Every new exploit,
on the radar.

One zero-byte QUIC packet is enough to desynchronize HAProxy's backend connection pool and smuggle HTTP requests across unrelated users — even users on a compl…

CVE-2026-37750 — School Management System 1.0 - Reflected XSS

CVE-2026-37749 — CodeAstro Simple Attendance Management System 1.0 - SQL Injection

Visitor Management System 1.0 - Unrestricted File Upload → RCE (CVE-2026-37748)

Critical remote code execution vulnerability in OpenRemote's Rules Engine allows authenticated users with `write:rules` role to execute arbitrary code on the s…

Proof-of-Concept exploit for CVE-2026-32223

CVE-2026-40175

Scan local repos for vulnerable axios versions (CVE-2026-40175) and patch interactively

Axios CRLF Injection (CVE-2026-40175) 취약점 대응 가이드 및 fetch 기반 마이그레이션 분석

CVE-2020-13654 - XWiki Platform < 12.8 - Stored XSS → CSRF → Account Takeover

This repository provides a comprehensive security remediation of denial-of-service and allocation of resources without limits or throttling security vulnerabil…

Proof of concept and end-to-end test of Algorithmic Complexity DoS in musl libc 0.8.0-1.2.6 assigned CVE-2026-6042

CVE-2026-0827 PoC

Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation

Critical RCE vulnerability (CVSS 9.3) in Weaver E-cology platform versions prior to build 20260312. Unauthenticated remote code execution via exposed debug end…

ASUS DriverHub Driver Update Process TOCTOU Vulnerability Leading to LPE

poc CVE-2026-5059 in aws-mcp-server

Custom script to showcase the novel contribution to CVE-2025-58060

CVE-2024-24590 ClearML RCE&CMD POC

Proof of concept for CVE-2024-24590

CVE-2024-24590 – ClearML RCE via unsafe pickle artifact deserialization (0.17.0–1.14.2)

With this script you can exploit the CVE-2024-24590

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded ar…

Created this exploit for the Hack The Box machine, Blurry.

Proof of Concept demonstrating Remote Code Execution through insecure deserialization in Roundcube (CVE-2025-49113).

💥 Python Exploit for CVE-2025-49113 | Roundcube Webmail RCE via PHP Object Injection

Proof-of-concept to CVE-2025-49113

Detection for CVE-2025-49113

POC of CVE-2025-49113

CVE-2025-49113 - Roundcube <= 1.6.10 Post-Auth RCE via PHP Object Deserialization

Critical path traversal to RCE vulnerability in Jellyfin Media Server (CVSS 9.9). Includes proof-of-concept exploit, technical analysis, and detection tools.

This repository contains alternative payload approaches for the InvokeAI RCE vulnerability (CVE-2024-12029) when SSH key injection fails. The payloads are desi…

Secured root-level access by identifying and exploiting misconfigurations and outdated software. Buffer overflow vulnerability in an outdated version of mod_ss…

Exploit for CVE-2022-35650, a Moodle Arbitrary File Read.

Tivoli FastBack Server (6.1.4) is vulnerable to a stack-based buffer overflow allowing threat-actors to gain Arbitrary Code Execution (ACE) via a remote TCP-co…