Every new exploit,
on the radar.

Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026.

CVE-2026-49176 WalletService LPE — standalone PoC + Cobalt Strike BOF (SYSTEM command on interactive session)

Web Help Desk Hardcoded Credential Vulnerability (CVE-2024-28987)

Proof of Concept Exploit for CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability

Proof of Concept Exploit for CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability

**CVE-2024-28987** is a critical vulnerability in SolarWinds Web Help Desk (WHD) that allows remote attackers to access sensitive ticket information using **ha…

Security Advisory: Camaleon CMS - Authenticated RCE via `select_eval` Custom Field

CVE-2023-22515: Confluence Broken Access Control Exploit

Confluence未授权添加管理员用户(CVE-2023-22515)漏洞利用工具

Scanner for CVE-2023-22515 - Broken Access Control Vulnerability in Atlassian Confluence

CVE-2023-22515

Confluence Unauthorized Administrator User Addition Exploitation Script

配合 CVE-2023-22515 后台上传jar包实现RCE

Confluence后台rce

Poc for CVE-2023-22515

Path Traversal in AgentDVR

Security Advisory: Unchecked Room Lookup Leads to Server Crash (Let's Chat)

Security Advisory: Insufficient Access Controls Allow for Unauthorized File Downloads (Let's Chat)

Security Advisory: Insufficient Access Controls Allow for Unauthorized Room Deletion (Let's Chat)

Security Advisory: Unauthenticated Memory Leak Leads To Memory Exhaustion (TinyWeb)

Security Advisory: Unauthenticated NULL Pointer Dereference Crashes the Server (TinyWeb)

Security Advisory: Unauthenticated Path Traversal Allows Arbitrary File Read (TinyWeb)

Security Advisory: HTTP Request Smuggling via Unparsed Transfer-Encoding Values (tiny_http)

Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values (tiny_http)

Security Advisory: HTTP Request Smuggling Enables Front-End Access Control Bypass (rouille)

Security Advisory: Remote Denial of Service via Reachable Assertion in URL Prefix Handling (rouille)

Security Advisory: HTTP Request Smuggling via Transfer-Encoding Desynchronization (rouille)

Security Advisory: HTTP Response Splitting via Unvalidated Response Header Values (rouille)

Path Traversal Vulnerability in NitroShare v0.3.4

IoT Security research conducted during my internship at IIIT Allahabad, leading to CVE-2026-65893, CVE-2026-65894, and the CERT-In Vulnerability Note CIVN-2026…

Unprivileged user to root on macOS Sonoma, Sequoia, and Tahoe. Patched in macOS 26.6 / 15.7.8 / 14.8.8.

A small PoC for the Keycloak vulnerability CVE-2023-0264

Reflected XSS vulnerability in MikroTik Hotspot login page

EasyStore Joomla Pre-Auth SQL Injection via filter_sortby Direction (CVE-2026-65761, CVSS 9.3)

Proof of Concept for CVE-2026-65761 - EasyStore Pro Unauthenticated SQL Injection via `filter_sortby`

PoC exploit for Below privilege escalation (CVE-2025-27591) allowing local root access via symlink manipulation in world-writable log directory.

Isolated regression and security-control lab for CVE-2026-59891 in @sigstore/oci