gichirimaku / wp2shell-PoC
CVE-2026-63030 + CVE-2026-60137 exploit RCE chain.
gichirimaku / wp2shell-PoC
jburgess-r7 / CVE-2026-97229-PoC
GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image
code-zm / plex2shell
CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
sakidekin / CVE-2026-41940-PoC
cPanel & WHM Authentication Bypass via CVE-2026-41940 explotation
opaxial / CVE-2026-9830
CVE-2026-9830 Proof of Concept
aniqfakhrul / CVE-2026-54121
Certighost POC
hypnguyen1209 / CVE-2026-62911
POC pre-auth RCE on Exchange
ynsmroztas / KeySniper
**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.
rafabd1 / CVE-2026-75604-poc
CVE-2026-75604 Next.js Windows RCE poc
dinosn / mikrotrick-poc
CVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC
watchtowrlabs / watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452
CVE-2026-8452 PreAuth RCE
DeathShotXD / Comment2Shell
Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker
sfewer-r7 / CVE-2026-55040
Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040)
Boreas37 / CVE-2026-64638-PoC-XSS2Shell-
XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain — PoC exploit + defensive audit tool + nuclei template
digiprosec / MicroTrick
cve-2026-86060 PoC
EQSTLab / CVE-2026-94545
Next.js RCE
Snizi / CVE-2026-18963-Exploit
Exploit for KeyCloak CVE-2026-18963
guneykabel / cve-2026-85706
Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7–19.1.7; 19.2.0–19.2.5; 19.3.0–19.3.1
petermalone / CVE-2026-84543
Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability
ressl / cve-2026-87902-poc
PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab
imbas007 / POC-CVE-2026-60206
cve cve-2026-60206 weblogic saml exploit poc vulnerability oracle scanner security
imbas007 / CVE-2026-42533
nginx heap buffer overflow PoC — CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed on Ubuntu 24.04.
abraxas / CVE-2026-87902
CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion (conditional RCE)
predyy / CVE-2026-34990
CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc.
tc4dy / CVE-2026-54121-PoC-Exploit
CVE-2026-54121 - CertiGhost AD CS Multi-Exploit Framework | Rogue DC + LDAP spoofing, certificate abuse, PKINIT hash extraction, auto DCSync. Safe Checker + full exploit, multi-threaded mass scan, Shodan integration, JSON/CSV/JSONL output. CVSS 8.8 High. Use Ethically, Stay Legal :v
EQSTLab / CVE-2026-85706
GitLab Unauthenticated Arbitrary File Read