mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
0xMarcio
1b87e9669d
Wordfence templates do not exploit anything. They fetch a plugin's readme.txt, read the version string and report that a vulnerable release is installed: 80,706 of their 81,526 templates are that and nothing else, and not one sends a payload. Yesterday's widening filed 35,383 of them as proofs of concept, which is a claim the files do not support. Judge the template rather than the repository it came from. A template whose every request reads readme.txt, style.css or a changelog, and which never sends a body or a payload, is a version probe and is skipped wherever it comes from. That keeps the 382 real templates Wordfence does publish and drops the same shape out of the community sets, which were re-hosting them. 39,973 templated CVEs becomes 4,929 and 19,504 entries give up a nuclei section they should never have been given. The index returns to 104,184 CVEs with PoCs from an inflated 117,373.
Exploit repositories with a commit in the last 90 days, newest first. 
marks a CVE CISA lists as exploited in the wild.
Just landed · last 10 days
No star floor here, so a PoC published this morning shows up the same day rather than once it has been noticed.
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 0⭐ | 5h ago | CVE-2026-68138 | Tracking CVE-2026-68138, the Linux kernel net/sched qdisc rate-table use-after-free |
| 0⭐ | 10h ago | CVE-2025-69080 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')… |
| 0⭐ | 18h ago | cve-2025-20333 |
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and… |
| 0⭐ | 1d ago | CVE-2026-76569 | Reflected XSS via search GET Parameter in Phoca Download |
| 2⭐ | 1d ago | CVE-2025-49844 | 🚨 Exploit the CVE-2025-49844 Redis Lua interpreter UAF vulnerability to execute arbitrary shellcode and gain… |
| 10⭐ | 1d ago | cve-2025-21479-iqoo11pro |
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of… |
| 0⭐ | 1d ago | cve-2026-42945 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This… |
| 0⭐ | 1d ago | CVE-2025-6440 | The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services… |
| 10⭐ | 2d ago | givewp-cve-2026-82222-rce-lab | Authorized Docker lab and clean PoC for validating CVE-2026-82222 RCE in GiveWP 4.16.5.1 and the 4.16.7.2 fix. |
| 0⭐ | 2d ago | CVE-2025-55182-scanner |
🔍 Scan for CVE-2025-55182 risks in React Server Components with this non-intrusive tool that helps detect… |
2026 · newest 20 of 253
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 80⭐ | 6d ago | CVE-2026-75604-poc | CVE-2026-75604 Next.js Windows RCE poc |
| 157⭐ | 10d ago | CVE-2026-62911 | POC pre-auth RCE on Exchange |
| 53⭐ | 10d ago | CVE-2026-64638-PoC-XSS2Shell- | XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain - PoC exploit + defensive audit tool + nuclei… |
| 37⭐ | 11d ago | CVE-2026-18963-Exploit | Exploit for KeyCloak CVE-2026-18963 |
| 416⭐ | 11d ago | CVE-2026-9830 | CVE-2026-9830 Proof of Concept |
| 531⭐ | 11d ago | cve-2026-41940-PoC |
A cPanel and WHM authentication bypassing tool |
| 824⭐ | 11d ago | CVE-2026-24061 |
CVE-2026-24061 exploit PoC |
| 60⭐ | 17d ago | watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452 |
CVE-2026-8452 PreAuth RCE |
| 24⭐ | 19d ago | CVE-2026-66804-CrossDevice-Service-EoP | CVE-2026-66804 Windows Cross Device virtual camera EoP - Standard user to SYSTEM |
| 33⭐ | 19d ago | CVE-2026-68138 | CVE-2026-68138 Linux qdisc rate-table race local privilege escalation PoC |
| 19⭐ | 24d ago | CVE-2026-63077 |
Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077) |
| 58⭐ | 25d ago | CVE-2026-55040 |
Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040) |
| 53⭐ | 28d ago | CVE-2026-64560-Analysis | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… |
| 17⭐ | 29d ago | CVE-2026-60004-POC |
CVE-2026-60004 Pre-Auth RCE Exploit - Gitea <= 1.27.0 diffpatch git hook injection (CVSS 9.8) |
| 81⭐ | 32d ago | CVE-2026-43499-Poc-Analysis | Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For… |
| 23⭐ | 33d ago | CVE-2026-66066-POC | PoC for CVE-2026-66066 in Ruby on Rails |
| 11⭐ | 34d ago | CVE-2026-16232 |
A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login… |
| 325⭐ | 35d ago | CVE-2026-54121 | Certighost POC |
| 35⭐ | 36d ago | CVE-2026-42533 | nginx heap buffer overflow PoC - CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed… |
