exploit
Joomla Extension 4.1.4 - PHP Object injection
Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass
MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation
Windows Defender (MsMpEng.exe) - Race Condition
WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)
KNX visualisering - Broken Access Control
Epson Printer RAW Protocol Exploit Framework
CVE-2026-54998 RCE Exploit
CVE-2026-22874 writeup: incomplete SSRF allow-list in Gitea webhook/migration (IPv6 transition and cloud metadata). Fixed in Gitea 1.26.3.
PoC for CVE-2026-53360: guest-triggered heap out-of-bounds read/write in KVM SEV-SNP Page State Change (PSC) handling.
PoC for CVE-2026-54415 — Azuriom CMS (<1.2.11) Broken Access Control → account takeover
Static config scanner that flags nginx configs vulnerable to the complex_value two-pass capture-clobbering bug (regex map + regex capture → heap overflow / info leak).
Apache ActiveMQ Classic RCE research: CVE-2026-34197 / CVE-2026-42588 bypass chain + hardened-6.2.6 audit findings + Crowdfense comparison (authorized lab research)
CVE-2026-34038: Authenticated Remote Command Injection in Coolify
CVE-2026-59243 — Apache Airflow FAB Auth Manager JWT signature bypass (embargoed until Apache advisory)
📤 Mass exploitation framework for CVE-2026-56290 — Page Builder CK Joomla unauthenticated file upload to RCE
CVE-2017-12615 - Apache Tomcat Remote Code Execution (RCE)
Pardus Software Local Privilege Escalation PoC - affected from <= 1.0.4