#漏洞利用
200
2026-10-23
assetnote/php2shell-scanner
A
High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
2026-10-22
HOSTED-POWER/php_uploadprogress_guard
S
Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP 5.6-8.5; Sury, cPanel EA4, DirectAdmin, Docker, Windows.
2026-08-29
mhtsec/nacos-authscope-poc
S
Nacos 3.x (3.0.0~3.2.3) auth scope misassignment: unauthenticated admin account creation & full takeover PoC, fixed in 3.2.4
2026-10-22
9bie/php2shell-bypass-aslr-exp
A
A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.
2026-09-04
ByteV0rtex/CVE-2026-65343
A
CVE-2026-65343 PoC — AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71)
2026-08-31
KorekKayu/IKONA-Security
A
🛡️ Comprehensive Cybersecurity Arsenal, Bug Bounty Payloads & Security Audit Tools by IKONA ONI
2026-09-25
angusdevgo/Seep-Reverse-Lab
B
Agent-Native multi-platform reverse engineering and CWE-602 client-side authorization audit workbench.
2026-09-16
ustayready/Thunderstorm
A
A collector and derivation engine. It maps your environment, evaluates effective permissions and trust, and writes a complete attack graph as a single .rage.ndjson file. The input to everything else.
2026-10-22
mikensec/php2shell-lab
A
Offline, reproducible lab to safely analyse an untrusted PoC for CVE-2026-109618/109619 and build detection rules. No exploit included; bring your own sample.
2026-11-03
dis0rder0x00/TrustedHive
A
LPE Proof-of-Concept for Windows 11 abusing TrustedInstaller's Component Based Servicing (CBS) session COM object and junctions for arbitrary file write.
2026-11-02
Gezine/CivSwitch
A
Nintendo Switch userland code execution using Civilization 7 game cartridge
2026-10-19
Fazmin/cve-intel
A
Local security intelligence for CVE triage - 31 data sources and 32 tools, risk scores and an MCP server for AI agents, all in native Rust. Private by default.
2026-10-29
Ping-2o/duper-cves
A
cves localised in the 24A435->24B115 binaries (iPhone17,5), currently 36
2026-09-07
dinosn/mikrotrick-poc
A
CVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC
2026-10-21
ikow/php2shell-poc
B
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
2026-09-08
ynsmroztas/KeySniper
B
**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.
2026-11-05
sudonoodle/BOF-coerce-ipp
B
Beacon Object File (BOF) to coerce machine account auth via IPP.
2026-10-23
miilv/ya-station-root-shell
B
Full chain reproduction: eMudhra CA → MITM of Yandex Station Mini 2 config sync → root adbd → root shell. PoC scripts + disclosure report.
2026-10-15
jburgess-r7/CVE-2026-97229-PoC
B
GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image
2026-10-24
dimasma0305/CVE-2026-111497-POC
B
Reproducible local Brotli decoder proof for CVE-2026-111497 with a self-checking tuned RCE harness
2026-09-28
xwtk/hmg_nemesis
B
Gain control of your Hyundai Motor Group vehicle, NEMESIS provides a way to execute software as root. Compatible with Gen5W AVNT systems with OTA update support.
2026-10-29
MchinaMd57764/CVE-2026-112706-CoreMedia-fd-leak
B
Independent discovery & coordinated disclosure: CoreMedia bytestream XPC (mediaplaybackd) vended live file descriptors for protected paths to any sandboxed app on iOS 26.5–27.0.1. Fixed in iOS 27.2 as CVE-2026-112706. PoC + evidence.
2026-10-03
kyle41111/AI-FILE
B
A listener profile for the Mythic C2 framework that utilizes AI vendors file API's
2026-09-15
0xjohnnydev/airlift
C
AirLift — paired-Mac AirTraffic/ATAirlock sandbox escape for iOS 27.0
2026-10-26
assetnote/node2shell-scanner
B
High fidelity detection mechanism for node2shell (CVE-2026-111497)
2026-10-22
JoasASantos/php2shell-scanner
B
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.
