Every new exploit,
on the radar.

DEPRECATED: Chef cookbook to audit & remediate "Shellshock" (BASH-CVE-2014-7169)

CVE-2014-7169 Shell Shock

This contains the Dockerfile for building and reproduing shellshock

No-dongle, no-root Bluetooth security assessment tool for wireless earbuds affected by the Airoha SDK vulnerability chain (CVE-2025-20700/20701/20702)

A combination of CVE-2026-55494 and CVE-2026-62308 to get root privilege RCE in tugtainer

CVE-2026-43724 - Apple's published enough advisories about the issue, I'm not getting paid for any of my kernel bugs.

DirtySlide XNU Exploit (CVE-2026-43724) For MacOS

SQL注入漏洞复现报告——OWASP靶场实战，通过UNION注入提取数据库29条用户凭证 ThinkPHP 5.0.24 RCE漏洞复现报告——CVE-2018-16385，验证代码执行能力

Reproducer for CVE-2026-46454 — Apache Camel camel-cometd inbound Bayeux header injection (unauthenticated Camel control-header injection → downstream producer…

Reproducer for CVE-2026-46453 — Apache Camel camel-elasticsearch-rest-client unprefixed-header injection (operation/query override via inbound HTTP headers)

PoC Exploit for the NTLM reflection SMB flaw.

Universal exploitation tool for CVE-2025-33073 targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled.

Proof-of-Concept

cupntlm

PoC Exploit for the NTLM reflection SMB flaw.

This rough PoC checker script tests targets for CVE-2025-33073 vulnerability by attempting to perform NTLM reflection attacks using NTLM auth coercion via samb…

Unauthenticated Arbitrary File/Folder Deletion in Joomla Helix Ultimate (JoomShaper) <= 2.2.6 — CVE-2026-57830

Initial upload

Admin-only terminal bootstrap routes checked only for login state, which let a normal team member drive Coolify's realtime terminal backend and execute command…

Reproducer for CVE-2026-43867 — Apache Camel camel-pqc AwsSecretsManagerKeyLifecycleManager unsafe key-metadata deserialization (RCE)

CVE-2019-5420 (Ruby on Rails)

A vulnerability can allow an attacker to guess the automatically generated development mode secret token.

Ruby反序列化命令执行漏洞（CVE-2019-5420）-vulfocus通关版

POC Exploit written in Ruby

cve-2019-5420 POC simple ruby script

cve-2019-5420

Unauthenticated Stored XSS in Joomla Helix Ultimate (JoomShaper) <= 2.2.6

CVE-2026-53805 - Draft

CVE-2026-45659

CVE-2026-48095

bee

CVE-2026-3805: Use-After-Free in curl SMB connection reuse - heap info disclosure

Apache Tomcat Remote Code Execution on Windows

Apache Tomcat Remote Code Execution on Windows - CGI-BIN

Vulnerability analysis and PoC for the Apache Tomcat - CGIServlet enableCmdLineArguments Remote Code Execution (RCE)

CVE-2019-0232-Remote Code Execution on Apache Tomcat 7.0.42

Hi this is a revised and enhanced code for CVE-2019-0232

CVE-2026-2002 writeup and Proof-of-concept

Clone from gist

Node.js vm2 CVE-2023-29017 reproduction with Docker Compose and PoC