EQSTLab/CVE-2026-49869 Create: 2026-09-29 05:24:33 +0000 UTC Push: 2026-09-29 05:24:35 +0000 UTC |

HORKimhab/CVE-2026-10817 CVE-2026-10817 Create: 2026-09-29 04:19:33 +0000 UTC Push: 2026-09-29 04:19:38 +0000 UTC |

vpxuser/CVE-2026-59310 Create: 2026-09-29 01:54:33 +0000 UTC Push: 2026-09-29 01:55:28 +0000 UTC |

dpfkdlemtp/CVE-2021-43718 Published Epson EH-TW5350 CVE · Web Control authentication bypass · B-BEAM-BOB team Create: 2026-09-29 00:53:13 +0000 UTC Push: 2026-09-29 00:53:14 +0000 UTC |

dpfkdlemtp/CVE-2021-43717 Published Epson EH-TW5350 CVE · Hard-coded credentials · B-BEAM-BOB team Create: 2026-09-29 00:53:01 +0000 UTC Push: 2026-09-29 00:53:02 +0000 UTC |

dpfkdlemtp/CVE-2021-43716 Published Epson EH-TW5350 CVE · Firmware update verification bypass · B-BEAM-BOB team Create: 2026-09-29 00:52:47 +0000 UTC Push: 2026-09-29 00:52:48 +0000 UTC |

dpfkdlemtp/CVE-2026-100633 Published SiYuan CVE · Reporter: dpfkdlemtp · Official record and advisory links Create: 2026-09-29 00:51:55 +0000 UTC Push: 2026-09-29 00:51:56 +0000 UTC |

murrez/CVE-2026-101894 CVE-2026-101894 PoC: @xhmikosr/decompress symlink-chain archive path traversal (bypass CVE-2026-53486). Node lab + lockfile scan + mass evil.tar upload exploit. CVSS 9.1. https://pocbit.org/pocs/cve-2026-101894 Create: 2026-09-29 00:49:49 +0000 UTC Push: 2026-09-29 00:50:29 +0000 UTC |

murrez/CVE-2026-101110 CVE-2026-101110 PoC: OrdaSoft Joomla Book Library (Free) <=6.4.6 unauth SQLi — field/direction ORDER BY, session prime + `-- xselect` blacklist bypass (com_booklibrary). Colored check + mass exploit, CVSS 9.3. https://pocbit.org/pocs/cve-2026-101110 Create: 2026-09-29 00:34:11 +0000 UTC Push: 2026-09-29 00:34:13 +0000 UTC |

murrez/CVE-2026-101108 CVE-2026-101108 PoC: OrdaSoft Joomla Vehicle Manager (Free) <=6.5.7 unauth SQLi — order_field/order_direction unquoted ORDER BY (com_vehiclemanager). Colored check + mass exploit, CVSS 9.3. https://pocbit.org/pocs/cve-2026-101108 Create: 2026-09-29 00:23:07 +0000 UTC Push: 2026-09-29 00:23:28 +0000 UTC |

murrez/CVE-2026-100752 CVE-2026-100752 PoC: OrdaSoft Joomla Real Estate Manager (Free) <=6.7.8 unauth SQLi via order_field ORDER BY (com_realestatemanager). Colored check + mass exploit, version fingerprint, PoCbit https://pocbit.org/pocs/cve-2026-100752 Create: 2026-09-29 00:08:47 +0000 UTC Push: 2026-09-29 00:09:13 +0000 UTC |

Wayang1337/CVE-2026-18143 Request a Quote for WooCommerce (Addify) <= 2.9.2 Unauthenticated arbitrary file upload via afrfq_submit_quote_via_popup Create: 2026-09-28 22:27:44 +0000 UTC Push: 2026-09-28 22:28:42 +0000 UTC |

lorenzog/CVE-2020-13664 PoC for CVE-2020-13664 Create: 2026-09-28 22:25:50 +0000 UTC Push: 2026-09-28 22:25:52 +0000 UTC |

DeAurity/CVE-2026-86950-POC Out-of-bounds Write (CWE-787) Create: 2026-09-28 21:25:00 +0000 UTC Push: 2026-09-28 21:25:02 +0000 UTC |

MRdark-ops/CVE-2026-87902 CVE-2026-87902 — WordPress Core LFI → RCE Create: 2026-09-28 21:18:39 +0000 UTC Push: 2026-09-28 21:18:40 +0000 UTC |

MRdark-ops/CVE-2026-38526 CVE-2026-38526 - Authenticated RCE exploit for Krayin CRM <= 2.2.x. Upload arbitrary PHP via /admin/tinymce/upload and gain remote code execution. Python PoC for security researchers, CTF players and bug bounty hunters. Tested on HTB Nexus. Create: 2026-09-28 20:49:54 +0000 UTC Push: 2026-09-28 20:49:55 +0000 UTC |

do4choo/CVE-2026-5053 CVE-2026-5053 Create: 2026-09-28 19:38:13 +0000 UTC Push: 2026-09-28 19:38:23 +0000 UTC |

do4choo/CVE-2026-5054 CVE-2026-5054 Create: 2026-09-28 19:25:42 +0000 UTC Push: 2026-09-28 19:25:52 +0000 UTC |

ungabunga-ctf/CVE-2026-34990 CVE-2026-34990 - OpenPrinting CUPS versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. Create: 2026-09-28 19:12:35 +0000 UTC Push: 2026-09-28 19:12:37 +0000 UTC |

ZeroDayEvil/CVE-2026-41651 Create: 2026-09-28 19:03:34 +0000 UTC Push: 2026-09-28 19:03:36 +0000 UTC |