2026-10-22
dinosn/php-cve-2026-10961x-lab-poc
B
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
2026-10-17
feiguang-ai/plz110-6.12.69-cve-2026-64560-ksu
B
一加 15T（PLZ110）临时 root + KernelSU per-boot 接管：CVE-2026-64560 移植，不写分区、重启即失效。内核 6.12.69-android16-6-g242e1a07f878。
2026-10-12
7h30th3r0n3/Flipper-EvilRelay
B
ISO-DEP (ISO 14443-4) NFC relay for the Flipper Zero. Read a real contactless card on a phone/Evil-Cardputer, relay APDUs over Wi-Fi to an ESP32-C3 bridge, and emulate the card to the reader with the Flipper. Ported from Evil-M5Project.
2026-09-19
crypt0p3g/adnullenum
B
One-pass anonymous Active Directory enumeration over SAMR and LSARPC — null session, no credentials, with structured reusable output.
2026-09-08
Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
C
Stuxnet! Here reproduced by me. Only researchs educations purposes.
2026-08-27
picodoki/linux-privesc-lab
B
Linux 权限提升漏洞靶场（linux-privesc-lab) : 17 个独立 Docker 漏洞环境（sudo、SUID、capabilities、cron、/etc/passwd、/etc/shadow、LD_PRELOAD、BASH_FUNC、MySQL UDF）每个环境包含一键利用脚本、手动分步教学与原理详解，开箱即用，镜像加速，类似vulhub靶场
2026-10-07
oscardagrach/qualcomm_pbl_siglen_bug
B
Notes on RSA signature length handling in the Qualcomm PBL secure boot verifier.
2026-11-09
34306/doublera1n
B
create a secondary jailbroken iOS on iPhone 11 series devices using usbliter8.
2026-10-22
0xrsydn/php2shell-scan
B
Reachability + change detector for the php2shell PHP RCEs (CVE-2026-109618 / CVE-2026-109619). Agent-ready, stdlib only, read-only by default.
2026-10-20
0xPrimo/DemonLdr
B
A PoC of User-Defined Reflective Loader for Havoc Framework built with Cystal Palace
2026-10-10
kutukam/autonomous-pentest-agent
B
Autonomous Pentest Agent — LLM multi-agent autonomous penetration testing system (Go backend + Next.js UI). AGPL-3.0.
2026-09-23
Malwation/CVE-2026-43786
B
Proof of concept for CVE-2026-43786, a local privilege escalation vulnerability in macOS CoreServices that allows an application to gain root privileges.
2026-09-16
QiantangCredit/heimdall-pentest
B
An autonomous AI agent framework for authorized penetration testing
2026-11-09
Rust505/CVE-2026-112611
B
CVE-2026-112611: OOB Write in CoreGraphics (PDF ShadingType 5) via /N and /C0 array mismatch. Causes heap overflow (DoS). The Python PoC generates the malicious PDF, while the C-code uses a SIGSEGV handler to map the faulting memory and confirm the write primitive.
2026-10-29
Ping-2o/CVE-2026-112611-cg-shading
B
CVE-2026-112611/112610: CoreGraphics PDF out-of-bounds writes (fixed in iOS 27.2) — fix-diff analysis, on-device proof, methodology, and PoC generator scripts. No prebuilt PoCs, no crash reports.
2026-10-24
whokilleddb/TTs
B
Gain shellcode execution via T4 Text Transform files/TextTransoform.exe
2026-10-23
cookiengineer/actual-php2shell
B
:robot: NO, There is an easy way to exploit this vulnerability! (vibecoded to prove a point)
2026-09-28
pho5nix/Red-Team-GOAD-Lab-Proxmox
B
Build guide for Red Teaming home lab. GOAD lab setup in Proxmox and pfSense, Operator/C2 and Redirectors.
2026-09-17
DevCop95/dev101x-pentest-lab
B
Self-contained Docker Pro Lab for pentest practice: boolean blind SQLi + hashcat cracking, web path traversal, command injection, internal network pivoting and SUID PATH-hijack privesc — with live flag validation and completion certificate. No VPN needed.
