1dayexploit/1day-archiveTechnical deep-dives and root cause analyses of recently disclosed CVEs - reverse engineering patches, building proof-of-concepts, and documenting exploitation techniques in the 1-day window.
Technical deep-dives and root cause analyses of recently disclosed CVEs.
This repository collects technical write-ups of recently disclosed CVEs — the 1-day window between patch release and widespread exploitation.
Each analysis contains:
| CVE | Vendor | Product | Class | Severity | Write-up |
|---|---|---|---|---|---|
CVE-2026-96677 | Apache Software Foundation | Apache Juneau 9.2.0 and earlier | Reflected XSS | Critical | Read |
CVE-2026-123158 | OpenSSH Project | OpenSSH portable < 10.6p2 (musl libc, without PAM) | Authentication Bypass | High | Read |
CVE-2026-117691 | Red Hat | Keycloak 26.8.1 and earlier | Authentication Bypass | Critical | Read |
CVE-2026-93389 | LiteSpeed Technologies | LiteSpeed Cache 7.9.0-7.9.1 | Info Disclosure | High | Read |
CVE-2026-119977 | Automattic | WordPress Core 4.7.0 - 7.1.3 | Predictable Web-Accessible Staging Directory / RCE | High | Read |
CVE-2026-121802 | Better Auth | @better-auth/expo 1.4.0-beta.6 to 1.7.15 | Authentication Bypass | Critical | Read |
CVE-2026-88811 | SUSE | Rancher Manager 2.11.0-2.15.2 | Information Disclosure | Critical | Read |
CVE-2026-93680 | Langflow Inc | Langflow OSS 1.0.0-1.12.8 | Auth Bypass | Critical | Read |
CVE-2026-108497 | TMS | Amelia 2.4.10 and earlier | SQL Injection | Critical | Read |
CVE-2026-108587 | 10Web | 10Web Booster (tenweb-speed-optimizer) 2.34.10 and earlier | RCE via Arbitrary File Upload | Critical | Read |
CVE-2026-115188 | Mautic Community | Mautic 7.0.0-7.2.1 | Unrestricted File Upload / RCE | Critical | Read |
CVE-2026-77366 | The 40 Thieves | obsidian-tc < 1.3.1 | Authorization Bypass | Critical | Read |
CVE-2026-87930 | MaxSite | MaxSite CMS 0.78-109.6 | Object Injection / RCE | High | Read |
CVE-2026-97229 | GitLab | GitLab CE/EE 19.2.x, 19.3.x, 19.4.x | Integer Overflow / RCE | Critical | Read |
CVE-2026-18937 | WPMU DEV | Broken Link Checker < 2.4.12 | RCE | Critical | Read |
CVE-2026-18480 | SureCart | SureCart 4.0.0-4.6.2 | Privilege Escalation / Account Takeover | High | Read |
CVE-2026-107645 | Creative Themes | Blocksy Companion <= 2.1.58 | Privilege Escalation | Critical | Read |
CVE-2018-1160 | Netatalk Project | Netatalk 3.1.x before 3.1.12 (and 2.x before 2.2.7) | Out-of-Bounds Write | Critical | Read |
CVE-2026-65008 | Grav Foundation | Grav CMS 2.0.0-2.0.6 | Remote Code Execution | Critical | Read |
CVE-2026-19949 | ServMask | All-in-One WP Migration and Backup <= 7.109 | SQL Injection | High | Read |
CVE-2026-87902 | Automattic / WordPress.org | WordPress core 4.7.0-7.1.1 | Path Traversal / File Inclusion | High | Read |
CVE-2026-65634 | Erlang/OTP Foundation | Erlang/OTP 17.0 - 29.1.0 | Algorithmic Complexity DoS | High | Read |
CVE-2026-53940 | Conda (Anaconda Inc.) | Conda 26.5.0-26.5.1 | Path Traversal | High | Read |
CVE-2026-60004 | Gitea | Gitea 1.17.0-1.27.0 | Remote Code Execution | Critical | Read |
CVE-2026-37266 | trippo | Responsive FileManager 9.14.0 and prior | RCE / Path Traversal / Extension Whitelist Bypass | High | Read |
CVE-2026-78159 | StellarWP | The Events Calendar <= 6.17.3 | Type Confusion / Code Injection | Critical | Read |
CVE-2026-85706 | GitLab B.V. | GitLab CE/EE 18.7.0-19.3.1 | Path Traversal / Arbitrary File Read | Critical | Read |
CVE-2026-78006 | StellarWP | The Events Calendar 6.17.3-6.17.4 | PHP Object Injection / RCE | Critical | Read |
CVE-2026-84647 | Jenkins project / Cloudbees | Jenkins 2.579 (weekly) / 2.568.2 (LTS); Stapler 2107.v8dfcb_e8ed317 | Deserialization / Type Confusion | High | Read |
CVE-2026-75816 | DynamiApps | Frontend Admin <= 3.29.12 (WordPress plugin acf-frontend-form-element) | Auth Bypass | Critical | Read |
CVE-2026-16723 | Alibaba | fastjson 1.2.68-1.2.83 | Unsafe Class Resolution / RCE | Critical | Read |
CVE-2026-83627 | WPMU DEV | Hummingbird <= 3.21.0 | Code Injection / RCE | Critical | Read |
