Every new exploit,
on the radar.

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

CVE-2026-31900 Vulnerable Lab - psf/black GitHub Action RCE

WordPress HTMega Unauthenticated PII Disclosure Exploit (CVE-2026-4106)

PoC for CVE-2020-0601- Windows CryptoAPI (Crypt32.dll)

A PoC for CVE-2020-0601

CVE-2020-0601 #curveball - Alternative Key Calculator

Proof of Concept for CVE-2020-0601

Zeek package to detect CVE-2020-0601

这资源是作者复现微软签字证书漏洞CVE-2020-0601，结合相关资源及文章实现。推荐大家结合作者博客，理解ECC算法、Windows验证机制，并尝试自己复现可执行文件签名证书和HTTPS劫持的例子。作为网络安全初学者，自己确实很菜，但希望坚持下去，加油！

PoC for CVE-2020-0601 - CryptoAPI exploit

Zeek package that uses OpenSSL to detect CVE-2020-0601 exploit attempts

POC - CVE-2026-35584

CVE-2026-23500 - OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration in Dolibarr

CVE-2026-23498 - Shopware Has Improper Control of Generation of Code in Twig rendered views

CVE-2026-1434 - Omega-PSIR is vulnerable to Reflected XSS via the lang parameter. An attacker can craft a...

CVE-2026-24415 - OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter

CVE-2026-27621 - TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload

CVE-2025-66024 - XWiki Blog Application home page vulnerable to Stored XSS via Post Title

CVE-2026-22849 - Saleor lacks proper HTML sanitization in rich text fields

CVE-2026-23499 - Saleor vulnerable to stored XSS via Unrestricted File Upload

CVE-2025-66204 - WBCE CMS allows brute-force protection bypass using X-Forwarded-For header

CVE-2025-67875 - ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking

CVE-2025-67876 - ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking

CVE-2025-65094 - WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)

CVE-2026-23491 - InvoicePlane has Unauthenticated Path Traversal in Guest Controller

CVE-2026-21857 - Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

CVE-2026-25514 - FacturaScripts has SQL Injection in Autocomplete Actions

CVE-2026-25513 - FacturaScripts has SQL Injection in API ORDER BY Clause

CVE-2026-24419 - OpenSTAManager has a SQL Injection in the Prima Nota module

CVE-2026-24417 - OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service

CVE-2026-24416 - OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module