📢 Big News! #Pwn2Own #P2OAuto Taejin Kim (@tae3), Junsu Yeo (@junactually), Sunmin Park (@sunminpark4503), Sungmin Son (@_ssm98), and Hoseok Lee of SKShieldus (@EQSTLab) of 299 exploited a hardcoded credential (CWE-798) to achieve code execution via CWE-494 on the Grizzl-E Smart 40A, earning $40,000 USD and 4 Master of Pwn points.

⚠️ CVE-2026-94545 (CVSS 9.5) ⚠️ Your Next.js OG image endpoint can hand an attacker a shell. 😱 If you use next/og on the Node runtime with sharp installed (what Next recommends for prod), one unauthenticated POST to that route runs commands on your server. Here's why: Satori builds the image as an SVG and drops your text in without escaping it, so an attacker breaks out of the tag and injects their own markup. It reaches the native image libs (sharp, libvips, librsvg, libxml2) and corrupts memory there, and since Node ships non-PIE, a hardcoded ROP chain lands execve every time. This is the default prod setup, not some weird edge case. 🚨 Not affected: edge runtime or no sharp — that path uses the wasm renderer. Patched in Next.js 16.3.6 / Satori 0.33.5. On 16.2.0–16.3.5? Update now. 🔥 PoC + setup: github.com/EQSTLab/CVE-2026-… #Nextjs #RCE #CVE #PoC #Exploit #CyberSecurity #nextog #CVE_2026_94545

⚠️CVE-2026-49869 (CVSS 10.0)⚠️ Unauthenticated RCE in Kestra OSS workers. A `/configs` suffix bypasses Basic Auth, letting attackers create and run shell-task flows. It affects OSS instances using Basic Auth when an attacker can reach the API; no credentials or pre-existing flow are required. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-… #Kestra #RCE #CyberSecurity #CVE #PoC #Exploit #CVE_2026_49869

⚠️CVE-2026-6951 (CVSS 8.2)⚠️ Remote Code Execution in simple-git. In simple-git before 3.36.0, attackers may bypass Git option filtering using --config and execute arbitrary commands when user-controlled options are passed to simple-git. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-… #simplegit #RCE #CommandInjection #NodeJS #CyberSecurity #CVE #PoC #Exploit #CVE_2026_6951

⚠️CVE-2026-85706 (CVSS 10.0)⚠️ Your GitLab will hand a stranger its files. 😱 No login. No account. An attacker just URL-encodes one letter of commits → %63ommits, and GitLab-Workhorse waves the request through — so a single unauthenticated POST to the repository commits API reads files straight off the server filesystem. Config, internal logs, source paths, versions… all without ever signing in. Already in CISA KEV — exploited in the wild. 🚨 If you self-host GitLab, patch to 19.1.8 / 19.2.6 / 19.3.2 now. 🔥PoC + setup: github.com/EQSTLab/CVE-2026-… #GitLab #ArbitraryFileRead #CVE #PoC #Exploit #CyberSecurity #CVE_2026_85706

⚠️CVE-2026-18963 (CVSS 9.1)⚠️ Critical Unauthenticated Account Takeover vulnerability in Keycloak’s reset-credentials flow. In affected Keycloak 26.x versions, unauthenticated attackers can bypass email verification during password recovery and continue the reset-credentials flow. This allows an attacker who knows a target username or email address to set new credentials without accessing the victim’s email, resulting in full account takeover. Patched versions include 26.4.15, 26.6.6, and 26.7.2. Users should upgrade to a fixed release. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-… #Keycloak #AccountTakeover #AuthenticationBypass #PasswordReset #CWE640 #CyberSecurity #CVE #PoC #Exploit #CVE_2026_18963

⚠️CVE-2026-72898 (CVSS 10.0)⚠️ Your Metabase's "forgot password" page will run an attacker's SQL. 😱 No login. No account. An attacker just POSTs to /api/session/reset_password with a crafted user-id — Metabase drops it straight into a database query with zero validation. Full unauthenticated SQL injection: dump admin credentials, session tokens, the whole app DB. If you self-host Metabase, patch to the latest release now. 🔥PoC + setup: github.com/EQSTLab/CVE-2026-… #Metabase #SQLi #CVE #PoC #Exploit #CyberSecurity #CVE_2026_72898

⚠️CVE-2026-19478 (CVSS 9.4)⚠️ One unauthenticated GraphQL query can wipe any public repo off your GitLab. 😱 No login. No token. An attacker tags a field with a fake "future version" directive (@gl_introduced) — GitLab skips validation, treats the field name as a method, and calls destroy. Any public project, gone. No admin. No exploit chain. If you self-host GitLab (CE/EE 18.2–19.2.3), patch to 19.2.4 now. 🔥PoC + setup: github.com/EQSTLab/CVE-2026-… #GitLab #GraphQL #CVE #PoC #Exploit #CyberSecurity #CVE_2026_19478