2026-11-05
Luminger/balatro-switch-rce
B
Userland code execution on Nintendo Switch 1 and 2 via Balatro save data: a Lua REPL and FTP server in place of the game
2026-10-22
0x4148/CVE-2026-109618-php2shell-lab
B
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Docker lab and PoC. Use-After-Free in PHP's session.upload_progress.
2026-10-21
eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
C
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
2026-10-15
newbe3e/Pwn2Own-Automotive-2026-Alpine-iLX-F511-0-Click-RCE-Exploit-Writeup
B
This is a write up of the exploit I developed for the Pwn2Own Automotive 2026 competition.
2026-08-28
zack0x01/XSS.pdf-Credential-Harvesting-PDF
B
A proof-of-concept PDF file designed for authorized security testing of PDF upload functionality and PDF viewer behavior, including XSS and credential-harvesting scenarios.
2026-08-27
dinosn/log4j-4255
B
End-to-end Docker lab reproducing Apache log4j2 #4255 — FilteredObjectInputStream allowlist bypass via java.rmi.MarshalledObject (unfiltered deserialization → RCE) on Log4j 2.26.1 / JDK 17.
2026-11-03
zecoxao/BD-JB-Relapse
B
BD-JB Relapse for 13.42 and below by zecoxao, EchoStretch and Claude
2026-10-17
ZigZagBoi1/PS5-14.10-Research
C
PS5 firmware 14.10 kernel attack surface research - 62 Lua probes mapping syscalls, memory, networking, and exploit paths from userland
2026-10-17
kamalx06/TornadoC2
B
Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go binary agent with every property baked in at build time. Multi-operator team server with RBAC, audit chain, and a Qt/CLI console. Linux + Windows, amd64 + arm64.
2026-09-10
Supersonic/TLPE
C
CVE-2026-49881, a logic issue in the InCallController class in Android 17's Telecom service that allows an unprivileged app to gain arbitrary code execution as UID 1000 system_server
2026-09-03
Maas6696/cloudflare-challenge-clearance
C
Bypass the Cloudflare challenge (Just a moment / 5s) in Python and get a valid cf_clearance cookie via the Peak API - headless-friendly, proxy-aware.
2026-08-27
ioallocate/imMapper
B
Demonstration of Abusing the Vulnerable driver AmdTools64.sys for Physical R/W.
2026-10-20
TwoSevenOneT/PhantomBuffer
B
EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)
2026-09-28
PanosoikoGr/adaptix-kerbrute
B
In-process Kerberos user enumeration and password attacks for AdaptixC2 — no process spawn, no file drop.
2026-09-25
petermalone/CVE-2026-84543
B
Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability
2026-09-16
shaheeryasirofficial/SmuggleMyPayload
B
SmuggleMyPayload generates HTML pages that embed and reconstruct files client-side using JavaScript. The toolkit offers multiple HTML Smuggling techniques, payload encoding options, JavaScript variations, and pre-built HTML templates.
2026-10-22
wakemeiflose/php2shell
B
CVE-2026-109618 / CVE-2026-109619 — PHP session.upload_progress RCE PoC & Vulnerable Lab
2026-10-15
abraxas/pfsense-qinq-parent-if
B
pfSense CE 2.9.0-DEVELOPMENT - High - Remote - RCE - QinQ parent-if ifconfig
2026-09-25
dinosn/cve-2026-87902-wordpress-lfi-lab
B
Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4.7.0-7.1.1, fixed 7.1.2). Authorized/defensive testing.
2026-09-13
SyntaxMethod/CVE-2026-42978-PoC-Research
C
CVE-2026-42978 Windows Push Notifications (WpnService) Use-After-Free & Race Condition PoC research, diagnostic scanner, and security audit module for AI Security Tool.
2026-09-02
CircuitSavage/cloudflare-turnstile-reversed
C
Cloudflare Turnstile challenge internals: the live request flow, the challenge bundle, and a capture toolkit.
