ressl/cve-2026-87902-poc PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab Create: 2026-09-22 18:40:26 +0000 UTC Push: 2026-09-22 18:40:27 +0000 UTC |

abraxas/CVE-2026-87902 CVE-2026-87902 - WordPress - WordPress Core - High 8.1 - Unauthenticated GET /?page_id={id}&pagename=templates%252... - Unauthenticated Local File Inclusion (conditional RCE) Create: 2026-09-22 18:13:48 +0000 UTC Push: 2026-09-22 18:13:49 +0000 UTC |

lukehebe/IBM-Langflow-CVE-2026-48519-poc CVE-2026-48519 pre-auth rce poc in IBM langflow <= 1.9.1 Create: 2026-09-22 16:35:55 +0000 UTC Push: 2026-09-22 16:35:56 +0000 UTC |

rushikesh-a-bhujbal/CVE-2011-2523 From-scratch exploit development in Python. No Metasploit. No frameworks. Raw socket-level implementation of real CVEs against authorized lab targets. Create: 2026-09-22 16:33:22 +0000 UTC Push: 2026-09-22 16:33:23 +0000 UTC |

WadesWeaponShed/CVE-2026-91843_Checks Simple Checks to look for indicators of compromise Create: 2026-09-22 16:28:41 +0000 UTC Push: 2026-09-22 16:28:42 +0000 UTC |

WadesWeaponShed/CVE-2026-93616_Checks Simple Checks to look for indicators of compromise Create: 2026-09-22 16:28:41 +0000 UTC Push: 2026-09-22 16:28:45 +0000 UTC |

ShadowForge-Cyber/CVE-2026-84388-POC Improper Restriction of Rendered UI Layers or Frames (CWE-1021) Create: 2026-09-22 16:22:18 +0000 UTC Push: 2026-09-22 16:22:19 +0000 UTC |

Yutori-Natsu/cve-2023-6931-pipa Create: 2026-09-22 14:02:28 +0000 UTC Push: 2026-09-22 14:02:35 +0000 UTC |

0xBlackash/CVE-2026-93485 CVE-2026-93485 Create: 2026-09-22 13:47:36 +0000 UTC Push: 2026-09-22 13:47:37 +0000 UTC |

digiprosec/cve-2026-86060 cve-2026-86060 PoC Create: 2026-09-22 13:23:54 +0000 UTC Push: 2026-09-22 13:23:55 +0000 UTC |

sadandbset/CVE-2026-51772-CVE-2026-51772 This project describes detailed information about the CVE-2026-51772 and CVE-2026-51773 vulnerabilities. Create: 2026-09-22 12:34:22 +0000 UTC Push: 2026-09-22 12:34:23 +0000 UTC |

sadandbset/CVE-2026-51772 This project describes detailed information about the CVE-2026-51772 vulnerability. Create: 2026-09-22 11:57:53 +0000 UTC Push: 2026-09-22 11:57:54 +0000 UTC |

sadandbset/CVE-2026-51772-CVE-2026-51773 This project describes detailed information about the CVE-2026-51772 vulnerability. Create: 2026-09-22 11:57:53 +0000 UTC Push: 2026-09-22 12:30:07 +0000 UTC |

gagaltotal/CVE-2026-68376-Ubuntu-7.0.0-30-Poc CVE-2026-68376 - Ubuntu Kernel 7.0.0-30 Create: 2026-09-22 11:06:25 +0000 UTC Push: 2026-09-22 11:06:26 +0000 UTC |

HORKimhab/CVE-2026-93485 CVE-2026-93485 - Draft or TODO Create: 2026-09-22 09:34:07 +0000 UTC Push: 2026-09-22 09:34:13 +0000 UTC |

murrez/CVE-2026-19658 WordPress Give Tributes CVE-2026-19658: Python 3 checker, FOFA helper, legacy Give form exploit path (CWE-502, CVSS 9.8). Create: 2026-09-22 06:37:07 +0000 UTC Push: 2026-09-22 06:37:08 +0000 UTC |

murrez/CVE-2026-13355 CVE-2026-13355 PoC — Meta Box AIO ≤3.11.0 unauthenticated admin privesc via MB Frontend Submission + User Profile shortcode chain. Python check/exploit, FOFA helper, mass scan with live flow. Create: 2026-09-22 06:08:57 +0000 UTC Push: 2026-09-22 06:08:58 +0000 UTC |

Nxploited/CVE-2026-91097-CVE-2026-91106 HPLIP < 3.26.6 — Full admin takeover via PAPPL web interface (no auth). Related to CVE-2026-91097 through CVE-2026-91106 (CVSS 9.3) Create: 2026-09-22 04:49:01 +0000 UTC Push: 2026-09-22 04:49:02 +0000 UTC |

yyymk/CVE-2026-94570-sglang-aux-data-dos Public disclosure of CVE-2026-94570. Create: 2026-09-22 04:35:51 +0000 UTC Push: 2026-09-22 04:35:52 +0000 UTC |

Aayushbankar/cve-2026-28576 CVE-2026-28576 (GHSA-ph86-9mcx-3p6r) — Android Contacts Provider SQL Injection via targetSdk-gated ENFORCE_STRICT_SQL_CHECKS. Zero-permission boolean-oracle PoC + Red Team app with consent-gated dashboard exfiltration. Create: 2026-09-22 04:23:04 +0000 UTC Push: 2026-09-22 04:23:17 +0000 UTC |