Tools

boreas37/cve-2026-85168-poc

CVE-2026-85168 — n8n Git node RCE from repo-local filter.*.clean / merge-driver config on add|commit|checkout. Verified v2.35.3 / v2.36.2.

aduli198/cve-2026-85102

Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN

blackhatexploitation/cve-2026-85097

Python PoC exploiting CVE-2026-85097, an unauthenticated file upload in Bricksforge <= 3.1.8.9, using a GIF/PHP polyglot and URL mismatch to achieve…

hakaioffsec/cve-2026-82957

Proof-of-concept exploit for CVE-2026-82957, an SSRF in Hyperledger FireFly webhook subscriptions that forces the node to request internal or cloud…

murrez/cve-2026-82901

Python PoC for CVE-2026-82901: unauthenticated arbitrary file upload in Ultra Addons for Contact Form 7 <=3.5.50 via signature field, with check and…

abraxas/t3code-websocket-ticket-origin

T3 Code 61c3794c origin leftover. wsTicket upgrade ignores Origin. Cookie missing Origin is accepted. Cookie hostile Origin is rejected. Loopback lab.

gmh5225/cve-2026-77770

Python PoC for CVE-2026-77770: unauthenticated arbitrary wp_options deletion in miniOrange 2FA (WordPress) <= 6.3.0 via the email-verification link.

murrez/cve-2026-76570

Python PoC for CVE-2026-76570: unauthenticated SQL injection in Joomla JCTables (com_jctables) front-end JSON API, with check, exploit and mass-scan…

h4zaz/cve-2026-76547

PHP Object Injection in Profile Builder < 4.0.1

maxprog-svg/cve-2026-76504-cisco

Python exploit for CVE-2026-76504, a Cisco Catalyst SD-WAN Manager authentication bypass via percent-encoded j_security_check, with token theft, API…

kush-coder/autopilot-pentest-ai

Official Build & Verified Release | Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a…

bobmarleyfaruk9/cve-2026-86962

Proof-of-concept code for CVE-2026-86962, demonstrating the vulnerability with a minimal Python implementation for verification and research.

murrez/cve-2026-85520

Python PoC for CVE-2026-85520: detects and exploits unauthenticated arbitrary file write in PrestaShop gmfeed feed.php to achieve RCE, with bulk…

woshigenm/cve-2026-98937

Verified PoC and analysis for a Linux perf/core permission-check bypass that leaks kernel callchain addresses to unprivileged Android tasks, enabling…

tc4dy/cve-2026-98432-poc-exploit

Toolkit for CVE-2026-98432 Linux TCP use-after-free: kernel patch checks, race oracle triggering, pcap UAF analysis, KASLR slide recovery, and…

janewas/cve-2026-98260-vivo-gki-research

Research notes: porting CVE-2026-98260 to vivo/iQOO GKI 6.6.127 (no exploit code; coordinated disclosure planned)

jadedfella/lpe-study-notes

A slow, from-zero walk through a Linux kernel privilege-escalation bug (CVE-2026-98260)