2026-09-27
DeathShotXD/Comment2Shell
C
Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker
2026-09-25
ynsmroztas/NextForge
C
NextForge — unified Next.js exploitation framework. RCE · SSRF · middleware · authorized lab only.
2026-09-24
ressl/cve-2026-87902-poc
C
PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab
2026-09-16
racoten/ReflectivePluginLoader
C
A minimal PE mapper that loads DLLs straight from memory and calls into a clean plugin interface, no LoadLibrary needed.
2026-09-03
kowalski76057/cf-turnstile-token
C
Scriptable Cloudflare Turnstile token CLI via the Peak API - sitekey discovery, solve, and token output for CI and automation.
2026-10-29
speedyfriend433/sandbox_extension-TOCTOU-bug
C
Read restricted system files with sandbox_extension TOCTOU bug
2026-09-30
lupingQAQ/dotnet-memshell
C
Three .NET memory shells at three distinct insertion positions - HttpModule pipeline, WebSocket connection takeover, Remoting URI registration. Zero impact on unmarked traffic, no new port, no web.config change, no file drop. 三个插入位互不相同、业务无感的 .NET 内存马。
2026-09-16
Yean-Sec/StrikeAgent_Coder-Flash
C
由夜安团队研发的代码审计平台，涵盖十多种常用语言，提供从上传源代码、审计、靶机验证到生成报告的一站式流程，并最终形成真正可用的 POC。平台致力于发现最真实的漏洞（包括评级与漏洞本身），同时将成本控制在最低水平。在如何平衡成本与发现高危、严重真实漏洞之间，我们将持续探索研究。
2026-09-10
karollooool/CVE-2026-83991-writeup-and-poc
C
CVE-2026-83991: Windows Cloud Files access-check bypass
2026-10-23
3em0/php2shell
C
Remote HTTP-only RCE on PHP 8.4.26 + Apache prefork/mod_php (ASLR bypass via session.upload_progress UAF) — self-contained Docker lab, one-click exploit.py
2026-10-23
JoasASantos/php2shell-exploit
C
PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE
2026-10-23
devploit/php2shell
C
PHP2Shell: version-aware research toolkit for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP session.upload_progress (mod_php). Build profiles, labs, heap calibration and detection guidance for authorized security testing.
2026-10-23
vperetti/php-cve-2026-109618-109619-backports
C
Minimal source backports of the PHP core RCE fixes (CVE-2026-109618 / CVE-2026-109619) for EOL PHP 5.4 and 7.3
2026-10-12
kyle41111/BinarySoap
C
A python proof of concept tool to assist in your payloads classification against EDR/AV's machine learning models
2026-10-04
whoismob/onionhen-13x-research
C
PS5 13.60 OnionHEN: 13.x allproc offset patch (kstuff v1.11), RNPS decrypt dump hook with notifications, 7 full 1.8MB HomeUI bundle dumps, profile entry added (hash f73c3e..., ver 89). Offsets best-effort from 12.20 profile; full HBC offset derivation open.
2026-09-10
weidutech/PentestPi
C
Autonomous Penetration Testing Agent Framework with External State Memory & Anti-False-Falsification Guardrails.
2026-08-31
MSNightmare/PrettyPrague
C
GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability
2026-08-27
hypnguyen1209/log4j2-rce
C
Pre-auth RCE via FilteredObjectInputStream MarshalledObject bypass in Apache Log4j 2
2026-10-22
Is4yev/php2shell-poc
C
CVE-2026-109618/109619 PHP2Shell — Heap UAF PoC (crash + RCE framework)
2026-09-24
tihanyin/REx-skill
C
REx@Skill - Agentic Reverse Engineering eXecution Skill for binary vulnerability discovery
2026-09-20
0xdeadbeefnetwork/four-horsemen-pocs
C
what happens when multiple products fork a driver and strip it's security?
2026-09-13
SyntaxMethod/CVE-2026-41089-Netlogon-RCE-PoC
C
CVE-2026-41089 Netlogon RCE PoC — security research, vulnerability validation & defensive testing.
