Every new exploit,
on the radar.

Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Of…

CVE-2017-0199

Quick and dirty fix to OLE2 executing code via .hta

Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could generate a malici…

RTF Cleaner, tries to extract URL from malicious RTF samples using CVE-2017-0199 & CVE-2017-8759

Exploit toolkit for vulnerability RCE Microsoft RTF

Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could generate a malici…

CVE-2026-42978 Windows Push Notifications (WpnService) Use-After-Free & Race Condition PoC research, diagnostic scanner, and security audit module for AI Secur…

CVE-2026-42978 — Use-After-Free race condition in Windows Push Notifications (WpnService). Patch diff, root cause analysis, TOCTOU lab, Sysmon/ETW detection ru…

Exploit and analyze CVE-2026-42978 with a Windows Push Notifications module for AI security, multi-protocol terminal, and autonomous agent suite.

Explore and validate CVE-2026-42978 PoC with an integrated AI security tool, multi-protocol terminal, and autonomous agent suite for Windows Push Notifications.

Exploitation of CVE-2026-24061

基于cve-2026-24061 telnet远程认证绕过漏洞的批量检测利用工具

CVE-2026-24061 GNU Inetutils telnetd 身份验证绕过漏洞检测与利用 GUI 工具

A small docker lab to play with cve-2026-24061, the inetutils-telnetd authentication bypass.

scanner/exploiter CVE-2026-24061 & CVE-2026-32746

Read-only vulnerability scanner for CVE-2026-49049 — Helix3 Joomla plugin unauthenticated AJAX handler

 CVE-2026-49049 - Unauthenticated File Deletion, Arbitrary Write & XSS Injection for Helix3 Joomla Extension

CVE-2026-49049 Helix3 (JoomShaper) Joomla Unauthenticated AJAX RCE Scanner

Mass Exploiter for CVE-2026-49049

Mass vulnerability scanner for CVE-2026-49049 – Unauthenticated Remote Code Execution in Joomla Helix3 plugin. Multi‑threaded, detects both executed and raw PH…

Balbooa Forms (com_baforms) < 2.4.1 — Unauthenticated File Upload to RCE via form.uploadAttachmentFile | CVSS 9.8 | CISA KEV

Mendeteksi versi (passive detection) & Exploitation CVE POC

nuclei template for CVE-2026-56291

The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

cve-2026-48907 scanner

PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5 unauthenticated RCE

CVE-2026-48907

CVE-2025-48907 - Unauthenticated RCE exploit for Joomla JCE < 2.9.99.5

Defensive lab validation and SOC detection guidance for CVE-2026-48907 in Joomla JCE <= 2.9.99.4, including Apache/Joomla/auditd telemetry, webshell artifacts,…

POC for CVE-2026-48907

Python & template nuclei

vuln ejs 3.1.6 docker

Serverside Template Injection (SSTI) RCE - THM challenge "whiterose"

PoC for CVE-2022-29078

Browser demo: EJS template injection (CVE-2022-29078) with Seal Security remediation

npm repo with ejs CVE-2022-29078 (CVSS 9.8, EPSS 32%) for Dependabot automerge testing

Dependabot security automerge test - ejs CVE-2022-29078

arm64/aarch64 port of V4bel/dirtyfrag (CVE-2026-43284). ESP-only - rxrpc path kernel-oopses on arm64 due to flush_dcache_page

DirtyFrag Android Root is an Android app and helper module chain based on DirtyFrag (CVE-2026-43284). Tested on iQOO Z9 5G.

CVE-2026-43284

A proof-of-concept demonstrating how a default, unprivileged Kubernetes Pod can achieve node-level code execution on Amazon EKS by exploiting the Dirty Frag (C…

CVE-2026-43284/CVE-2026-43500 'DirtyFrag' Benign patch & mitigation detection script

Read-only checker for CVE-2026-43284 / CVE-2026-43500 (Dirty Frag) Linux kernel local-root vulns

三星 Galaxy S25 Ultra（SM-S938B）适配版 DFRoot：开机自动获取 root（DirtyFrag CVE-2026-43284 + CVE-2026-43499 双链路），全中文界面，fork 自 diabl0w/DFRoot

Wazuh 4.14.4 detection rules for CVE-2026-43284 / CVE-2026-43500 (Dirty Frag) - Linux Local Privilege Escalation via page cache write

