winrarzipsexploit/CVE-2026-87930 CVE-2026-87930 Joomla Multi-CVE RCE suite — authorized testing only Create: 2026-09-17 18:44:27 +0000 UTC Push: 2026-09-17 18:44:31 +0000 UTC |

winrarzipsexploit/CVE-2026-27540 CVE-2026-27540 WWLC WordPress unauth upload RCE suite — authorized testing only Create: 2026-09-17 18:44:20 +0000 UTC Push: 2026-09-17 18:44:25 +0000 UTC |

tc4dy/CVE-2026-85706-PoC-Toolkit 🪬 CVE-2026-85706 – GitLab Unauth File Read Toolkit (CVSS 10.0) | Red/Blue Team suite for self-managed GitLab CE/EE 18.7–19.3.1. 2 tools: Full Exploit (unauth file read, admin token, mass scan, loot, shell, stealth, SQLite/HTML/JSON output) etc., SafeChecker (version detect, audit, security headers, TLS check, MITRE). Only Use Ethically, Educ. <3 Create: 2026-09-17 18:06:48 +0000 UTC Push: 2026-09-17 18:07:45 +0000 UTC |

HEMLOCK-LYK/CVE-2026-88533 PoC and lab reproduction for CVE-2026-88533 Create: 2026-09-17 17:54:18 +0000 UTC Push: 2026-09-17 17:54:34 +0000 UTC |

winrarzipsexploit/CVE-2026-48908 CVE-2026-48908 SP Page Builder (Joomla) unauth RCE suite — authorized testing only Create: 2026-09-17 17:48:56 +0000 UTC Push: 2026-09-17 17:49:00 +0000 UTC |

cflowsec/CVE-2026-92805 UVdesk unauth wizard super-admin POC Create: 2026-09-17 16:57:27 +0000 UTC Push: 2026-09-17 16:57:28 +0000 UTC |

SangSenimanWartefak/CVE-2026-80467 Create: 2026-09-17 16:22:14 +0000 UTC Push: 2026-09-17 16:22:16 +0000 UTC |

wvverez/CVE-2026-23744 exploit de RCE (ejecución remota de código) que abusa del endpoint /api/mcp/connect de aplicaciones MCP vulnerables. En concreto, corresponde a CVE-2026-23744 (MCPJam Inspector) y CVE-2026-57124 Create: 2026-09-17 15:57:13 +0000 UTC Push: 2026-09-17 15:57:49 +0000 UTC |

SneakyNachos/CVE-2026-85048-the-gpu-died Create: 2026-09-17 15:38:44 +0000 UTC Push: 2026-09-17 15:38:45 +0000 UTC |

SneakyNachos/CVE-2026-85045 Create: 2026-09-17 15:36:23 +0000 UTC Push: 2026-09-17 15:36:57 +0000 UTC |

overgrowncarrot1/CVE-2026-49179-Active-Directory-WriteSPNScript-Command-Injection CVE-2026-49179: Active Directory WriteSPNScript Command Injection Create: 2026-09-17 14:02:46 +0000 UTC Push: 2026-09-17 14:03:04 +0000 UTC |

S3v3n-JG/CVE-2026-85706 CVE-2026-85706 Create: 2026-09-17 13:45:39 +0000 UTC Push: 2026-09-17 13:45:40 +0000 UTC |

S3v3n-JG/CVE-2026-76461 CVE-2026-76461 Create: 2026-09-17 12:47:17 +0000 UTC Push: 2026-09-17 12:47:18 +0000 UTC |

S3v3n-JG/CVE-2026-76460 CVE-2026-76460 Create: 2026-09-17 12:00:16 +0000 UTC Push: 2026-09-17 12:00:17 +0000 UTC |

HORKimhab/CVE-2026-19975 CVE-2026-19975 - Draft or TODO Create: 2026-09-17 06:57:37 +0000 UTC Push: 2026-09-17 06:57:42 +0000 UTC |

imbas007/CVE-2026-67401 PoC for CVE-2026-67401 — cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE. Includes a self-contained vulnerable lab, SQLi detection, and full exploit chain. Create: 2026-09-17 06:53:22 +0000 UTC Push: 2026-09-17 06:53:34 +0000 UTC |

shivammittal2403/cve-2026-59827-metabase-cyber-range Educational cyber range for CVE-2026-59827 (Metabase H2 unsafe deserialization / CWE-502). Isolated Docker lab — training only, not for attacking production Metabase. Create: 2026-09-17 06:16:21 +0000 UTC Push: 2026-09-17 06:16:22 +0000 UTC |

shivammittal2403/cve-2025-57819-freepbx-range Isolated educational FreePBX-compatible cyber range for CVE-2025-57819 (CWE-89/CWE-288). Docker lab — not official Sangoma FreePBX. Create: 2026-09-17 05:35:14 +0000 UTC Push: 2026-09-17 05:35:16 +0000 UTC |

abraxas/CVE-2026-12793 CVE-2026-12793 — Abraxas Labs advisory (private until validated) Create: 2026-09-17 02:44:56 +0000 UTC Push: 2026-09-17 03:11:28 +0000 UTC |

g17hubH4ck/CVE-2026-55781-poc Unbounded memory allocation in NanaZip's UFS handler via an attacker-controlled `fs_bsize` field. Create: 2026-09-17 00:54:20 +0000 UTC Push: 2026-09-17 00:54:21 +0000 UTC |