#1Static and dynamic code analysis, SAST, DAST, and code review tools.
Kitploit recommended
biitts/cve-2026-56121-feast-unauth-rceCVE-2026-56121 — Feast <0.63.0 unauthenticated RCE via gRPC registry dill.loads of OnDemandFeatureView UDF (pre-auth). Lab + PoC, verified e2e.
xxconi/cve-2026-5718CVE-2026-5718: Unauthenticated File Upload To RCE in DnD Upload CF7 Plugin
n40y/poc_cve-2025-32432CraftCMS CVE-2025-32432 - Clean PoC
xxconi/cve-2026-27384Automated scanner and exploit for CVE-2026-27384, an unauthenticated RCE in W3 Total Cache via mfunc/eval() injection. Features auto-detection, 48…
seqra/cve-2026-58138Reproduction kit for CVE-2026-58138, an unauthenticated RCE in Conductor. Includes OpenTaint static analysis rules, isolated tests, SARIF results,…
oscerd/cve-2026-40048Reproducer for CVE-2026-40048: Apache Camel camel-pqc FileBasedKeyLifecycleManager unsafe deserialization (RCE)
izxci/cve-2026-49777Python exploit for CVE-2026-49777, a critical unauthenticated RCE in ShapedPlugin Product Slider Pro for WooCommerce. Includes automated detection…
error-inside/cve-2026-47670Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
heshamash/cve-2026-11417-aws-cdk-rceTechnical writeup and Proof of Concept (PoC) for CVE-2026-11417: OS Command Injection / Remote Code Execution (RCE) in AWS CDK's NodejsFunction.
oscerd/cve-2026-43865Reproducer for CVE-2026-43865 — Apache Camel camel-hazelcast default-configured instance unsafe Java deserialization (RCE)
xxconi/cve-2026-3296CVE-2026-3296 is a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the Everest Forms WordPress plugin
biitts/cve-2026-58138-conductor-unauth-rceCVE-2026-58138 — Conductor (3.21.21..<3.30.2) unauthenticated RCE via INLINE GraalVM evaluator (HostAccess.ALL). Lab + PoC, verified e2e (root).
filipsedivy/cve-2020-15227Python-based checker for CVE-2020-15227 that tests Nette applications for remote code execution vulnerabilities via file_put_contents and shell_exec…
dexsemon/cve-2026-27495Proof-of-concept exploit and lab environment for CVE-2026-27495
oscerd/cve-2026-46591Reproducer for CVE-2026-46591: Apache Camel camel-neo4j Cypher injection via property names in CamelNeo4jMatchProperties, enabling authorization…
oscerd/cve-2026-43867Reproducer for CVE-2026-43867 — Apache Camel camel-pqc AwsSecretsManagerKeyLifecycleManager unsafe key-metadata deserialization (RCE)
oscerd/cve-2026-43866Reproducer for CVE-2026-43866 — Apache Camel camel-jms forged DefaultExchangeHolder bypass of the CVE-2026-40860 deserialization filter…
muslimbek-0x/cve-2026-48030Proof-of-concept exploit for CVE-2026-48030, a critical OS command injection in Pheditor 2.0.1-2.0.3. Includes vulnerable code analysis, PoC script,…
