0days-in-the-wild
googleprojectzero/0days-in-the-wildRepository for information about 0-days exploited in-the-wild.
curated-resourceseducationexploitation+3
1.0k
googleprojectzero/0days-in-the-wildRepository for information about 0-days exploited in-the-wild.
turroks/cve_prioritizerStreamline vulnerability patching with CVSS, EPSS, and CISA's Known Exploited Vulnerabilities. Prioritize actions based on real-time threat…
cisagov/kev-dataMirrors CISA's Known Exploited Vulnerabilities (KEV) catalog as CSV and JSON with a JSON schema, enabling programmatic access and commit-history…
rxerium/rxerium-templatesNuclei scripts created by @rxerium for zero days / actively exploited vulnerabilities.
trinitor/cve-vulnerability-information-downloaderDownloads and aggregates CVSS, EPSS, and CISA known exploited vulnerability data into unified JSON/CSV files and a SQLite database. Enriches…
manishrawat21/cisa-kev-threat-intel-orchestratorZero-touch pipeline that turns newly weaponized CVEs from the CISA Known Exploited Vulnerabilities (KEV) catalog into production-ready Sigma…
adityabhatt3010/cve-2025-49706-sharepoint-spoofing-vulnerability-under-active-exploitationA deep dive into CVE-2025-49706 — the SharePoint spoofing flaw now exploited in the wild for stealthy web shell deployment and privilege escalation.
vulncheck-oss/jupyter-notebooksExample Jupyter notebooks that query VulnCheck APIs to chart exploitation timelines, Known Exploited Vulnerabilities, and botnet data for threat…
rxerium/cisa-kevAggregates and cross-references CISA's Known Exploited Vulnerabilities with VulnCheck KEV and Nuclei scanning templates for coverage analysis.
adityabhatt3010/cve-2025-61882-oracle-e-business-suite-pre-auth-rce-exploitA critical pre-authentication Remote Code Execution (RCE) flaw in Oracle E-Business Suite (versions 12.2.3 - 12.2.14) allows attackers to gain full…
mrk336/kernel-chaos-weaponizing-cve-2025-62215-for-system-privilege-escalationHands‑on analysis of CVE‑2025‑62215, a Windows Kernel race condition exploited in the wild. Demonstrates privilege escalation to SYSTEM, detection…
mvlnetdev/cve-2021-31166-detection-rulesDifferent rules to detect if CVE-2021-31166 is being exploited
harshiys/cve-2007-2447-exploitation-siem-detection-labIsolated AD/Linux attack lab: exploited CVE-2007-2447 via Metasploit, detected with Wazuh SIEM mapped to MITRE ATT&CK (T1190, T1059)
zavikhttak/follina-msdt-threat-investigation🔵 Threat analysis writeup for Follina (CVE-2022-30190) — Microsoft MSDT RCE zero-day exploited in the wild. Covers static analysis, VirusTotal,…
ishwardeepp/cve-2025-0411-motw-pocProof-of-concept and technical analysis of CVE-2025-0411, a 7-Zip Mark-of-the-Web bypass vulnerability exploited in SmokeLoader campaigns, with…
zeltoc/threat-intel-brief-cve-2026-42208-litellmThreat intelligence brief on CVE-2026-42208, a critical pre-auth SQL injection in BerriAI LiteLLM exploited within 36 hours of disclosure. Covers…
justjeff211/conti-ransomware-writeupConducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…
cert-lv/exchange_webshell_detectionDetect webshells dropped on Microsoft Exchange servers exploited through "proxylogon" group of vulnerabilites (CVE-2021-26855, CVE-2021-26857,…