⚠️CVE-2026-60004 (CVSS 9.8)⚠️ A single malicious patch can hand an attacker your entire Gitea server. 😱 Any user who can push to a repo just sends the same file twice — and Gitea runs their code as the server account. No admin. No exploit chain. Full Remote Code Execution. If you self-host Gitea, patch to 1.27.1 now. 🔥PoC + setup: github.com/EQSTLab/CVE-2026-… #Gitea #RCE #CVE #PoC #Exploit #CyberSecurity #CVE_2026_60004

⚠️Critical Authentication Bypass in Gitea Docker images.⚠️ In Gitea Docker images up to and including 1.26.2, REVERSE_PROXY_TRUSTED_PROXIES was set to `*` by default. When reverse-proxy authentication is enabled and the Gitea container port is directly reachable, unauthenticated attackers can spoof the X-WEBAUTH-USER header to impersonate any existing user—including an administrator—without a password or session cookie. This may allow attackers to access private repositories, source code, secrets, and administrative functionality. Users should upgrade directly to Gitea 1.26.4 and restrict trusted proxies to the intended proxy addresses. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-… #Gitea #AuthenticationBypass #AccountTakeover #Docker #ReverseProxy #CyberSecurity #CVE #PoC #Exploit #CVE_2026_20896

⚠️CVE-2026-49975 (CVSS 7.5)⚠️ Critical HTTP/2 Bomb Denial-of-Service vulnerability in Apache HTTP Server mod_http2. Attackers can send crafted malicious HTTP/2 requests to trigger excessive memory allocation in vulnerable servers. By abusing HTTP/2 header compression and connection-hold behavior, unauthenticated remote attackers may rapidly exhaust server memory and cause service disruption. This issue affects Apache HTTP Server 2.4.17 through 2.4.67. Users are advised to upgrade to Apache HTTP Server 2.4.68 or apply vendor-provided mitigations. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-… #Apache #HTTP2 #HTTP2Bomb #DenialOfService #DoS #MemoryExhaustion #CyberSecurity #CVE #PoC #Exploit #CVE_2026_49975

⚠️CVE-2026-26980 (CVSS 9.4)⚠️ SQL Injection in Ghost Content API. In Ghost v3.24.0 through v6.19.0, unauthenticated attackers can abuse improper Content API filter handling to perform blind SQL injection and read arbitrary data from the database. This may expose sensitive CMS data, unpublished content, API keys, and internal metadata in vulnerable deployments. 🔥PoC + Ghost setup: github.com/EQSTLab/CVE-2026-… #Ghost #GhostCMS #SQLInjection #BlindSQLi #ContentAPI #CyberSecurity #CVE #PoC #Exploit #CVE_2026_26980

⚠️CVE-2026-42048 (CVSS 9.6)⚠️ Critical Path Traversal / Arbitrary Directory Deletion vulnerability in Langflow Knowledge Bases API. In Langflow before 1.9.0, authenticated attackers can abuse the kb_names parameter in DELETE /api/v1/knowledge_bases to escape the intended Knowledge Base storage path and recursively delete arbitrary directories on the server. This can lead to data loss, deletion of application-owned directories, and service disruption. 🔥PoC + Langflow setup: github.com/EQSTLab/CVE-2026-… #Langflow #PathTraversal #ArbitraryDirectoryDeletion #CWE22 #CyberSecurity #CVE #PoC #Exploit #CVE_2026_42048

⚠️CVE-2026-40897 (CVSS 8.8)⚠️ Remote Code Execution in Math.js Expression Parser. Attackers can craft malicious expressions to bypass Math.js expression parser restrictions and execute arbitrary JavaScript code. In server-side Node.js applications that evaluate user-controlled expressions, this can lead to Remote Code Execution (RCE). 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-…

⚠️CVE-2026-30951 (CVSS 7.5)⚠️ SQL Injection in Sequelize via unsafe JSON path cast handling. In Sequelize v6 before 6.37.8, JSON/JSONB path keys containing `::` may be parsed as SQL cast expressions and inserted into generated queries without proper validation. If attackers can control JSON query keys passed to Sequelize, they may inject arbitrary SQL expressions, bypass intended query logic, and potentially exfiltrate sensitive data from unrelated database tables. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-… #Sequelize #SQLInjection #ORM #ORMInjection #CyberSecurity #CVE #PoC #Exploit #CVE_2026_30951

⚠️CVE-2026-33937 (CVSS 9.8)⚠️ Critical RCE in Handlebars.js via AST Injection. Attackers can supply a crafted AST object to Handlebars.compile(), causing the code generator to emit and execute arbitrary JavaScript without sanitization, resulting in Remote Code Execution on the server. 🔥PoC + Handlebars.js setup: github.com/EQSTLab/CVE-2026-…