CVE-2026-28134
randomrobbiebf/cve-2026-28134JetEngine <= 3.7.2 - Authenticated (Contributor+) Remote Code Execution
vulnerability-analysisexploitationweb-application-exploitation+1
Custom payload crafting, obfuscation, AV evasion, and delivery mechanism tools.
randomrobbiebf/cve-2026-28134JetEngine <= 3.7.2 - Authenticated (Contributor+) Remote Code Execution
k0nnect/halo-cve-2026-67919halo cms plugin 1-request rce from a url, PoC + exploit chain
zychen027/cve-2026-43499_hw-clt-al01Generates per-device kernel offsets from boot.img and compiles a preload library to exploit CVE-2026-43499 Android arm64 local privilege escalation.
cenobyte-vincit/slot2UEFI GRUB2 bootkit that installs a pre-boot networked implant via NVRAM boot option, chainloads a UKI, executes a dracut payload, and kexecs the…
cenobyte-vincit/dyenIn-memory Mach-O dylib loader for stock macOS Python; decrypts, maps, and runs payloads without dlopen or writing to disk, with optional encrypted…
velessecurity/cve-2020-14882-weblogic-analysisTechnical analysis and clean Java Thread Echo PoC for Oracle WebLogic Server vulnerability chain.
hackspeak/cve-2026-14669Proof-of-concept exploit for CVE-2026-14669, a PostgreSQL to_char() timezone abbreviation heap buffer overflow enabling RCE through information leak…
gitchw/ghostlock-cve-2026-43499CVE-2026-43499 (GhostLock) — Linux kernel futex PI rt_mutex UAF ARM32 privilege escalation research targeting Huawei Watch 4 Pro (kernel 5.4.210)
valentineus/hp-slate7-root-kitHP Slate 7 2800 Android 4.1.1 rooting kit using CVE-2015-1805.
l4st98/cve-2026-33017-fireflowProof-of-concept RCE for Langflow CVE-2026-33017 using a malicious custom component to execute OS commands via build_public_tmp and retrieve output…
lulztigre/cve-2026-41042Exploits unauthenticated RCE in Apache Gravitino < 1.2.1 via H2 JDBC INIT; hosts SQL/Java payloads, executes commands, and exfiltrates output over…
cyberauth/cve-2026-20079Implements the CVE-2026-20079 authentication-bypass-to-root-RCE chain against Cisco Secure FMC using fingerprint, check, proof, and interactive…
defineid/wildfireCVE-2026-39154 · Stored XSS in CometChat JS SDK
katransefa/cve-2026-13714Unauthenticated RCE exploit for Realtyna WPL < 5.3.0 that uploads a PHP webshell via hardcoded API key and executes arbitrary system commands.
r2qa/cve-2026-17544Exploit for CVE-2026-17544: PHP bcmath OOB write converted into memory-only RCE, bypassing disable_functions and open_basedir with a runtime…
686f6c61/poc-geoleak-cve-2026-52715PoC funcional de CVE-2026-52715 (GeoLeak): SQLi no autenticada en GEO my WordPress <= 4.5.5 via swlatlng/nelatlng. Laboratorio Docker + exploit…
mermehr/mouseserver-1.7.8.5-rcePoC exploit for CVE-2022-3218 targeting WiFi Mouse Server 1.7.8.5, achieving RCE via keystroke injection and in-memory PowerShell payload delivery…
oguzylmzx/cve-2025-64512-pdfminer-pocPoC for CVE-2025-64512: pdfminer.six CMapDB pickle deserialization RCE via crafted PDF