pervinzahidli/CVE-2026-104110 Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php Create: 2026-10-01 18:55:16 +0000 UTC Push: 2026-10-01 18:55:17 +0000 UTC |

pervinzahidli/CVE-2026-103977 Session-scoped TOTP rate limiting permits repeated verification attempts Create: 2026-10-01 18:48:25 +0000 UTC Push: 2026-10-01 18:48:26 +0000 UTC |

yel1337/CVE-2025-47947 POC for libapache2-mod-security2 Create: 2026-10-01 18:20:00 +0000 UTC Push: 2026-10-01 18:20:02 +0000 UTC |

Hassham1/CVE-2026-62059-ultimate-member-sqli-poc Create: 2026-10-01 16:09:44 +0000 UTC Push: 2026-10-01 16:10:05 +0000 UTC |

CheLover86/CVE-2017-9841 I like CVEs! Create: 2026-10-01 15:47:31 +0000 UTC Push: 2026-10-01 15:47:34 +0000 UTC |

securifera/CVE-2026-90817 REDCap DataImport RCE Create: 2026-10-01 15:34:52 +0000 UTC Push: 2026-10-01 15:34:53 +0000 UTC |

canhieu/cve-2026-100671-poc Create: 2026-10-01 15:25:50 +0000 UTC Push: 2026-10-01 15:25:51 +0000 UTC |

aorozco-sys/CVE-2026-90907 CVE-2026-90907 (CVSS 6.9) — Joomla! CMS unauthorized user account creation via com_users profile.save (authorization bypass). Non-destructive checker + authorized-use exploit PoC. Fixed in 5.4.9 / 6.1.4. Create: 2026-10-01 15:14:28 +0000 UTC Push: 2026-10-01 15:14:34 +0000 UTC |

eitanch228/cve-2025-48385-revshell-poc Weaponized PoC for CVE-2025-48385 (git bundle-uri parameter injection): clone-time arbitrary file write to reverse shell. Authorized research only. Create: 2026-10-01 14:42:08 +0000 UTC Push: 2026-10-01 14:42:12 +0000 UTC |

BishopFox/CVE-2026-93616-check Safely detect Check Point CPM RCE CVE-2026-93616 Create: 2026-10-01 14:32:31 +0000 UTC Push: 2026-10-01 14:32:35 +0000 UTC |

MutagomaRaissa/container-security-lab-cve-2024-21626 University laboratory demonstrating a reproducible container security scenario, including environment setup, technical analysis, demonstration, verification, and mitigation strategies. Create: 2026-10-01 14:17:40 +0000 UTC Push: 2026-10-01 14:17:41 +0000 UTC |

petriQore/CVE-2026-26026_PoC PoC script for CVE-2026-26026 GLPI versions 11.0.0 through 11.0.5 Create: 2026-10-01 13:38:39 +0000 UTC Push: 2026-10-01 13:39:05 +0000 UTC |

tonydelouvre/CVE-2026-102425 BAForms-RCE — GUI standalone scanner/exploit for CVE-2026-102425 (Balbooa Forms com_baforms < 2.4.3.4 unauth RCE). Dark neon Tkinter GUI. Authorized testing only. Create: 2026-10-01 12:40:15 +0000 UTC Push: 2026-10-01 12:40:44 +0000 UTC |

oscerd/CVE-2026-88789 Reproducer for CVE-2026-88789 (Apache Camel Quarkus camel-quarkus-support-xalan drops the JAXP external access restrictions, XXE / SSRF) — Camel Quarkus Create: 2026-10-01 10:22:10 +0000 UTC Push: 2026-10-01 10:22:14 +0000 UTC |

Makis6/CVE-2025-8110 Create: 2026-10-01 10:01:48 +0000 UTC Push: 2026-10-01 10:01:49 +0000 UTC |

murrez/CVE-2026-92966 CVE-2026-92966 — WordPress LatePoint ≤5.7.0 unauthenticated stored shortcode execution (CVSS 9.1, CWE-94). PoCbit mass-exploit PoC: plant [caption]/custom shortcode in booking first name → Customer Cabinet block double do_shortcode; fixed in 5.7.1. No API key. check/exploit/mass, hits.txt & exploited.txt, https://pocbit.org/pocs/cve-2026-92966 Create: 2026-10-01 07:38:03 +0000 UTC Push: 2026-10-01 07:38:05 +0000 UTC |

Ez4rd1x1/CVE-2026-58138-Research critical-severity unauthenticated Remote Code Execution (RCE) vulnerability impacting Orkes Conductor Create: 2026-10-01 06:32:16 +0000 UTC Push: 2026-10-01 06:32:17 +0000 UTC |

Waynehck8/CVE-2025-8110-POC Create: 2026-10-01 05:56:11 +0000 UTC Push: 2026-10-01 05:56:12 +0000 UTC |

murrez/CVE-2026-96349 CVE-2026-96349 — WordPress SiteSkite plugin ≤2.1.8 unauthenticated RCE (CVSS 10.0, CWE-94). PoCbit mass-exploit PoC: legacy API-key autologin (?token=) + REST MCP siteskite_execute_php eval chain; fixed in 2.2.0. Check/exploit/mass bulk, hits.txt & exploited.txt, --lab self-test. Catalog: https://pocbit.org/pocs/cve-2026-96349 Create: 2026-10-01 04:23:00 +0000 UTC Push: 2026-10-01 04:23:38 +0000 UTC |

gotr00t0day/CVE-2024-55591 CVE-2024-55591 — FortiOS / FortiProxy Authentication Bypass Create: 2026-10-01 04:06:51 +0000 UTC Push: 2026-10-01 04:07:24 +0000 UTC |