2026-10-29
G4sp4rCS/CVE-2026-97798-exploit
C
CVE-2026-97798 Windows Error Reporting - Command Injection TO SYSTEM
2026-10-29
speedyfriend433/CVE-2026-84636-PoC
C
Proof of concept of CVE-2026-84636, WiFi SSID Info Disclosure
2026-10-28
S12cybersecurity/CredGuardRuntimeShutdown
C
Runtime Credential Guard deactivation via \\LSA_ISO_DISABLE_CREDENTIAL_GUARD + LSASS NT hash extraction (Win11 24H2)
2026-10-23
kuwoo/php2shell-Lab
C
🐘 php2shell（CVE-2026-109618 / CVE-2026-109619）复现靶场 — session.upload_progress 文件名注入 + LFI → RCE，Docker 一键启动，附中文原理分析与 PoC
2026-09-19
0xBugatti/wolf
C
Curated wordlist and payload collection for penetration testing, bug bounty, and red-team work — 2,500+ lists across credentials, content discovery, DNS, injection payloads, HTTP fuzzing, dorks, and AI/LLM testing.
2026-09-13
guneykabel/cve-2026-85706
C
Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7–19.1.7; 19.2.0–19.2.5; 19.3.0–19.3.1
2026-10-22
syrex1013/php2shell
D
CVE-2026-109618/109619 PoC — PHP session.upload_progress heap use-after-free (CVSS 9.2)
2026-09-28
TwoSevenOneT/InjectSetConsole
D
Proof of Concept for Process Code Injection Without Using WriteProcessMemory
2026-09-14
thebelx/GRANDE-PS4-13.02
C
Writeup regarding ps4 13.02 jailbreaking/userland exploitation by thebelx/belsploit
2026-08-26
prot0tw/Keycloak_CVE-2026-18963_PoC
C
This repo is poc of cve-2026-18963. Please use it on legal products (lab, local,...).
2026-08-25
jailbreakdotparty/Erosion
D
A collection of customization tweaks that use the bad_query sandbox escape. Supports iOS 26.0 - iOS 26.6.1 & iOS 27.0db1-db4.
2026-10-23
godylockz/cve-2026-109618-php2shell
C
Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell
2026-10-22
KarimUD7/RCE-POCKET-POC-for-PHP2SHELL
C
Pocket proof-of-concept and lab materials for PHP2SHELL remote code execution research.
2026-10-16
gzimbric/ps5-hv-bypass-porting
C
Evidence-driven tools and documentation for porting the PS5 S3-resume hypervisor bypass across firmware versions
2026-09-29
murrez/CVE-2026-88772
C
CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints Gateway, build vs 14.1-73.37 / 13.1-64.23, UDP/443 DTLS probe. CTX697096; active exploitation reported. https://pocbit.org/pocs/cve-2026-88772
2026-09-09
Solvr-io/solvr-go
C
The official Go client for the Solvr API: typed, dependency-free access to the Kasada and DataDome endpoints, with sync examples, retries, and a small concurrency-safe core.
2026-08-27
HackingLZ/sleepwalker
C
Passive backdoor implant that sniffs for a covert magic-packet trigger and runs tasks written in a custom 23-opcode bytecode command language.
2026-09-13
sam-plab03c2/nucleus-patch-utility-2026
C
A Python-based utility for managing and testing Roblox client patches. Developed for QA engineers and developers to streamline patch validation workflows. It includes a feature for automated script execution and error logging.
2026-10-31
N1nEmAn/sapper-v2
C
Autonomous pentest legion — AI commander + worker swarm + layered fact-intent graph. 3rd Tencent Intelligent Attack-Defense online champion (634 teams · 8h unattended · 1B tokens beat 4.5B). The Nüwa Test: give AIs Create/Language/History, let a civilization grow.
2026-10-21
Zer061/CVE-2026-109618
C
PoC CVE-2026-109618 / -109619 (PHP session.upload_progress heap UAF)
2026-10-16
YuuLuo/a7c2-service-preload
D
Research on A7C II service authentication, Jiritsu path resolution, and preload-based code execution.
2026-09-11
VoidSecSoftwares/voidsyscall
C
Cross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.
