonai-platform 0.1.6
- Description: PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET is unset, while the startup and token-issuance guards are disabled because PLATFORM_ENV also defaults to dev. An unauthenticated attacker can sign a JWT containing an attacker-chosen sub value, and AuthService._verify_token() accepts it as an authenticated identity, enabling user or workspace-owner …
- Remediation:
- More Info: NVD - CVE-2026-57148
- PoC:
CVE-2026-57147 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: praisonai-platform 0.1.6
- Description: PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me value to JWT_SECRET when PLATFORM_JWT_SECRET is unset, and its production guard does not run when PLATFORM_ENV is also unset because that setting defaults to dev. A remote unauthenticated attacker can mint an HS256 token with an arbitrary sub and email, and the platform’s AuthService._verify_token() and get_current_user dependency accept the fo…
- Remediation:
- More Info: NVD - CVE-2026-57147
- PoC:
CVE-2026-57141 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: PraisonAI 1.7.2
- Description: PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), while a regular-expression blocklist can be bypassed with Function(‘return this’)() to recover the global object and by constructing the child_process module name dynamically. An attacker who can influence the code argument can access host process capabilities, read or write files, obtain envi…
- Remediation:
- More Info: NVD - CVE-2026-57141
- PoC:
CVE-2026-57139 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: PraisonAI TypeScript 4.6.60, praisonai npm package 1.7.2
- Description: PraisonAI TypeScript is a multi-agent framework. Prior to version 4.6.60 (and praisonai npm package version 1.7.2), the MCPServer component exposes an HTTP JSON-RPC transport without authentication. Unauthenticated network attackers can send crafted requests to tools/call, resources/read, or prompts/get endpoints to invoke registered tools, access sensitive configuration resources, and execute arbitrary commands or code within the application process. This vulnerability is fixed in version 4….
- Remediation:
- More Info: NVD - CVE-2026-57139
- PoC:
CVE-2026-53710 NEW
- Severity: 10.0 CRITICAL
- Impacted Products: MCP Context Forge, python_sandbox_server < 1.0.2
- Description: MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and…
- Remediation:
- More Info: NVD - CVE-2026-53710
- PoC:
CVE-2026-12793 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: Crocoblock JetFormBuilder for WordPress 3.6.2 and prior
- Description: Crocoblock JetFormBuilder for WordPress contains an improper privilege management vulnerability in versions 3.6.2 and prior. An unauthenticated remote attacker can exploit this flaw to create an administrator account or elevate existing user privileges.
- Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
- More Info: NVD - CVE-2026-12793
- PoC:
CVE-2024-58385 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: Yonyou U8 CRM
- Description: Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first …
- Remediation:
- More Info: NVD - CVE-2024-58385
- PoC:
CVE-2023-54398 NEW
- Severity: 9.8 CRITICAL
- Impacted Products: Yonyou U8 Cloud
- Description: Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shado…
- Remediation:
- More Info: NVD - CVE-2023-54398
- PoC:
References
This list was scraped from the quite amazing and highly recommended newsletters below:
Thanks for reading! For corrections, omissions (e.g. newsletter recs) feel free to get in touch.