Every new exploit,
on the radar.

Provenance-aware Linux kernel vulnerability research harness used in the investigation of CVE-2026-53075

POC of CVE-2026-53075

Evidence-driven Linux kernel vulnerability research harness used in the investigation of CVE-2026-31720

Technical vulnerability analysis and CVE briefing for CVE-2026-9645 affecting ScadaBR.

CVE-2026-19195 Proof of Concept

CVE-2026-19193 Proof of Concept

PoC for CVE-2026-71554 - h2 duplicate Host header request smuggling primitive (fixed in 4.4.1)

The Joomla extension PhocaCommander is vulnerable to Path Traversal in the getSource function - CVSS 8.2

The Joomla extension PhocaCommander is vulnerable to Path Traversal in delete, copy, move actions - CVSS 6.4

The Joomla extension PhocaCommander is vulnerable to Path Traversal in the file upload action - CVSS 6.1

Sudo exploit

Containerized and deployable use of the CVE-2019-14287 vuln. View README.md for more.

Sudo Security Bypass (CVE-2019-14287)

This is a container built for demonstration purposes that has a version of the sudo command which is vulnerable to CVE-2019-14287

Reproduction and patch verification of CVE-2026-24055 (CWE-284) - an unauthenticated OAuth access control vulnerability in Langfuse allowing Slack workspace hi…

CVE-2026-59774

PoC for CVE-2026-18953 — arbitrary file write (CWE-22) in awslabs.aws-transform-mcp-server's get_resource tool via the savePath parameter

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php…

CVE-2023-6553 exploit script

Exploit Development for CVE-2023-6553 on Backup Plugin in Wordpress

This exploit is based on CVE-2023-6553 and was built upon the original exploit by Chocapik, it was added that a direct reverse shell can be obtained.

This exploit is based on CVE-2017-9757 and was built upon the original exploit by 0x09AL.

SyncBreeze exploit for CVE-2017-9757

CVE-2025-66680

Windows utility that uses the vulnerable WiseDelfile64.sys driver affected by CVE-2025-66680 to enable kernel-assisted file deletion.

CVE-2026-67595 — Embedded malicious JavaScript (spyware) in VaahCMS 2.0.0–2.3.4 official releases. CVSS 8.1. Advisory + detection.

CVE-2026-67598 — Emlog Pro: disabled TLS certificate validation in AI assistant (MITM → API-key theft). CWE-295, CVSS 9.1. Reported by @IlhomjonR.

POC_CVE-2026-45185 for nuclei-templates

Dead.Letter CVE-2026-45185 EXIM Vulnerability Detection Script

These detection scripts are property of the SECPlayground Platform. Two safe detection scripts. Neither drives the close_notify-mid-BDAT trigger, so they will…

Wormable exploit for CVE-2026-57858

Scanner: CVE-2026-42208 LiteLLM SQL Injection — Python scanner for BerriAI LiteLLM proxy instances

CVE-2026-42208 lab

CVE-2026-40487

Threat intelligence brief on CVE-2026-42208, a critical pre-auth SQL injection in BerriAI LiteLLM exploited within 36 hours of disclosure. Covers attack path, …

A lightweight Python-based security assessment tool for detecting dangerous Cross-Origin Resource Sharing (CORS) misconfigurations - CVE-2025-34291.

Scanner: CVE-2025-34291 Langflow Origin Validation Error / CORS Misconfiguration — Python checker (CISA KEV)