Exploits

A Proof-of-Concept implementation for CVE-2025-55182, a critical unauthenticated Remote Code Execution vulnerability affecting React Server Components (RSC).

CVE-2026-103956 - Loom for AWS - Critical - Auth bypass - unauthenticated super-admin when no IdP is configured

CVE-2026-102282: adm-zip LPE via SUID/SGID preservation during archive extraction (fixed in 0.6.1)

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

Predictable delete_code via rand() in PictShare < 3.7.1 (CWE-338). PoC + advisory writeup.

Sensitive info disclosure via info API in PictShare < 3.7.1 (CWE-522). PoC + advisory writeup.

Divi Membership (DiviEngine) pre-auth admin takeover — CVE-2026-19660 paypal_param bypass. Python PoC with exploit + cookie export.

PoC for CVE-2026-14378: DevKit Pro ≤2.3.0 unauthenticated admin takeover via original_user_id cookie + revert_switch nonce. check/admin + mass scan.

Defensive analysis, patch breakdown, and detection scanner for CVE-2026-14378 (WordPress DevKit Pro Plugin <= 2.3.0).

CPython - High - wrap_bio hostname skip

CPython - Critical - SNI SSLContext UAF

CVE-2026-90907 (CVSS 6.9) — Joomla! CMS unauthorized user account creation via com_users profile.save (authorization bypass). Non-destructive checker + authorized-use exploit PoC. Fixed in 5.4.9 / 6.1.4.

CVE-2026-102425 - GUI CONSOLE

CVE-2026-92966 — WordPress LatePoint ≤5.7.0 unauthenticated stored shortcode execution (CVSS 9.1, CWE-94). PoCbit mass-exploit PoC: plant [caption]/custom shortcode in booking first name → Customer Cabinet block double do_shortcode; fixed in 5.7.1. No API key. check/exploit/mass, hits.txt & exploited.txt, https://pocbit.org/pocs/cve-2026-92966

Sanitized report and local PoC for CVE-2026-103585

Sanitized report and local PoC for CVE-2026-103584

Local Privilege Escalation (LPE) Vulnerabilities in DeskIn macOS Client