Exploits

CVE-2026-9809 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting Mautic 7 (versions 7.0.0 through 7.1.1).

CVE-2026-9811 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting Mautic 7 (versions 7.0.0 through 7.1.1).

Local privilege escalation via TOCTOU race condition in PackageKit's.

Marimo exploit prior to 0.23.0. Pre-Auth RCE vulnerability via websocket endpoint : /terminal/ws.

A research project on the Log4Shell (CVE-2021-44228) vulnerability.

A flaw in Gitea Open Source Git Server’s approval‑gate logic allows a pull request that originates from a permanent fork to merge without satisfying the repository’s configured approval gates.

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Unauthenticated File Upload → RCE PoC for CVE-2026-57827 (RSFiles! Joomla < 1.17.12). Authorized security research use only.

the CVE-2026-43499 by iqooneo11

🦀 C→Rust port of DaveGamble/cJSON — 🧪 22/22 original tests unmodified, 🐛 70M+ fuzz comparisons/0 divergences, 🎯 CVE-2025-57052 fixed.

Automated PoC exploit for CVE-2025-68937 — Gitea/Forgejo Template Symlink RCE. Any authenticated user can get a shell as the git service user.

Mass vulnerability scanner for CVE-2026-49049 – Unauthenticated Remote Code Execution in Joomla Helix3 plugin. Multi‑threaded, detects both executed and raw PHP payloads.

CVE-2026-72844 : Example of proving "0 = 1" using a vulnerability in the Lean 4 kernel.

CVE-2026-43499 for the Meta Quest

CVE-2025-31207 mitigation and sandboxed tester for iOS 17 Relaxin/rootHide

Root prototype for Galaxy S26

PoC & checker for CVE-2026-15964 - unauthenticated password change in the WordPress plugin Single Sign On For TNG <= 2.0.0 (CVSS 9.8)

WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read