Every new exploit,
on the radar.

Security Advisory for CVE-2026-51565

Scan LLM outputs and AI-generated content for data exfiltration signals (EchoLeak, CVE-2025-32711) before they reach users or downstream systems

Proof-of-concept and analysis for CVE-2025-32711

Black-box test whether an LLM chatbot is vulnerable to markdown/HTML exfil (CVE-2025-32711 class). Spins up a sink, sends payloads, renders in headless Chromiu…

AISec Plus Week 1 threat write-up — EchoLeak (CVE-2025-32711), zero-click indirect prompt injection in Microsoft 365 Copilot.

PoC for CVE-2026-65694 — Microweber CMS (<=2.0.20) unauthenticated path traversal → arbitrary file read (.env / secrets)

CVE-2026-54900, CVE-2026-54902 - Draft

CVE-2020-5148 - Forced Authentication in the SonicWall UTM SSO Agent. The agent probes unvalidated workstations as Domain Admin, so one outbound web request yi…

CVE-2021-3262 - Blind SQL Injection in the editOEN parameter of TripSpark VEO Transportation / NovusEDU. Unauthenticated, internet-facing. Payloads, annotated …

CVE-2021-26837 - SQL Injection in the SearchTextbox parameter of HelpSystems/Fortra DeliverNow. Payloads, annotated requests, and evidence. Fixed in 1.2.18.

CVE-2026-12960 - Improper Export of Android Application Components in the ASUS Router app (com.asus.aihome). PoC, exploit APK, video, and vendor report. Fixed …

CVE-2026-61946: Unauthenticated IDOR in Easy Appointments <= 3.12.27

Hashes and shim versions for the UEFI Secure Boot shims affected by CVE-2026-8863

Chaining Security Bugs in Discuz! X5.0: from Race Condition to Pre-Auth RCE

Discuz! X5.0 Authentication Bypass Exploit Framework (CVE-2026-49952) - Critical vulnerability allowing unauthenticated database backup access via UC_KEY encry…

Path Traversal vulnerability in TahaBakhtari/SubtitleGenerator - CVE-2026-51592

DugganUSA threat-intelligence contributions to the IETF Hackathon — real-world agentic-attack benchmark vectors, CVE-2026-33697 attestation analysis, MCP verif…

Evidence-driven C/C++ vulnerability remediation pipeline + http-parser case study (CVE-2024-22019-class). Python core, React 19 console, 17-test verification s…

kernel exploit

A Proof of Concept (PoC) exploit for CVE-2015-1328

This is my SNP project where my ID is IT19366128

compiled CVE-2015-1328

CVE: 2015-1328 On python test

Custom vulnerable VM (Ubuntu 14.04) designed for teaching multi-stage penetration testing. Features 10 interconnected challenges across Forensics, Web Exploita…

Full black-box penetration test against SecOS:1 (VulnHub) — CSRF exploitation, privilege escalation via CVE-2015-1328 (OverlayFS), post-exploitation

ay 09 — CVE-2025-27520 (BentoML-style insecure deserialization) — Local Docker lab

exploit for CVE-2025-27520 A Remote Code Execution (RCE) vulnerability caused by insecure deserialization in the latest version (v1.4.2) of BentoML. It allows…

Reproducer for CVE-2026-46592: Apache Camel camel-cxf operationName header injection redirecting the invoked SOAP operation (confused deputy) from a read to a …

PoC reproducer for CVE-2026-49042 (Apache Camel camel-langchain4j-tools): a prompt-injected LLM's tool-call arguments become unfiltered Exchange headers, hijac…

PoC for CVE-2026-65650 - Elgg avatar upload DoS

PHPMailer < 5.2.18 Remote Code Execution exploit and vulnerable container

RCE against WordPress 4.6; Python port of https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html

Prevent PHP vulnerabilities similar to CVE-2016-10033 and CVE-2016-10045.

PHPMailer < 5.2.18 Remote Code Execution Exploit

Exploits CVE-2016-10033 and CVE-2016-10045

Code and vulnerable WordPress container for exploiting CVE-2016-10033

To solve CTFS.me problem

Reproducer for CVE-2026-46455 — Apache Camel camel-keycloak missing TokenVerifier.IS_ACTIVE check (expired access tokens accepted)

Reproducer for CVE-2026-46726: Apache Camel camel-vertx-websocket unfiltered inbound header injection enabling SSRF and secret disclosure via property-placehol…

Reproducer for CVE-2026-46590: Apache Camel camel-pqc key-lifecycle unsafe deserialization (FileBasedKeyLifecycleManager legacy .key migration via ObjectInputS…

Reproducer for CVE-2026-46584: Apache Camel camel-mail mail.smtp.* header injection enabling credential theft via on-path SOCKS interception (fixed in 4.14.8/4…