Every new exploit,
on the radar.

patching N-day of CVE-2026-26114 before microsoft. where microsoft could not patch 100% in many months. but FAC security did it

PoC Exploit for VM2 Sandbox Escape Vulnerability

Tool for exploring CVE-2023-30547

PoC to CVE-2023-30547 (Library vm2)

Walkthrough for Codify (Linux - Easy). Exploits vm2 RCE (CVE-2023-30547), SQLite DB hash extraction, Bcrypt cracking with John, and Privilege Escalation via B…

CVE-2026-9848 is an Unauthenticated SQL Injection (SQLi) vulnerability affecting the WP Ticket (Customer Support Ticket System & Helpdesk) plugin for WordPress…

Weaponized CobaltStrike BOF for CVE-2023-36874 Windows Error Reporting LPE

This repository contains a proof-of-concept exploit written in C++ that demonstrates the exploitation of a vulnerability affecting the Windows Error Reporting …

CVE-2023-36874 Proof of Concept

Educational Proof of Concept (PoC) for CVE-2023-36874 — Windows Error Reporting (WER) Local Privilege Escalation vulnerability.

HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2022-21907

A REAL DoS exploit for CVE-2022-21907

Proof of concept of CVE-2022-21907 Double Free in http.sys driver, triggering a kernel crash on IIS servers

CVE-2022-21907 Vulnerability PoC

CVE-2022-21907: detection, protection, exploitation and demonstration. Exploitation: Powershell, Python, Ruby, NMAP and Metasploit. Detection and protection: P…

POC for CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability.

PoC for CVE-2021-31166 and CVE-2022-21907

cve-2022-21907

Path traversal (Tar Slip) in Cornac via _extract_archive (CVE-2026-43637)

Code injection (RCE) in datamodel-code-generator via unvalidated customBasePath (CVE-2026-63720)

Unauthenticated arbitrary file read in Flowise (< 2.2.4) via path traversal in getFileFromStorage (storageUtils.ts). Caused by un-sanitized file path combined …

SQL injection in PyAthena via DefaultParameterFormatter (CVE-2026-65321)

CVE-2026-32941 PoC

CVE-2026-17583 - Draft

🦀 C→Rust port of DaveGamble/cJSON — 🧪 22/22 original tests unmodified, 🐛 70M+ fuzz comparisons/0 divergences, 🎯 CVE-2025-57052 fixed.

CVE-2026-8337 is an Insecure Direct Object Reference (IDOR) vulnerability in Concrete CMS that affects the Survey feature. Unlike CVE-2026-8347 (which involved…

proof-of-concept scripts for 2 unauthenticated RCEs in Samba (CVE-2026-4408 & CVE-2026-4480) and local privilege escalation in TelnetD (CVE-2026-28372)

Handlebars.js AST Injection Remote Code Execution Vulnerability

Python POC, Exploit for Handlebars.js AST Injection RCE, Handlebars.js versions 4.0.0 through 4.7.8 are affected. CVSS score: 9.8 Critical.

CVE-2026-33937 Handlebars RCE exploit PoC (AST Injection)

this is a poc for CVE-2026-33937

CVE-2026-52887 — NocoBase SQL injection -> PostgreSQL-superuser RCE (myInAppChannels:list filter, CVSS 10.0). Author PoC + source analysis + docker lab.

CVE-2026-12940 — Langflow OSS <=1.10.1 unauthenticated RCE via MCP stdio environment-variable injection (SHELLOPTS/PS4). Author PoC + source analysis + lab.