JailBr3ak/CVE-2026-97347 Create: 2026-09-30 10:24:29 +0000 UTC Push: 2026-09-30 10:24:34 +0000 UTC |

CaptainAI-Labs/CaptainAI-LPE-CVE-2026-52993 Create: 2026-09-30 10:12:29 +0000 UTC Push: 2026-09-30 10:12:30 +0000 UTC |

ThierryDuval/CVENGODA2026 Create: 2026-09-30 09:52:55 +0000 UTC Push: 2026-09-30 09:52:56 +0000 UTC |

murrez/CVE-2026-102425 CVE-2026-102425 PoC (PoCbit) — Joomla Balbooa Forms (com_baforms) <2.4.3.4 unauth RCE via field shortcode injection in post-submission PHP eval(). check + exploit + mass bulk. https://pocbit.org/pocs/cve-2026-102425 Create: 2026-09-30 08:00:21 +0000 UTC Push: 2026-09-30 08:00:23 +0000 UTC |

mhtsec/CVE-2026-94545 Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC Create: 2026-09-30 05:52:57 +0000 UTC Push: 2026-09-30 05:53:04 +0000 UTC |

ghannyxploit404/CVE-2026-18143 single PoC for CVE-2026-18143 Unauth AFU (Arbitrary File Upload) Create: 2026-09-30 04:35:37 +0000 UTC Push: 2026-09-30 04:35:39 +0000 UTC |

0Asylum/CVE-2026-31857 CraftCMS has an RCE vulnerability via relational conditionals in the control panel Create: 2026-09-30 03:17:31 +0000 UTC Push: 2026-09-30 03:17:32 +0000 UTC |

uziii2208/CVE-2026-96760 Authlib 1.7.2: Signature Verification Bypass - General JSON JWS Accepts Unsigned Payload when `signatures` is Empty Create: 2026-09-30 03:01:31 +0000 UTC Push: 2026-09-30 03:01:33 +0000 UTC |

KrioSocial/defender-bypass-winrar-cve-2023-38831 The purpose of this lab is to empirically demonstrate that relying solely on the free, built-in Microsoft Defender Antivirus is insufficient for small businesses. While free Defender provides baseline endpoint protection, it lacks the operational capabilities, patching, and 24/7 monitoring required to stop modern, multi-stage attacks. Create: 2026-09-30 01:34:22 +0000 UTC Push: 2026-09-30 01:34:23 +0000 UTC |

IamSaishi/CVE-2023-43364_Exploit Create: 2026-09-29 22:46:44 +0000 UTC Push: 2026-09-29 22:46:45 +0000 UTC |

tonydelouvre/CVE-2026-87902 XWP_RCE — CVE-2026-87902 Hacker Console Create: 2026-09-29 20:17:47 +0000 UTC Push: 2026-09-29 20:17:48 +0000 UTC |

kiyingiericmark-wq/CVE-2020-24186 Create: 2026-09-29 19:33:53 +0000 UTC Push: 2026-09-29 19:33:54 +0000 UTC |

Sakura999999999/CVE-2023-3776_repro Reproduce and debug CVE-2023-3776 Create: 2026-09-29 18:58:54 +0000 UTC Push: 2026-09-29 18:58:55 +0000 UTC |

RnW29/cve-2024-21626-runc-lab Create: 2026-09-29 18:54:48 +0000 UTC Push: 2026-09-29 18:54:49 +0000 UTC |

dinosn/libheif-cve-2026-84383-lab Marker-only Docker lab for validating CVE-2026-84383 in libheif through Discourse Create: 2026-09-29 17:40:08 +0000 UTC Push: 2026-09-29 17:40:13 +0000 UTC |

0xTatsuki/CVE-2026-31857 CraftCMS RCE exploit Create: 2026-09-29 17:03:46 +0000 UTC Push: 2026-09-29 17:03:47 +0000 UTC |

7acini/CVE-2026-102261 https://vuldb.com/cve/CVE-2026-102261 Create: 2026-09-29 16:30:28 +0000 UTC Push: 2026-09-29 16:30:29 +0000 UTC |

MRdark-ops/WP2Shell--CVE-2026-63030-CVE-2026-60137- Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only. Create: 2026-09-29 16:26:47 +0000 UTC Push: 2026-09-29 16:26:48 +0000 UTC |

GadyPrime/grafana_mythos_cve-2025-4123 Create: 2026-09-29 14:54:28 +0000 UTC Push: 2026-09-29 14:54:29 +0000 UTC |

primesec-dev/grafana_mythos_cve-2025-4123 Create: 2026-09-29 14:54:28 +0000 UTC Push: 2026-09-29 14:54:29 +0000 UTC |