Google-chrome-zero-day

Google Chrome Zero-Day — Web Security Track Learn, practice, and defend — ethically. This repository contains course materials and labs for the Web Security module . Use only in controlled, legal environments VMs, lab networks and follow the Responsible Disclosure & Code of Conduct below. Table o...

hello-ReGrade-security

hello-ReGrade-security A hands-on demo of zero-day discovery withReGrade. You'll point an ordinary test suite at ReGrade, record it against a tiny service, replay it against a second copy of the same service , and use Claude Code + the ReGrade MCP tools to surface a password-hash leak — a...

PrintNightmare-CVE-2021-34527

PrintNightmare CVE-2021-34527 By now you most probably already heard of the CVE-2021-34527 zero-day vulnerability in all Windows builds since 2003. While there's a fix being pushed by Microsoft, you might still want to restrict devices in your network to be vulnerable. These Intune or Microsoft...

ToolShell-Honeypot

ToolShell-Honeypot SharePoint Zero-Day A Docker-based honeypot focused on detecting and logging exploitation attempts against Microsoft SharePoint zero-day vulnerabilities. This honeypot is designed for early detection and threat intelligence, not for simulating a full SharePoint environment or...

CVE-2022-30190-Zero-Click-Zero-Day-in-msdt

This repository does not have a README...

Event-ID-263-Arbitrary-File-Read-on-Checkpoint-Security-Gateway-CVE-2024-24919-

SOC Alert Analysis: Arbitrary File Read on Checkpoint Security Gateway CVE-2024-24919 Introduction CVE-2024-24919 is a critical zero-day vulnerability in Check Point Security Gateways that allows unauthenticated remote attackers to read arbitrary files from affected systems. Discovered in May 202...

PrintNightmare

Critical Vulnerability PrintNightmare CVE-2021-1675, CVE-2021-34527 Currently no solution from Microsoft yet as of 02.07.2021 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 Affects all operating system versions server and client Options Disable Print Spooler Adjust ACL Event...

CVE-2023-4357-APT-Style-exploitation

CVE-2023-4357-APT-Style-exploitation Apt style exploitation of Chrome 0day CVE-2023-4357 https://ogulcan-unveren.medium.com/seviye-y%C3%BCkseltmek-chrome-zerodayi-xss-ile-tetiklemek-23b8498f9701...

Open WebUI 'LDAP Empty Password' - Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...

Gogs <= 0.13.3 - Remote Code Execution

Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a...

Aquatronica Controller System <= 5.1.6 - Information Disclosure

Aquatronica Controller System firmware 5.1.6 and earlier and web interface 2.0 and earlier contain an information disclosure vulnerability caused by unauthenticated access to tcp.php endpoint, letting remote attackers retrieve sensitive configuration data including plaintext credentials, exploit...

Dify User Enumeration via Observable Response Discrepancy

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue. id: CVE-2026-28288 info: name: Dify User Enumeratio...

CVE-2025-14174-Chrome-Zero-Day

Affected Software: Google Chrome prior to version 121.0.6167.85. Vulnerability Type: Use‑after‑free in the V8 JavaScript engine. Description: A use‑after‑free bug in V8’s garbage collection allows crafted JavaScript to corrupt memory, leading to arbitrary code execution within the browser context...

LIVEBOX-0DAY

This repository does not have a README...

reverie

Reverie An efficient implementation of the NIZKPoK outlined in KKW 2018 Reverie is an implementation prover and verifier of the MPC-in-the-head NIZKPoK outlined in Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures. Reverie seeks to offer concrete prover efficien...

CVE-2025-8088-WinRAR-Zero-Day-Path-Traversal

CVE-2025-8088: WinRAR’s Zero-Day Path Traversal — From Zero to Pwn 🗿 Intro – The “Old Friend” Just Got Caught Slipping WinRAR — the dusty classic everyone has installed but no one updates — just got slapped with a high-severity zero-day : CVE-2025-8088. Severity: CVSS v3.1 → 8.8 High Exploited in...

CVE-2022-30190-Analysis-With-LetsDefends-Lab

CVE-2022-30190-Analysis-With-LetsDefends-Lab On May 27, 2022, the NaoSec technical team attempted to analyze and discovered a document in .doc format that appeared malicious. The document was indicated to have been uploaded from an IP address in Belarus. This suspicion was further traced and on M...

CVE-2022-29856-PoC

CVE-2022-29856-PoC Minimal PoC for CVE-2022-29856 Credits: https://dolosgroup.io/blog/2022/4/28/anatomy-of-a-zero-day-how-to-decrypt-a-robot...

CVE-2022-37332-RCE-

Foxit nday : CURRENTLY UNDER WORK... ALL I NEED TO IMPLEMENT IS JIT SPRAYING ..... also tested on Version: 9.0.1.1049 so yeahh idk : enjoy...

Linux Distros Unpatched Vulnerability : CVE-2026-98647

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix divide-by-zero in btfstructwalk When an access goes past the struct and the last member is a flexible array, btfstructwalk folds the offset back into a...