Every new exploit,
on the radar.

CVE-2026-21876 OWASP ModSecurity CRS WAF bypass (docker container + minimal PoC).

CVE-2026-21876 PoC: WAF charset bypass (Flask, ASP.NET and Spring Boot stands)

Unauthenticated Local File Inclusion

CVE-2026-7515: BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion TO RCE EXPLOİT

Reproduction lab for CVE-2026-54316 (Claude Code WebFetch huggingface.co bare-hostname permission bypass / exfiltration)

Authenticated privilege escalation in Camaleon CMS v2.9.0 via improper parameter handling in the updated_ajax endpoint.

Python script to exploit Privilege Escalation in Camaleon CMS.

CVE-2025-2304 POC

Proof-of-concept for CVE-2025-2304 — critical (CVSS 9.4) mass-assignment privilege escalation in Camaleon CMS.

This Python script exploits a critical mass assignment vulnerability in Camaleon CMS version 2.9.0, allowing any registered user to escalate their privileges t…

Privilege escalation vulnerability in Camaleon CMS < 2.9.1.

CVE-2025-2304 POC - Camaleon CMS Privilege Escalation

CVE-2026-42055 - Draft

Authenticated Remote Code Execution via loadReader functionName code injection in DbGate

Proof of Concept exploit for CVE-2026-46368 — authenticated root command injection in OpenWrt luci-app-https-dns-proxy (EDB-52521)

CVE-2025-6254 — Doctreat Core <= 1.6.8 — Unauthenticated Privilege Escalation

A PoC/exploit written in python for the unauthenticated SQL injection vulnerability CVE-2026-3359 situated within Form Maker (version <= 1.15.42) by 10Web.

CVE-2026-54420

PoC de CVE-2026-54420: explotacion via symlink en el plugin LiteSpeed de cPanel/WHM.

CVE-2025-54123 Hoverfly Authenticated Middleware Command Injection RCE

CVE-2025-54123 Hoverfly Command Injection to RCE PoC

CVE-2025-54123 exploit and documentation

PoC CVE-2025-54123 - Hoverfly <= 1.11.3 - Authenticated Middleware Command Injection

Hoverfly CVE RCE

Oracle VirtualBox VGA OOB-Read Vulnerability

A unified, security-first wire protocol for tool access and agent coordination. UAP eliminates CVE-2025-49596 and MCP tool-poisoning vulnerabilities using Ed25…

MCP-Inspector-vulncheck is a Python script that checks if an MCP Inspector server is vulnerable to CVE-2025-49596. It tests whether the /sse endpoint responds …

PoC for CVE-2025-49596 on linux targets

Browser-based MCP CTF — OAuth token confusion and session isolation failure (CVE-2025-49596 pattern). DevTools only.

Detection scripts, patch checker & hardening guide for CVE-2026-44963 (Veeam B&R RCE)

CVE-2026-44963 - Draft - Veeam

CVE-2026-38165 (SSTI)

Aritifacts of docker env of CVE-2021-3975

Windows POC for CVE-2021-34427 affecting Birt Viewer

CVE-2024-42009 Proof of Concept

This script exploits a stored XSS vulnerability (CVE-2024-42009) in Roundcube Webmail version 1.6.7. It injects a malicious payload into the webmail system, wh…

This Proof of Concept (PoC) demonstrates an exploit for CVE-2024-42009, leveraging a cross-site scripting (XSS) vulnerability to extract emails from a target w…

NimbusPwn (CVE-2022-29799/29800) local privilege escalation PoC in C.

Aritifacts of docker env of CVE-2020-8036

PoC de CVE-2026-20262: escritura arbitraria de archivos por path traversal en Cisco Catalyst SD-WAN Manager (autenticado).

CVE-2026-20262 - Draft

CVE-2026-49083 LatePoint Calendar Booking Plugin Privilege Escalation Exploit

CVE-2024-38819 nuclei template

CVE-2026-5513: Bookly <= 27.2 Stored XSS via Cookie (Unauthenticated)

CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie