CVE-2026-114094

A flaw was found in Dulwich. On Windows systems, the application fails to validate drive letter prefixes within repository paths during checkout operations. A remote attacker could exploit this flaw by enticing a user to clone or check out a specially crafted Git repository containing malicious...

CVE-2026-113222

A flaw was found in Chromium's V8 engine. A remote attacker could exploit this use-after-free vulnerability by convincing a user to visit a specially crafted HTML page. Successful exploitation could allow the attacker to execute arbitrary code outside the browser sandbox...

CVE-2026-113300

A flaw was found in the Forms component of chromium-browser. This vulnerability allows a remote attacker to achieve arbitrary code execution outside of the browser security sandbox. By tricking a user into visiting a specially crafted HTML page, an attacker can trigger an out-of-bounds memory wri...

CVE-2026-113189

A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution outside the browser sandbox by enticing a user to visit a specially crafted HTML page. The issue stems from a use-after-free memory management vulnerability in the Core component, which ca...

exphub

Notice In the end, I still felt that having separate scripts for each vulnerability was very inconvenient, so I integrated all poc and exp scripts into one, enabling one-click scanning + exploitation. Since I've been working on integration recently, Exphub has not been updated for a long time. Th...

Partial-deobfuscated-sc-from-HackingTeam-Malware.-

This repository does not have a README...

dlinject

dlinject.py Inject a shared library i.e. arbitrary code into a live linux process, without ptrace. Inspired by Cexigua and linux-inject, among other things. Usage .. . | /| | || || / | .. / | | | | |/ \ | |/ / \ \ \ | \ | |/|| /| |\ \ | /| // | / /| / / /|| / source:...

CVE-2025-61882

Oracle E-Business Suite RCE Scanner CVE-2025-61882 A fast, multi-threaded bulk scanner for detecting CVE-2025-61882 in Oracle E-Business Suite installations. This critical vulnerability allows unauthenticated remote code execution. 🎯 Features Bulk Scanning - Process hundreds or thousands of...

php2shell-checker-claude

Instrucciones en español al final PHP2Shell C...

Apache-CVE-2026-23918-fix

Apache HTTP Server: http2: Double Free and possible RCE on early reset CVE-2026-23918. Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issu...

Lastenzug

LastenZug This project implements a Socka4a proxy based on websockets. The client component is implemented in C compiling down to fully position independent code PIC. During the compilation process, obfuscation is applied on assembly level by leveraging a second tool: SpiderPIC located in...

CVE-2026-94127

CVE-2026-94127 — F5 BIG-IP APM Detection Tool Defensive Author: https://github.com/FurkanKAYAPINAR/ A defensive, non-exploit detector for CVE-2026-94127 , a heap-based buffer overflow CWE-122 in F5 BIG-IP APM that allows an unauthenticated remote attacker to achieve remote code execution RCE. CVS...

CVE-2026-86218

CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit Overview This is a Python 3 proof-of-concept exploit for CVE-2026-86218, a critical pre-authentication remote code execution vulnerability in N-able N-central. Vulnerability Details: CVE: CVE-2026-86218 CVSS Score: 10.0 Critical CWE: CWE-96...

Atom-CMS-2.0---File-Upload-Remote-Code-Execution-Un-Authenticated-POC

Atom-CMS-2.0---File-Upload-Remote-Code-Execution-Un-Authenticated- Remote Code Execution RCE Exploit Author: Ashish Koli Shikari Vendor Homepage: https://thedigitalcraft.com/ Software Link: https://github.com/thedigicraft/Atom.CMS Version: 2.0 CVE: CVE-2022-25487 About this: This script uploads...

Exploit for CVE-2026-109618

PHP2Shell: Two Days of Records – From Exposure, Previews to Pa...

fastjson-cve-2026-16723

Disclaimer : This project is intended for security research and learning purposes in authorized environments only. Testing against unauthorized systems is prohibited, and users are solely responsible for any consequences of use. Fastjson 1.2.83 Remote Code Execution Vulnerability Analysis...

fastjson-check

fastjson-check 一条命令，查清你的 Java 应用里到底有没有 fastjson、藏在哪、是否受 CVE-2026-16723 影响。 零依赖 · 完全离线 · 单个 23KB 的 jar · 支持 Java 8+ English | 下载 为什么需要它 2026 年 7 月 21 日，fastjson 官方公布 CVE-2026-16723 （CVSS 9.0 ，远程代码执行）： 影响 fastjson 1.2.68 1.2.83 默认配置即可利用 —— 不需要开启 AutoType，不需要 classpath gadget，不需要认证 公告数日内即出现在野利用，主要针对...

GHSA-F2PH-CMG5-WXC8 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of...

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of...

NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites vulnerability discovered by ? in WordPress Npm storybook versions = 8.0.0, 8.6.19...