SaiTeja-Erukude/CVE-2026-93349-frictionless-command-injection- Frictionless <= 5.20.0rc1 OS command injection via CLI explore. Create: 2026-09-23 16:07:06 +0000 UTC Push: 2026-09-23 16:07:08 +0000 UTC |

SaiTeja-Erukude/CVE-2026-93349-frictionless-command-injection Frictionless <= 5.20.0rc1 OS command injection via CLI explore. Create: 2026-09-23 16:07:06 +0000 UTC Push: 2026-09-23 16:10:46 +0000 UTC |

bhideki/CVE-2026-87902 CVE-2026-87902: PoC for WordPress's critical path traversal Create: 2026-09-23 15:43:38 +0000 UTC Push: 2026-09-23 15:43:39 +0000 UTC |

Hassham1/CVE-2026-94545-nextjs-og-poc CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j — Next.js next/og ImageResponse SVG injection (Satori, GHSA-wx4j-mvgx-mqwp): isolated Docker validation lab with vulnerable (16.3.5) vs patched (16.3.6) controls, non-destructive Python scanner with pixel-level PNG evidence, and root-cause analysis of the upstream Satori fix. Authorized security research only. Create: 2026-09-23 14:51:59 +0000 UTC Push: 2026-09-23 14:52:38 +0000 UTC |

Polosss/By-Poloss..-..CVE-2026-19125 Unauthenticated Authentication Bypass Create: 2026-09-23 14:25:07 +0000 UTC Push: 2026-09-23 14:25:09 +0000 UTC |

super-meuw/CVE-2026-86218 CVE-2026-86218 Create: 2026-09-23 12:32:48 +0000 UTC Push: 2026-09-23 12:32:49 +0000 UTC |

rankthree/SOC-Detection-T1003.001-CVE-2021-40444 Create: 2026-09-23 12:30:01 +0000 UTC Push: 2026-09-23 12:30:02 +0000 UTC |

Hassham1/CVE-2026-87902 WordPress Core <= 7.1.1 unauthenticated LFI to RCE - validation lab, PoC, nuclei template (GHSA-7hp8-65ch-5whp) Create: 2026-09-23 11:54:00 +0000 UTC Push: 2026-09-23 11:54:01 +0000 UTC |

Nefhara/CVE-2020-6857 PoC CVE-2020-6857 Create: 2026-09-23 11:46:31 +0000 UTC Push: 2026-09-23 11:47:10 +0000 UTC |

zer0dayf/CVE-2026-87902 Create: 2026-09-23 11:03:07 +0000 UTC Push: 2026-09-23 11:03:07 +0000 UTC |

FurkanKAYAPINAR/CVE-2026-94127 CVE-2026-94127 Create: 2026-09-23 10:38:29 +0000 UTC Push: 2026-09-23 11:04:24 +0000 UTC |

mohamedbrek/SOC335-CVE-2024-49138-Exploitation-Detected LetsDefend SOC lab investigating CVE-2024-49138 and related malicious activity. Create: 2026-09-23 09:09:56 +0000 UTC Push: 2026-09-23 09:10:01 +0000 UTC |

Leox48/CVE-2026-1769-WriteUp Public write-up and disclosure timeline for CVE-2026-1769 (Stored XSS in Xerox CentreWare Web) Create: 2026-09-23 08:09:37 +0000 UTC Push: 2026-09-23 08:09:38 +0000 UTC |

HORKimhab/CVE-2026-94545 CVE-2026-94545 - Draft or TODO Create: 2026-09-23 07:13:04 +0000 UTC Push: 2026-09-23 07:13:09 +0000 UTC |

dinosn/cve-2026-87902-wordpress-lfi-lab Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4.7.0-7.1.1, fixed 7.1.2). Authorized/defensive testing. Create: 2026-09-23 05:20:08 +0000 UTC Push: 2026-09-23 05:20:12 +0000 UTC |

kia950274/CVE-2026-90817-study CVE-2026-90817-study Create: 2026-09-23 05:16:39 +0000 UTC Push: 2026-09-23 05:16:40 +0000 UTC |

dookcss/cve-2026-84530-harness On-device runtime verification harness for CVE-2026-84530 (AIO kqueue kernel address disclosure). Builds an unsigned IPA via GitHub Actions. Create: 2026-09-23 03:58:58 +0000 UTC Push: 2026-09-23 03:59:05 +0000 UTC |

shlln/CVE-2026-90847 Create: 2026-09-23 03:56:47 +0000 UTC Push: 2026-09-23 03:56:48 +0000 UTC |

G4sp4rCS/CVE-2019-11707-from-an-IonMonkey-type-confusion-to-SYSTEM- CVE-2019-11707 is a critical type confusion in Firefox's IonMonkey optimizing JIT. The browser bug provides native code execution in the content process, but that process remains constrained by the Firefox sandbox. The complete laboratory chain therefore combines three vulnerabilities: Create: 2026-09-23 03:17:43 +0000 UTC Push: 2026-09-23 03:17:44 +0000 UTC |

donofly/CVE-2025-22457-vulnserver-lab Create: 2026-09-23 03:17:05 +0000 UTC Push: 2026-09-23 03:18:05 +0000 UTC |