jed-parsec/CVE-2026-63030-60137-wp2shell-lab Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only. Create: 2026-09-27 13:25:52 +0000 UTC Push: 2026-09-27 13:25:53 +0000 UTC |

tc4dy/CVE-2026-67279-86060-Toolkit 🛡️ CVE-2026-67279 + CVE-2026-86060 – MikroTrick MikroTik RouterOS SSH Pre-Auth Takeover (CVSS 9.2) | Red/Blue Team suite. 2 tools: Full Exploit (rekey bypass, fd-2 policy swap, full-admin shell, plant, mass scan, SOCKS5/Tor, stealth) & SafeDetect (banner/version audit, IoC guidance, JSON/CSV/HTML). Use Ethically & Safety only. Create: 2026-09-27 12:03:42 +0000 UTC Push: 2026-09-27 12:04:23 +0000 UTC |

langz337/CVE-2026-87902 Unauthenticated LFI and conditional RCE scanner for CVE-2026-87902 in WordPress Core (4.7.0 – 7.1.1). Create: 2026-09-27 12:03:13 +0000 UTC Push: 2026-09-27 12:03:15 +0000 UTC |

4minx/CVE-2026-48842 CVE-2026-48842 PoC — Roundcube virtuser_query pre-auth SQLi Create: 2026-09-27 11:26:19 +0000 UTC Push: 2026-09-27 11:26:20 +0000 UTC |

murrez/CVE-2026-100835 CVE-2026-100835 PoC: Edgeless Contrast <1.16.0 remote attestation relay (aTLS / CWE-295). Manifest audit (AllowedChipIDs/AllowedPIIDs), version & coordinator probe. https://pocbit.org/pocs/cve-2026-100835 Create: 2026-09-27 10:53:39 +0000 UTC Push: 2026-09-27 10:53:41 +0000 UTC |

gbuyssens/CVE-2026-34990 Local privilege escalation against a root `cupsd`. Create: 2026-09-27 10:27:04 +0000 UTC Push: 2026-09-27 10:27:06 +0000 UTC |

gbuyssens/CVE-2026-28695-craft-rce-bypass Authenticated, **blind** remote code execution in Craft CMS. Fix for CVE-2026-28695 Create: 2026-09-27 10:16:49 +0000 UTC Push: 2026-09-27 10:16:50 +0000 UTC |

0xc4rc3l/CVE-2026-34990-poc Create: 2026-09-27 09:25:45 +0000 UTC Push: 2026-09-27 09:25:46 +0000 UTC |

X-Bulow/Reproduce-CVE-2025-32433 Create: 2026-09-27 09:22:01 +0000 UTC Push: 2026-09-27 09:22:02 +0000 UTC |

be-keb/CVE-2026-12227-Visual-Composer-Website-Builder-Unauthenticated-Local-File-Inclusion-LFI- CVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE). Create: 2026-09-27 09:03:34 +0000 UTC Push: 2026-09-27 09:03:35 +0000 UTC |

be-keb/CVE-2026-12227 CVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE). Create: 2026-09-27 09:03:34 +0000 UTC Push: 2026-09-27 09:09:06 +0000 UTC |

v4naxx/YellowKey-BitLocker-CVE-2026-45585 YellowKey BitLocker recovery audits CVE-2026-45585: yellowkey github, TPM, recovery key backup. Windows 10/11 CLI GUI, portable audit tool for volumes you own. Extract and run. Official free download. Download:➧ Create: 2026-09-27 07:58:27 +0000 UTC Push: 2026-09-27 07:58:29 +0000 UTC |

YellowKeyBitLocker-CVE/YellowKey-BitLocker-CVE-2026-45585 YellowKey BitLocker recovery audits CVE-2026-45585: yellowkey github, TPM, recovery key backup. Windows 10/11 CLI GUI, portable audit tool for volumes you own. Extract and run. Official free download. Download:➧ Create: 2026-09-27 07:58:27 +0000 UTC Push: 2026-09-27 08:30:58 +0000 UTC |

raflesiait/CVE-2020-14008---ManageEngine CVE-2020-14008 — ManageEngine Applications Manager Remote Code Execution Create: 2026-09-27 07:41:02 +0000 UTC Push: 2026-09-27 07:41:13 +0000 UTC |

techupdate24/citrix-netscaler-cve-2026-8452-rce A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines. Create: 2026-09-27 07:29:49 +0000 UTC Push: 2026-09-27 07:29:54 +0000 UTC |

4xura/CVE-2026-44011-craftcms-auth-rce The PoC of CVE-2026-44011: Craft CMS, from 4.0.0 to before 4.17.12 and 5.9.18, contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. Create: 2026-09-27 06:57:34 +0000 UTC Push: 2026-09-27 06:57:35 +0000 UTC |

rahulreddykarne/CVE-2026-8712-Wyoming CVE-2026-8712: Unauthenticated SSRF / Backend URI Override in Wyoming HTTP API via uri Query Parameter Create: 2026-09-27 06:55:11 +0000 UTC Push: 2026-09-27 06:55:12 +0000 UTC |

murrez/CVE-2026-100740 CVE-2026-100740 PoC: D-Link DIR-895L A1_102b07 L2TP Host Name AVP out-of-bounds write in tunnel_set_params (UDP 1701). Device fingerprint + optional OOB trigger packet for authorized lab testing. https://pocbit.org/pocs/cve-2026-100740 Create: 2026-09-27 05:40:35 +0000 UTC Push: 2026-09-27 05:40:36 +0000 UTC |

rmhowe425/POC-CVE-2025-11201 Create: 2026-09-27 01:50:15 +0000 UTC Push: 2026-09-27 01:50:16 +0000 UTC |

osflaky/exp-logpresso-CVE-2021-44228-Scanner snapshot of logpresso/CVE-2021-44228-Scanner at a pinned commit, for cross platform ci legs Create: 2026-09-27 01:24:13 +0000 UTC Push: 2026-09-27 01:24:14 +0000 UTC |