2026-09-03
ChoppDev/AlterEgo-CS2
D
High-performance C++20 research framework for Source 2. Features sub-tick angle decoupling, multiplex hitscan tracing, dynamic lag record reconstruction, and Direct3D overlay rendering.
2026-11-09
murk-sus/kamui-escape
C
KAMUI (神威) — iOS 27.x sandbox escape + MobileGestalt editor. MIT licensed, free for everyone.
2026-10-01
GronedWaffel/etahen-13.60
C
Unofficial etaHEN 2.5B source port for PS5 13.60. Original etaHEN by LightningMods and contributors.
2026-09-29
predyy/CVE-2026-28695
C
CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS.
2026-09-24
abraxas/CVE-2026-87902
C
CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion (conditional RCE)
2026-10-22
xuehuolll/php2shell-CVE-2026-109618-109619
C
CVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch analysis.
2026-10-19
pastawithpesto/PS5-14.10-Jailbreak-Research
C
WebKit jailbreak research for PlayStation 5 firmware 14.10
2026-10-13
S12cybersecurity/LogonStealer
C
Abuses the Credential Provider interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks
2026-10-27
DialingSpoon527/seedsow-lua-editor
C
lua code export save to be run on seedsow switch demo exploit
2026-10-27
NiftyNova/GPUBrewLauncher
C
Switch 2 program that can run custom apps using RAM and GPU Shaders through the SmileBASIC4 exploit.
2026-10-25
aarsaputra/php2shell
C
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
2026-08-29
LoopNecromancer41/encrypted-payload-loader
C
Polymorphic loader and memory execution wrapper for secure delivery of compiled binaries.
2026-10-29
kuzibelit/PS5-14.00-14.10-Jailbreak-PoC
D
Proof of Concept related to Research and documentation about PS5 firmware 14.00 and 14.10, compiling publicly available technical research, code, and references for educational and archival purposes.
2026-09-15
ncxcy/iOS-26.5-mobileactivationd-vulns
D
iOS 26.5 list of vulnerabilities on mobileactivationd
2026-09-13
Hunterplastable/solara-executor-free
D
Solara Executor for Roblox — keyless, fast execution, script hub, UNC support | free | no key | 2026
2026-09-13
SvenGDK/unjail-ps5app-payload
D
A persistent PS5 daemon payload for promoting the caller's process (credentials, capabilities, and filesystem view).
2026-08-29
MSNightmare/HardBreacher
D
Kaspersky Antivirus For Endpoint ZeroDay Elevation of Privileges Vulnerability
2026-09-20
fawadqureshi007/K7R3
D
A practical bug bounty field guide covering recon, vulnerability research, attack scenarios, exploitation, validation, and reporting.
2026-09-08
Chrissucks/CS2-Steam-Logon-Disconnect-Exploit
D
Server.dll exploit allowing user control of server disconnect value, leading to arbitrary disconnect reasons from the client, can be used to force cancel matches by causing a fake vac ban.
2026-08-27
portbuster1337/Atlas
D
Cross-platform network execution toolkit (SMB/Kerberos/WMI/LDAP/DCSync) built on TrustedSec's Titanis - NetExec-style workflow in C#
2026-10-22
pentestershell/php2shellbt
D
Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies.
2026-08-27
yellowkeycve2026/YellowKey-BitLocker-CVE-2026-45585
D
YellowKey BitLocker recovery - bitlocker yellowkey, yellowkey bitlocker, CVE-2026-45585, yellowkey github, yellowkey vulnerability, yellowkey CVE, TPM, BitLocker recovery key backup, Windows 10/11, CLI GUI, portable audit tool. Download:🡇
2026-10-22
murrez/php2shell
D
PoC for CVE-2026-109618 / CVE-2026-109619 (php2shell): PHP session.upload_progress UAF. check = GET fingerprint + bulk JSONL; exploit = smart 618 (multi-path trigger) or 619 with --call. Stdlib only.
2026-10-23
david-alvarez-rosa/php-rce
D
Exploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets