Catálogo de exploits

Un fichier PHP, zéro dépendance : dit si laravel/framework est encore sous le correctif TokenGuard (CVE-2026-114509). Aucun exploit, aucun réseau.

You should patch, but not worry about CVE-2026-98432

Ubuntu Noble backport and regression evidence for the upstream CVE-2026-98432 IPv4 RCU lifetime repair

CVE-2026-106378 is a privilege escalation in the Google Chrome sandbox on macOS. An attacker who has already compromised the renderer process can execute arbitrary code **outside the sandbox** via a crafted HTML page.

CVE 2026 98260 vivo s60 poc

Temporary root for the Vivo iQOO 13 via CVE-2026-98260 posix-cpu-timer UAF, with KernelSU and FinaSU late-load

Proof-only PoC for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free): race trigger, heap-reuse oracle, no code execution

CVE-2026-103056 (CVSS 4.0 9.4 Critical) — AiSOC < 12.0.0 OS command injection into CrowdStrike RTR command strings. Verified standalone PoC.

krevetkqqq/CVE-2014-8361

krevetkqqq/CVE-2026-82384

Detection-only triage for GitLab CVE-2026-97229 (and CVE-2026-110264): grade a self-managed GitLab version plus its Ruby, catch the Oct-12-patch and custom-Ruby traps. No payloads, no network probes.

CVE-2026-98432 (CVSS 9.8) Linux IPv4 TCP use-after-free full toolkit. Detect kernel exposure, trigger the race, analyze captures, recover KASLR slides, and lock down hosts. Single command, zero setup, standard library only. Built for real-world authorized security testing.

Toy project

CVE-2026-109566 (CVSS 9.8) — Rapyd Admin 9.0.0 < 9.20.0 hard-coded super-admin credentials via AuthSeeder (admin@laravel / admin). Standalone exploit PoC.

Exploit for CVE-2026-104286 — FortiMail: Unauthenticated Arbitrary File Write → Code Execution

GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）

CVE 2026 98260 vivo x fold6 poc

Verified CVE-2026-98260 Android port for Xiaomi 15 dada OS4.0.0.22.XOCCNXM

CVE-2026-98260 (exec: posix timer UAF) LKM jailbreak for OPPO Find X10 Pro Max (PMX110) and OnePlus 16 (PYB110): one-command root via shell uid 2000, with KernelSU / FinaSU / SukiSU / KernelSU-Next handover. Release build Root618 1.5.12 (R8-obfuscated).

SOC-style investigation of a Netflix phishing email, CVE-2017-11882 exploitation, IOC extraction, and detection engineering mapping.

GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）

PoC CVE-2026-88804 (Rancher)

aymencdm/cve-2026-92424-content-egg-stored-xss-

Reproducer for CVE-2026-101259 — Apache Camel camel-coap consumer sent the exception message to the CoAP client as a 5.00 payload (CWE-209). Camel Spring Boot + Camel Quarkus.

Offline Python detector for CVE-2026-115889 version exposure in Wasmtime.

Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder

CLI scanner and PoC for CVE-2026-109618 / CVE-2026-109619 (PHP OOM heap corruption and session upload-progress injection, CVSS 9.2). Affects PHP 5.4.0-8.5.11; patched in 8.2.35, 8.3.36, 8.4.27, 8.5.12. No external dependencies.

Academic cybersecurity research project analyzing and restoring the FBI's 2013 Tor Browser deanonymization exploit, focusing on CVE-2013-1690, Firefox use-after-free vulnerabilities, exploit mechanisms, and historical forensic analysis.

The layer that protects you. Proactive defense-in-depth Web Application Firewall mitigating recent critical PHP engine vulnerabilities including PHP2Shell (CVE-2026-109618/9), PHP-CGI Argument Injection (CVE-2024-4577), iconv Filter Chains (CVE-2024-2961), and stream wrapper abuse.

Log4Shell (CVE-2021-44228) security briefing research: remediation checklist and write-up