📢 Big News! #Pwn2Own #P2OAuto Taejin Kim (@tae3), Junsu Yeo (@junactually), Sunmin Park (@sunminpark4503), Sungmin Son (@_ssm98), and Hoseok Lee of SKShieldus (@EQSTLab) of 299 exploited a hardcoded credential (CWE-798) to achieve code execution via CWE-494 on the Grizzl-E Smart 40A, earning $40,000 USD and 4 Master of Pwn points.

⚠️CVE-2026-72898 (CVSS 10.0)⚠️ Your Metabase's "forgot password" page will run an attacker's SQL. 😱 No login. No account. An attacker just POSTs to /api/session/reset_password with a crafted user-id — Metabase drops it straight into a database query with zero validation. Full unauthenticated SQL injection: dump admin credentials, session tokens, the whole app DB. If you self-host Metabase, patch to the latest release now. 🔥PoC + setup: github.com/EQSTLab/CVE-2026-… #Metabase #SQLi #CVE #PoC #Exploit #CyberSecurity #CVE_2026_72898

⚠️CVE-2026-19478 (CVSS 9.4)⚠️ One unauthenticated GraphQL query can wipe any public repo off your GitLab. 😱 No login. No token. An attacker tags a field with a fake "future version" directive (@gl_introduced) — GitLab skips validation, treats the field name as a method, and calls destroy. Any public project, gone. No admin. No exploit chain. If you self-host GitLab (CE/EE 18.2–19.2.3), patch to 19.2.4 now. 🔥PoC + setup: github.com/EQSTLab/CVE-2026-… #GitLab #GraphQL #CVE #PoC #Exploit #CyberSecurity #CVE_2026_19478

⚠️CVE-2026-60004 (CVSS 9.8)⚠️ A single malicious patch can hand an attacker your entire Gitea server. 😱 Any user who can push to a repo just sends the same file twice — and Gitea runs their code as the server account. No admin. No exploit chain. Full Remote Code Execution. If you self-host Gitea, patch to 1.27.1 now. 🔥PoC + setup: github.com/EQSTLab/CVE-2026-… #Gitea #RCE #CVE #PoC #Exploit #CyberSecurity #CVE_2026_60004

⚠️Critical Authentication Bypass in Gitea Docker images.⚠️ In Gitea Docker images up to and including 1.26.2, REVERSE_PROXY_TRUSTED_PROXIES was set to `*` by default. When reverse-proxy authentication is enabled and the Gitea container port is directly reachable, unauthenticated attackers can spoof the X-WEBAUTH-USER header to impersonate any existing user—including an administrator—without a password or session cookie. This may allow attackers to access private repositories, source code, secrets, and administrative functionality. Users should upgrade directly to Gitea 1.26.4 and restrict trusted proxies to the intended proxy addresses. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-… #Gitea #AuthenticationBypass #AccountTakeover #Docker #ReverseProxy #CyberSecurity #CVE #PoC #Exploit #CVE_2026_20896

⚠️CVE-2026-49975 (CVSS 7.5)⚠️ Critical HTTP/2 Bomb Denial-of-Service vulnerability in Apache HTTP Server mod_http2. Attackers can send crafted malicious HTTP/2 requests to trigger excessive memory allocation in vulnerable servers. By abusing HTTP/2 header compression and connection-hold behavior, unauthenticated remote attackers may rapidly exhaust server memory and cause service disruption. This issue affects Apache HTTP Server 2.4.17 through 2.4.67. Users are advised to upgrade to Apache HTTP Server 2.4.68 or apply vendor-provided mitigations. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-… #Apache #HTTP2 #HTTP2Bomb #DenialOfService #DoS #MemoryExhaustion #CyberSecurity #CVE #PoC #Exploit #CVE_2026_49975

⚠️CVE-2026-26980 (CVSS 9.4)⚠️ SQL Injection in Ghost Content API. In Ghost v3.24.0 through v6.19.0, unauthenticated attackers can abuse improper Content API filter handling to perform blind SQL injection and read arbitrary data from the database. This may expose sensitive CMS data, unpublished content, API keys, and internal metadata in vulnerable deployments. 🔥PoC + Ghost setup: github.com/EQSTLab/CVE-2026-… #Ghost #GhostCMS #SQLInjection #BlindSQLi #ContentAPI #CyberSecurity #CVE #PoC #Exploit #CVE_2026_26980

