Every new exploit,
on the radar.

POC in python for CVE-2026-2461

AsyncIO Scanner & Exploitation Framework for CVE-2026-24061 (Telnet NEW_ENVIRON Auth Bypass). Features high-concurrency discovery, passive fingerprinting, and…

CTT-Terrminus-Vortex (CVE-2026-2406)

CVE-2026-24102 is a Use-After-Free (UAF) vulnerability within the Linux Kernel io_uring subsystem. While traditional exploits attempt to win a race condition t…

Gerapy prior to version 0.9.8 is vulnerable to remote code execution. This issue is patched in version 0.9.8.

Proof of Concept exploit for CVE‑2021‑43857: Authenticated Remote Code Execution in Gerapy (<0.9.8). Updated and automated version of the original Exploit‑DB P…

CVE-2021-43857(gerapy命令执行)

Optimized exploit for CVE-2021-43857 affecting Gerapy < 0.9.8

poc and writeup for cve-2026-21440: a critical path traversal vulnerability in @adonisjs/bodyparser allowing arbitrary file writing

Advanced detection-only PoC for CVE-2026-21440 affecting AdonisJS BodyParser. No exploitation included.

CVE-2026-21440

This is a writeup for CVE-2020-11107 reported by Maximilian Barz

XAMPP - CVE-2020-11107

CVE-2020-11107-Local-Privilege-Escalation-XAMPP-7.2.29-7.3.x-7.3.16-7.4.x-7.4.4

Evidencing, details, and Proof-of-Concept for CVE-2025-66850.

# CVE-2024-12227 - NTIOLib_X64.sys DoS PoC

Proof of concept exploit for N-able N-central to chain CVE-2025-9316 and CVE-2025-11700 to read files

An uninitialized read vulnerability by incorrect Turboshaft Store-Store Elimination in V8.

Checks if your Chrome version is vulnerable to CVE-2025-5419, from the browser

Dissecting CVEin Chrome

Blackbox AI Security Analysis This repo identifies possible security risks w/Blackbox.ai extensions/agents/svcs. Possible credential harvesting, unpatched vul…

Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal (CVE-2026-1056)

Splunk RCE exploit by the use of Copybuckets. Just for vulnerability research.

Mass exploitation of CVE-2021-24499 unauthenticated upload leading to remote code execution in Workreap theme.

WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a …

CVE-2025-1868: Advanced IP Scanner & Advanced Port Scanner NTLM Leakage HTTP Tester

CVE-2025-66723: inMusic Brands Engine DJ >=3.0.0 through <4.3.4 exposes local and network files to external parties

WP Query Console <= 1.0 - Unauthenticated Remote Code Execution

This is a exploit for CVE-2024-50498

Unauthenticated 0-click RCE exploit for CVE-2024-50498. Exploits a code injection vulnerability in the LUBUS WP Query Console plugin to execute arbitrary PHP c…

aiohttp LFI (CVE-2024-23334)

A proof of concept of the path traversal vulnerability in the python AioHTTP library =< 3.9.1

CVE-2024-23334

Proof-of-Concept for LFI/Path Traversal vulnerability in Aiohttp =< 3.9.1

A proof of concept of the LFI vulnerability on aiohttp 3.9.1

Bash script to automate Local File Inclusion (LFI) attacks on aiohttp server version 3.9.1.

CVE-2025-57428

Exploitation scripts for the CrushFTP CVE-2025-54309: vulnerability

CrushFTP AS2 Authentication Bypass

Findings & july race with 0day in wild