predyy/CVE-2026-34990 CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc. Create: 2026-09-27 19:41:06 +0000 UTC Push: 2026-09-27 19:41:07 +0000 UTC |

DENNISDGR/CVE-2026-44011-poc Authenticated Craft CMS RCE PoC for CVE-2026-44011 Create: 2026-09-27 19:02:15 +0000 UTC Push: 2026-09-27 19:02:16 +0000 UTC |

abatsakidis/CVE-2026-14281-check A Windows-friendly, non-destructive Python checker for detecting WordPress installations potentially affected by CVE-2026-14281. Create: 2026-09-27 18:30:10 +0000 UTC Push: 2026-09-27 18:30:29 +0000 UTC |

DENNISDGR/CVE-2026-34990-poc Local privilege escalation PoC for CVE-2026-34990 using a CUPS root file write vulnerability. Create: 2026-09-27 18:24:03 +0000 UTC Push: 2026-09-27 18:24:04 +0000 UTC |

abatsakidis/wp-cve-2026-87902-checker Defensive WordPress security scanner for CVE-2026-87902 — local filesystem inspection and safe remote HTTP/HTTPS assessment. Create: 2026-09-27 18:20:57 +0000 UTC Push: 2026-09-27 18:20:58 +0000 UTC |

predyy/CVE-2026-28695 CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS. Create: 2026-09-27 18:15:52 +0000 UTC Push: 2026-09-27 18:15:53 +0000 UTC |

khanna419/cve-2021-43798-lab Create: 2026-09-27 17:57:29 +0000 UTC Push: 2026-09-27 17:57:30 +0000 UTC |

H4zaz/CVE-2026-76547 PHP Object Injection in Profile Builder < 4.0.1 Create: 2026-09-27 16:16:18 +0000 UTC Push: 2026-09-27 16:16:19 +0000 UTC |

nth347/mediawiki-CVE-2026-100382 Create: 2026-09-27 15:31:44 +0000 UTC Push: 2026-09-27 15:52:43 +0000 UTC |

tls456/CVE-2026-43805-PoC CVE-2026-43805 IOKit IODMACommand race analysis and proof of concept Create: 2026-09-27 14:47:40 +0000 UTC Push: 2026-09-27 14:47:45 +0000 UTC |

Alexandertanay/jenkins-cve-2024-23897-lab Create: 2026-09-27 14:35:19 +0000 UTC Push: 2026-09-27 14:35:20 +0000 UTC |

jed-parsec/CVE-2026-63030-60137-wp2shell-lab Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only. Create: 2026-09-27 13:25:52 +0000 UTC Push: 2026-09-27 13:25:53 +0000 UTC |

tc4dy/CVE-2026-67279-86060-Toolkit 🛡️ CVE-2026-67279 + CVE-2026-86060 – MikroTrick MikroTik RouterOS SSH Pre-Auth Takeover (CVSS 9.2) | Red/Blue Team suite. 2 tools: Full Exploit (rekey bypass, fd-2 policy swap, full-admin shell, plant, mass scan, SOCKS5/Tor, stealth) & SafeDetect (banner/version audit, IoC guidance, JSON/CSV/HTML). Use Ethically & Safety only. Create: 2026-09-27 12:03:42 +0000 UTC Push: 2026-09-27 12:04:23 +0000 UTC |

langz337/CVE-2026-87902 Unauthenticated LFI and conditional RCE scanner for CVE-2026-87902 in WordPress Core (4.7.0 – 7.1.1). Create: 2026-09-27 12:03:13 +0000 UTC Push: 2026-09-27 12:03:15 +0000 UTC |

4minx/CVE-2026-48842 CVE-2026-48842 PoC — Roundcube virtuser_query pre-auth SQLi Create: 2026-09-27 11:26:19 +0000 UTC Push: 2026-09-27 11:26:20 +0000 UTC |

murrez/CVE-2026-100835 CVE-2026-100835 PoC: Edgeless Contrast <1.16.0 remote attestation relay (aTLS / CWE-295). Manifest audit (AllowedChipIDs/AllowedPIIDs), version & coordinator probe. https://pocbit.org/pocs/cve-2026-100835 Create: 2026-09-27 10:53:39 +0000 UTC Push: 2026-09-27 10:53:41 +0000 UTC |

gbuyssens/CVE-2026-34990 Local privilege escalation against a root `cupsd`. Create: 2026-09-27 10:27:04 +0000 UTC Push: 2026-09-27 10:27:06 +0000 UTC |

gbuyssens/CVE-2026-28695-craft-rce-bypass Authenticated, **blind** remote code execution in Craft CMS. Fix for CVE-2026-28695 Create: 2026-09-27 10:16:49 +0000 UTC Push: 2026-09-27 10:16:50 +0000 UTC |

0xc4rc3l/CVE-2026-34990-poc Create: 2026-09-27 09:25:45 +0000 UTC Push: 2026-09-27 09:25:46 +0000 UTC |

X-Bulow/Reproduce-CVE-2025-32433 Create: 2026-09-27 09:22:01 +0000 UTC Push: 2026-09-27 09:22:02 +0000 UTC |