CVE-2024-4367 & CVE-2024-34342 Proof of Concept

CVE-2024-4367 arbitrary js execution in pdf js

PDF.js是由Mozilla维护的基于JavaScript的PDF查看器。此漏洞允许攻击者在打开恶意 PDF 文件后立即执行任意 JavaScript 代码。这会影响所有 Firefox 用户 （<126），因为 Firefox 使用 PDF.js 来显示 PDF 文件，但也严重影响了许多基于 Web 和 Elec…

YARA detection rule for CVE-2024-4367 arbitrary javascript execution in PDF.js

This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js (pdfjs-dist) library reported in CVE-2024-4367

PoC - Prueba de Concepto de CVE-2024-4367 en conjunto al CVE-2023-38831 en un solo Script

Analysis and PoC for CVE-2024-4367: arbitrary JavaScript execution (XSS) in PDF.js

This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js (pdfjs-dist) library reported in CVE-2024-4367

Temproot for Pixel 2 and Pixel 2 XL via CVE-2019-2215

Triggering and Analyzing Android Kernel Vulnerability CVE-2019-2215

This lab guides you through setting up an environment to explore CVE-2019-2215, a critical Android kernel vulnerability in the binder subsystem.

Android privilege escalation via an use-after-free in binder.c

Temproot for Bravia TV via CVE-2019-2215.

Android Kernel Vulnerability (CVE-2019-2215) temporary root PoC

PoC for old Binder vulnerability (based on P0 exploit)

Test whether a container environment is vulnerable to container escapes via CVE-2022-0492

CVE-2022-0492 EXP and Analysis write up

A script to check if a container environment is vulnerable to container escapes via CVE-2022-0492

Docker Breakout Checker and PoC via CAP_SYS_ADMIN and via user namespaces (CVE-2022-0492)

CVE-2022-0492-Container-Escape

PoC for CVE-2022-0492

Reproduction and verification of container-escape CVEs (CVE-2022-0492, CVE-2024-23652) in isolated Docker labs

Marimo Pre Authentication RCE

CVE-2026-39987 Exploitation Tool - Marimo < 0.23.0 Pre-Auth RCE (WebSocket)

CVE-2026-39987: Marimo Python Notebook Pre-Auth RCE (CVSS 9.3). Python & Nmap NSE detection scripts. Missing authentication on /terminal/ws WebSocket endpoint …

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability

Marimo Pre-Auth RCE

A proof-of-concept for CVE-2026-39987

PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable l…

CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion (conditional RCE)

Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4…

CVE-2026-87902 – WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7–7.1.1. | 2 tools: Full Exploit (LFI, PEAR RCE, admin create,…

Unauthenticated RCE on Wordpress

XWP_RCE — CVE-2026-87902 Hacker Console

CVE-2026-87902 detector. WordPress get_page_template LFI class. Detect-only. Authorized lab.

Proof of concept for vulnerability CVE-2026-87902 in Wordpress

Test tool for CVE-2020-1472

PoC for Zerologon - all research credits go to Tom Tervoort of Secura

Exploit for zerologon cve-2020-1472

Exploit Code for CVE-2020-1472 aka Zerologon

Abuse CVE-2020-1472 (Zerologon) to take over a domain and then repair the local stored machine account password.

cve-2020-1472 复现利用及其exp

CVE-2020-1472 C++

Test script for CVE-2020-1472 for both RPC/TCP and RPC/SMB

CVE-2016-5195 (dirtycow/dirtyc0w) proof of concept for Android

Dirty Cow exploit - CVE-2016-5195

PoC for Dirty COW (CVE-2016-5195)

A CVE-2016-5195 exploit example.

CVE-2022-0847-DirtyPipe-Exploit CVE-2022-0847 是存在于 Linux内核 5.8 及之后版本中的本地提权漏洞。攻击者通过利用此漏洞，可覆盖重写任意可读文件中的数据，从而可将普通权限的用户提升到特权 root。 CVE-2022-0847 的漏洞原理类似于 CVE-…

CVE-2016-5195 (Dirty COW) PoC for Android 6.0.1 Marshmallow

编译好的脏牛漏洞（CVE-2016-5195）EXP

Universal Android root tool based on CVE-2016-5195. Watch this space.

First publicly shared exploit implementation for CVE-2026-33439 (OpenAM pre-auth RCE via jato.clientSession deserialization).

Python PoC for CVE-2026-33439, an OpenAM pre-authentication RCE via jato.clientSession deserialization

CVE-2026-33439

Vulnerable endpoint description for CVE-2026-33439 in OpenAM

CVE-2026-33439 OpenAM pre-auth RCE PoC

Proof of concept for CVE-2026-33439, an unauthenticated RCE in OpenAM via Java deserialization

CVE-2026-33439

CVE-2022-0185

CVE-2022-0185 POC and Docker and Analysis write up

CVE-2022-0185 exploit rewritten with pipe primitive

CVE-2022-0185 exploit

Research and proof-of-concept for CVE-2022-0185 Linux kernel heap overflow vulnerability.

