hypnguyen1209 / CVE-2026-62911

POC pre-auth RCE on Exchange

DeathShotXD / Comment2Shell

Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker

Boreas37 / CVE-2026-64638-PoC-XSS2Shell-

XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain — PoC exploit + defensive audit tool + nuclei template

hypnguyen1209 / log4j2-rce

Pre-auth RCE via FilteredObjectInputStream MarshalledObject bypass in Apache Log4j 2

imbas007 / CVE-2026-42533

nginx heap buffer overflow PoC — CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed on Ubuntu 24.04.

0xReadingSteiner / Silent-Call

Silent;Call — Pre-authentication remote root on Cisco CUCM 15.x (CVSS 10.0)