Every new exploit,
on the radar.

Patch: Heap overflow in SSL-VPN (Fortinet FortiOS)

Patch: Command injection in GlobalProtect (Palo Alto PAN-OS)

Patch: SSRF leading to RCE (Microsoft Exchange Server)

Patch: Privilege escalation via web UI (Cisco IOS XE)

Patch: Deserialization vulnerability (Oracle WebLogic Server)

Patch: Remote code execution in SPL parsing (Splunk Enterprise)

Patch: RCE via authentication bypass (Ivanti Connect Secure)

Basic vulnerability scanning to see if web servers may be vulnerable to CVE-2023-44487

Tool for testing mitigations and exposure to Rapid Reset DDoS (CVE-2023-44487)

Proof of concept for DoS exploit

A python based exploit to test out rapid reset attack (CVE-2023-44487)

Examples for Implementing cve-2023-44487 ( HTTP/2 Rapid Reset Attack ) Concept

Highly configurable tool to check a server's vulnerability against CVE-2023-44487 by rapidly sending HEADERS and RST_STREAM frames and documenting the server's…

Professional PHPMyAdmin 5.0.0 SQL Injection (CVE-2020-5504) exploitation framework with automated database enumeration, table extraction, and data dumping capa…

PoC exploit chain for CVE-2026-15718: SpiderMonkey wasm baseline compiler array.fill missing-sync -> invalid pointer -> addrOf/fakeobj -> arbitrary R/W -> RCE

Reproducible lab for CVE-2026-10053 (GitLab npm package-registry path traversal -> arbitrary file write as git). Vulnerable 19.2.1 vs patched 19.2.2, determini…

IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery

Password-Protected Category Bypass via JSON Format in JoomGallery

Rail-OT-Protector (ROP) — free, open-source cybersecurity scanning tool for rail and transit OT/SCADA networks. PowerShell + Bash scanners for CVE-2025-1727, R…

Free BACnet/BMS vulnerability scanner for building automation systems. Detects CVE-2026-3611 (CVSS 10.0), CVE-2026-24060, and exposed HVAC/BAS controllers via …

Exploit for Grafana arbitrary file-read and RCE (CVE-2024-9264)

Grafana RCE exploit (CVE-2024-9264)

File Read Proof of Concept for CVE-2024-9264

A go implementation for CVE-2024-9264 which effect grafana versions 11.0.x, 11.1.x, and 11.2.x.

Authenticated RCE in Grafana (v11.0) via SQL Expressions - PoC Exploit

Grafana RCE

CVE-2026-0013 Android EoP PoC - Compiled artifacts for security research (Derivative of inforcqb/cve-2026-0013-exploit)

PoC for CVE-2026-75616, an authenticated OS command injection in TP-Link Archer C20 v6 firmware

CVE-2026-47630 — NVIDIA Triton Inference Server: arbitrary dlopen via TRITON_BATCH_STRATEGY_PATH

LiteSpeed Cache Privilege Escalation PoC

PoC for the CVE-2024 Litespeed Cache Privilege Escalation

LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000

CVE-2024-28000 Exploit for litespeed-cache =<6.3 allows Privilege Escalation with creation of administrator account

CVE-2024-28000 LiteSpeed Cache Privilege Escalation Scan&Exp

Hands-on exploit lab for CVE-2024-28000 — unauthenticated privilege escalation in LiteSpeed Cache (WordPress plugin, <=6.3.0.1). Spins up a vulnerable environm…

Hands-on reproduction of CVE-2024-28000 in LiteSpeed Cache using an isolated WordPress lab. Includes reconnaissance, vulnerable hash recovery, Administrator pr…

Apple MacOS Screen Sharing Arbitrary File read/write -> RCE

Read-only PoC for CVE-2026-65400 — macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file read. Patched in macOS 26.6.1 / 15.7.9 / 14.8.9.

CVE-2026-65400

CVE-2021-24092 - Draft or TODO