Private HTTP-only reproduction of CVE-2026-75650 StyleSmuggler

Docker lab reproducing the complete CVE-2026-75650 StyleSmuggler unauthenticated HTTP RCE and validating Adobe VULN-39341.

composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Magento, via cweagans/composer-patches. Auto-selects the patch for your Magen…

StyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells, persistence ar…

composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Mage-OS stores, via cweagans/composer-patches. Companion to stylesmuggler-ado…

CVE-2026-75650 - Magento Open Source - Critical 10.0 - Unauthenticated POST /graphql - Unauthenticated Remote Code Execution (StyleSmuggler SSTI)

Linux LPE via snap-confine + systemd-tmpfiles, explained in depth

PoC de CVE-2026-3888: condicion de carrera en snapd para escalada a root.

Exploit para CVE-2026-3888: race condition en snap-confine con hijack del loader para escalar a root en Linux.

This is a script designed for deployment on ubuntu instances patching the CVE-2026-3888 exploit

CVE-2026-3888 — snap-confine / systemd-tmpfiles SUID LPE (fixed race_pid.txt issue)

PoC for CVE-2026-67401 — cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE. Includes a self-contained vulnerable lab, SQLi detec…

poc in python for CVE-2026-67401

CVE-2026-67401 - Draft or TODO

CVE-2026-67401 cPanel & WHM EmailTrack SQL Injection — IOC scanner, compromise detection, patch verification, incident response and remediation toolkit.

PoC for CVE-2026-67401 — cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE. Includes a self-contained vulnerable lab, SQLi detec…

CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection

High fidelity scanner for CVE-2026-41940 (cPanel & WHM authentication bypass)

CVE-2026-41940 latest cPanel & WHM 0day - 70 million websites are possible to expose by Chirag Artani

CVE-2026-41940 SUPPORT SINGLE & MASS SCAN EXPLOIT

Detection, mitigation, and reverse-engineering tooling for CVE-2026-41940 (SessionScribe): the cPanel/WHM unauthenticated session-forgery vulnerability disclos…

Microsoft-Outlook-Remote-Code-Execution-Vulnerability

CVE-2024-21413 PoC for THM Lab

Microsoft Outlook Information Disclosure Vulnerability (leak password hash) - Expect Script POC

CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC

Microsoft Outlook Information Disclosure Vulnerability (leak password hash) - CVE-2024-21413 POC

Outlook exploitation

Bu betik, Microsoft Outlook'ta keşfedilen ve CVSS değeri 9.8 olan önemli bir güvenlik açığı olan CVE-2024-21413 için bir kavram kanıtı (PoC) sunmaktadır. Monik…

CVE-2026-43494

Proof-of-concept for CVE-2026-43494 (PinTheft): Linux LPE via RDS zerocopy refcount bug + io_uring fixed buffers → SUID page-cache overwrite. Authorized resear…

A x86_64 ASM implementation of PinTheft (CVE-2026-43494)

Tracking PinTheft (CVE-2026-43494, CVE-2026-43502), the RDS zerocopy double-free privilege escalation

A Go implementation of PinTheft (CVE-2026-43494)

Proof-of-concept for CVE-2026-43494 (PinTheft): Linux LPE via RDS zerocopy refcount bug + io_uring fixed buffers → SUID page-cache overwrite. Authorized resear…

LPE on Deb

SCTPhantom (CVE-2026-64564) SCTP ASCONF DEL-IP UAF LPE PoC (Debian 13 6.12.95) — community PoC mirror, MIT; for authorized security testing

Tracking SCTPhantom (CVE-2026-64564), the Linux kernel SCTP ASCONF transport use-after-free

DaemonSet для митигации уязвимости CVE-2026-64564 (SCTPhantom)

Complete fix collection for the CVE-2026-53359 guest-to-host escape vulnerability in the KVM/x86 shadow MMU. From zero-downtime livepatch to kernel upgrade — c…

CVE-2026-53359

Linux 内核升级指南 - 修复 CVE-2026-53359

CVE-2026-53359漏洞补丁

CVE-2026-53359 - Draft

Tracking Januscape (CVE-2026-53359), the KVM/x86 guest-to-host escape

A 16-year-old bug in the Linux kernel lets a rented VM break out and attack the host it runs on. Intel and AMD alike. Januscape is a use-after-free vulnerabili…