CerberusMrXi/cPanel-CVE-2026-41940-auth-bypass-exploit Critical authentication bypass exploit for cPanel/WHM CVE-2026-41940. Leverages CRLF injection in cpsrvd daemon to gain root WHM access without credentials. Includes version detection, verbose logging, proxy support, JSON reporting, and post-exploitation account enumeration. For authorized security testing only. Create: 2026-07-26 16:39:42 +0000 UTC Push: 2026-07-26 16:39:43 +0000 UTC |

CerberusMrXi/cPanel-WHM-CVE-2026-41940-auth-bypass-exploit Critical authentication bypass exploit for cPanel/WHM CVE-2026-41940. Leverages CRLF injection in cpsrvd daemon to gain root WHM access without credentials. Includes version detection, verbose logging, proxy support, JSON reporting, and post-exploitation account enumeration. For authorized security testing only. Create: 2026-07-26 16:39:42 +0000 UTC Push: 2026-07-26 16:51:15 +0000 UTC |

theopaid/CVE-2026-67183-Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb- Security Advisory: Unauthenticated Memory Leak Leads To Memory Exhaustion (TinyWeb) Create: 2026-07-26 15:08:19 +0000 UTC Push: 2026-07-28 23:28:01 +0000 UTC |

theopaid/CVE-2026-67184-Unauthenticated-NULL-Pointer-Dereference-Crashes-the-Server-TinyWeb- Security Advisory: Unauthenticated NULL Pointer Dereference Crashes the Server (TinyWeb) Create: 2026-07-26 15:07:08 +0000 UTC Push: 2026-07-28 23:27:13 +0000 UTC |

theopaid/CVE-2026-67185-Unauthenticated-Path-Traversal-Allows-Arbitrary-File-Read-TinyWeb- Security Advisory: Unauthenticated Path Traversal Allows Arbitrary File Read (TinyWeb) Create: 2026-07-26 15:06:23 +0000 UTC Push: 2026-07-28 23:26:40 +0000 UTC |

theopaid/CVE-2026-66750-Insufficient-Access-Controls-Allow-for-Unauthorized-File-Downloads-Let-s-Chat- Security Advisory: Insufficient Access Controls Allow for Unauthorized File Downloads (Let's Chat) Create: 2026-07-26 14:29:32 +0000 UTC Push: 2026-07-28 23:29:54 +0000 UTC |

theopaid/CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat- Security Advisory: Insufficient Access Controls Allow for Unauthorized Room Deletion (Let's Chat) Create: 2026-07-26 14:28:39 +0000 UTC Push: 2026-07-28 23:29:12 +0000 UTC |

theopaid/CVE-2026-66749-Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat- Security Advisory: Unchecked Room Lookup Leads to Server Crash (Let's Chat) Create: 2026-07-26 14:27:54 +0000 UTC Push: 2026-07-28 23:30:33 +0000 UTC |

woshimaniubi8/CVE-2026-43499-root-KernelSU 基于内核漏洞的本地提权适配，集成嵌入式 KernelSU 。编译生成`preload.so`；触发成功后会以 `late-load` 模式(越狱模式)启动 KernelSU。支持(xbl_config.img / vendor_boot.img) + boot.img 生成target.h Local privilege escalation adaptation based on a kernel vulnerability, integrating embedded KernelSU. Compiles and generates `preload.so`; , KernelSU will be started in `late-load` mode Create: 2026-07-26 12:39:00 +0000 UTC Push: 2026-07-26 12:39:01 +0000 UTC |

Debajyoti0-0/CVE-2026-64600 Create: 2026-07-26 12:20:53 +0000 UTC Push: 2026-07-26 12:20:54 +0000 UTC |

mumaosong/CVE-2026-43499-xiaomi-8gen2-debug 测试版 Create: 2026-07-26 12:09:22 +0000 UTC Push: 2026-07-26 12:09:23 +0000 UTC |

fusiondrive/CVE-2026-43499-S24U CVE-2026-43499 research port for Galaxy S24 Ultra SM-S928U1 DZF2 (in progress) Create: 2026-07-26 11:55:26 +0000 UTC Push: 2026-07-26 11:55:29 +0000 UTC |

northsia/CVE-2026-60137-With-Skip-SSL CVE-2026-60137-With-Skip-SSL Create: 2026-07-26 11:50:00 +0000 UTC Push: 2026-07-26 11:50:01 +0000 UTC |

Hunt-Benito/siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization Create: 2026-07-26 10:45:03 +0000 UTC Push: 2026-07-26 10:45:06 +0000 UTC |

shinthink/CVE-2026-10818 CVE-2026-10818 — WPForms Pro <= 1.10.1.1 Unauthenticated File Upload via Chunk Upload Race (5M+ installs) Create: 2026-07-26 10:07:13 +0000 UTC Push: 2026-07-26 10:07:16 +0000 UTC |

Nxploited/CVE-2026-15981 SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter Create: 2026-07-26 09:42:38 +0000 UTC Push: 2026-07-26 09:42:39 +0000 UTC |

Nxploited/CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering Create: 2026-07-26 09:29:00 +0000 UTC Push: 2026-07-26 09:29:01 +0000 UTC |

shinthink/CVE-2026-58480-Blocksy-Companion-Pro-RCE CVE-2026-58480 / CVE-2026-15158 — Unauthenticated RCE in Blocksy Companion Pro < 2.1.47 (300K+ installs). Pre-auth arbitrary file upload via double-extension bypass. Create: 2026-07-26 08:59:36 +0000 UTC Push: 2026-07-26 08:59:37 +0000 UTC |

shinthink/CVE-2026-58480 CVE-2026-58480 / CVE-2026-15158 — Unauthenticated RCE in Blocksy Companion Pro < 2.1.47 (300K+ installs). Pre-auth arbitrary file upload via double-extension bypass. Create: 2026-07-26 08:59:36 +0000 UTC Push: 2026-07-26 09:46:11 +0000 UTC |

cduram/Input-Leap--Path-Traversal---NotCVE-2026-0014 Create: 2026-07-26 01:24:06 +0000 UTC Push: 2026-09-24 21:42:08 +0000 UTC |