⚠️CVE-2026-42048 (CVSS 9.6)⚠️ Critical Path Traversal / Arbitrary Directory Deletion vulnerability in Langflow Knowledge Bases API. In Langflow before 1.9.0, authenticated attackers can abuse the kb_names parameter in DELETE /api/v1/knowledge_bases to escape the intended Knowledge Base storage path and recursively delete arbitrary directories on the server. This can lead to data loss, deletion of application-owned directories, and service disruption. 🔥PoC + Langflow setup: github.com/EQSTLab/CVE-2026-… #Langflow #PathTraversal #ArbitraryDirectoryDeletion #CWE22 #CyberSecurity #CVE #PoC #Exploit #CVE_2026_42048

⚠️CVE-2026-40897 (CVSS 8.8)⚠️ Remote Code Execution in Math.js Expression Parser. Attackers can craft malicious expressions to bypass Math.js expression parser restrictions and execute arbitrary JavaScript code. In server-side Node.js applications that evaluate user-controlled expressions, this can lead to Remote Code Execution (RCE). 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-…

⚠️CVE-2026-30951 (CVSS 7.5)⚠️ SQL Injection in Sequelize via unsafe JSON path cast handling. In Sequelize v6 before 6.37.8, JSON/JSONB path keys containing `::` may be parsed as SQL cast expressions and inserted into generated queries without proper validation. If attackers can control JSON query keys passed to Sequelize, they may inject arbitrary SQL expressions, bypass intended query logic, and potentially exfiltrate sensitive data from unrelated database tables. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-… #Sequelize #SQLInjection #ORM #ORMInjection #CyberSecurity #CVE #PoC #Exploit #CVE_2026_30951

⚠️CVE-2026-33937 (CVSS 9.8)⚠️ Critical RCE in Handlebars.js via AST Injection. Attackers can supply a crafted AST object to Handlebars.compile(), causing the code generator to emit and execute arbitrary JavaScript without sanitization, resulting in Remote Code Execution on the server. 🔥PoC + Handlebars.js setup: github.com/EQSTLab/CVE-2026-…

⚠️CVE-2026-34220 (CVSS 9.8)⚠️ SQL Injection in MikroORM via Custom Type __raw property. Attackers can inject arbitrary SQL expressions by supplying a __raw property in user-controlled input, enabling unauthorized exfiltration of sensitive data from unrelated database tables. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-…

⚠️CVE-2026-0603 (CVSS 8.3)⚠️ Second-Order SQL Injection in Hibernate ORM. Attackers can register with a malicious SQL payload as the primary key, triggering mass deletion or modification of all database records with a single delete or update request. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-…

⚠️CVE-2026-5027 (CVSS 8.8)⚠️ Critical Path Traversal / Arbitrary File Write vulnerability in Langflow’s `POST /api/v2/files` endpoint. By abusing the unsanitized multipart filename parameter, attackers can write files to arbitrary filesystem paths outside the intended upload directory, potentially leading to RCE in unsafe deployments. 🔥PoC + Langflow setup: github.com/EQSTLab/CVE-2026-… #Langflow #PathTraversal #ArbitraryFileWrite #RCE #CyberSecurity #CVE #PoC #Exploit #CVE_2026_5027

⚠️CVE-2026-33017 (CVSS 9.8)⚠️ Critical Unauthenticated RCE in Langflow. Attackers can exploit the public flow build endpoint to inject malicious flow data containing a custom Python component, resulting in unauthenticated Remote Code Execution. 🔥PoC + Langflow setup: github.com/EQSTLab/CVE-2026-…

⚠️CVE-2026-25253 (CVSS 8.8)⚠️ Critical Auth Token Exposure in OpenClaw Gateway. Attackers can leverage the exposed token to perform Cross-site WebSocket Hijacking (CSWSH), leading to 1-Click RCE. 🔥PoC + OpenClaw setup: github.com/EQSTLab/CVE-2026-…