Every new exploit,
on the radar.

Technical writeup and Proof of Concept (PoC) for CVE-2026-11417: OS Command Injection / Remote Code Execution (RCE) in AWS CDK's NodejsFunction.

Kernel exploit for Xbox SystemOS using CVE-2024-30088

该漏洞存在于 NtQueryInformationToken 函数中，特别是在处理AuthzBasepCopyoutInternalSecurityAttributes 函数时，该漏洞源于内核在操作对象时对锁定机制的不当管理，这一失误可能导致恶意实体意外提升权限。

🆘New Windows Kernel Priviledge Escalation Vulnerability

Questa repository contiene una replica (tentativo di replica) scritto in Python per CVE-2024-30088.

Kernel exploit for Xbox SystemOS using CVE-2024-30088

This is a modified version of the original CVE-2024-30088 exploit, adapted to work in non-interactive environments (WinRM).

compiled poc binary local privilege escalation by oilrig

CVE-2026-36522: unauthenticated NaN injection via MAVLink PARAM_SET in ArduPilot ArduPlane (CWE-1287, DoS/integrity)

The code for personally reproducing the corresponding vulnerability

CVE-2026-47101, CVE-2026-47102, CVE-2026-40217

CVE-2026-54597 - Authenticated Time-Based Blind SQL Injection in ITFlow

CVE-2026-54596 - Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration

CVE-2025-67511: Tricking a Security AI Agent Into Pwning Itself

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configu…

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker wit…

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by …

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthentica…

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role o…

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all appli…

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authentic…

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via …

Detection and sanitization for Acropalypse Now - CVE-2023-21036

Discord bot for mitigating the aCropalypse vulnerability (CVE-2023-21036, CVE-2023-28303) by retroactively deleting vulnerable images

Web tool for detecting Acropalypse (CVE-2023-21036) https://lordofpipes.github.io/acropadetect/

CVE-2023-21036 detection in Go

A lightweight CLI tool to detect and reconstruct cropped images vulnerable to Acropalypse (CVE-2023-21036 and CVE-2023-28303) written in Python.

X-Ways Acropalypse extension detects CVE-2023-21036 in common images

Proof-of-concept script to leverage the PAN-OS GlobalProtect authentication bypass CVE-2026-0257

CVE-2026-0257

Palo Alto Networks PAN-OS contains an authentication bypass caused by flaws in the GlobalProtect portal and gateway, letting attackers establish unauthorized V…

GrayXploit Security research and defensive team validate this toolkit for CVE-2026-0257 (PAN-OS GlobalProtect Authentication Bypass). Includes vulnerability as…

CVE-2026-0257 - PAN-OS

testing

genesisQL-sqli-CVE-2026-36826

CVE-2024-21533 PoC ggit

CVE-2024-21532 PoC ggit

A lightweight stdio-based MCP server for local file system operations — read, write, edit, search, exec for AI assistants. Specially optimized for Chatbox: bat…