| 27⭐ | 36d ago | CVE-2026-54121-PoC-Exploit | 👻 CVE-2026-54121 - Best CertiGhost AD CS Multi-Exploit Framework / Advanced toolkit with rogue DC/LDAP… |
2025 · newest 16 of 24
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 6⭐ | 5d ago | vivo_iqoo_neo_9_root_research_on_CVE-2025-21479 |
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of… |
| 4⭐ | 12d ago | cve-2025-21479_iqooneo8 |
Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables… |
| 20⭐ | 21d ago | CVE-2025-7771 | ThrottleStop.sys Arbitrary Physical Memory R/W |
| 6⭐ | 25d ago | CVE-2025-8045 | Dirty Pagetable Exploit for CVE-2025-8045 |
| 6⭐ | 30d ago | SELinux-Permissive-Only-CVE-2025-21479 |
This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the… |
| 4⭐ | 41d ago | CVE-2025-32432 |
Exploit, POC for CVE-2025-32432, CraftCMS2Shell |
| 4⭐ | 43d ago | CVE-2025-64512 | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads |
| 5⭐ | 45d ago | CVE-2025-8110-gogs-poc |
PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink |
| 7⭐ | 55d ago | CVE-2025-30065 | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… |
| 4⭐ | 60d ago | CVE-2025-69212-PoC | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M… |
| 3⭐ | 60d ago | CVE-2025-57819 |
CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE) |
| 4⭐ | 65d ago | CVE-2025-69212-PoC | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and… |
| 5⭐ | 67d ago | CVE-2025-8110 |
PoC exploit for CVE-2025-8110 |
| 14⭐ | 80d ago | vulnerable-nextjs-14-CVE-2025-29927 | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior… |
| 13⭐ | 86d ago | FreePBX-CVE-2025-57819-RCE |
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable… |
| 7⭐ | 86d ago | CVE-2025-57819-poc |
CVE-2025-57819 -> rce |
2024, 2023, 2022
2024 · newest 7 of 10
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 16⭐ | 15d ago | CVE-2024-56426 | A PoC of the CVE-2024-56426 vulnerability. |
| 3⭐ | 17d ago | CVE-2024-56426 | CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F |
| 3⭐ | 33d ago | CVE-2024-36104-PoC | PoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path… |
| 31⭐ | 65d ago | CVE-2024-24919-Bulk-Scanner |
CVE-2024-24919 [Check Point Security Gateway Information Disclosure] |
| 3⭐ | 71d ago | CVE-2024-36991 | Exploit for CVE-2024-36991 , written by me, enumerates a handfull of things, not all, cause not needed. |
| 7⭐ | 80d ago | CVE-2024-27983-nodejs-http2 | CVE-2024-27983 this repository builds up a vulnerable HTTP2 Node.js server (server-nossl.js) based on… |
| 4⭐ | 86d ago | CVE-2024-1065 | Page Cache Exploit for CVE-2024-1065 |
2023 · newest 5 of 8
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 3⭐ | 36d ago | CVE-2023-52076-PoC | PoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary… |
| 5⭐ | 40d ago | CVE-2023-36003 | PoC for CVE-2023-36003: Windows Exploit Security Feature Bypass Vulnerability in Windows Defender. |
| 3⭐ | 55d ago | cve-2023-4911-exploit-optimized |
Pure C exploit for CVE-2023-4911 (Looney Tunables) - x86_64 & aarch64 implementations. Multi-processing… |
| 15⭐ | 57d ago | CVE-2023-32315-EXPLOIT |
A PoC exploit for CVE-2023-32315 - Openfire Authentication Bypass |
| 6⭐ | 73d ago | CVE-2023-6019 | PoC exploit for CVE-2023-6019 - Remote Code Execution via unauthenticated Ray Dashboard Jobs API. |
2022 · newest 1 of 11
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 6⭐ | 75d ago | NimbusPWN-CVE-2022-29799-29800 | NimbusPwn (CVE-2022-29799/29800) local privilege escalation PoC in C. |
Data
Every file is plain JSON on the CDN. No key, no rate limit.
# everything the index knows about one CVE
curl -s https://cve.codepwn.win/CVE_list.json \
| jq '.[] | select(.cve == "CVE-2021-44228") | {cve, poc: (.poc | length), nuclei, msf, edb}'
# how bad it is, and how likely it is to be exploited in the next 30 days
curl -s https://cve.codepwn.win/nuclei.json | jq '."CVE-2021-44228"'
curl -s https://cve.codepwn.win/epss.json | jq '."CVE-2021-44228"'
# stars and last push for one PoC repository; repository keys are lowercased
curl -s https://cve.codepwn.win/repo_meta.json | jq '."sfewer-r7/cve-2026-55040"'
What CISA says is being exploited, that also has a PoC here, ranked by how likely each is to be used next:
curl -s https://cve.codepwn.win/kev.json -o kev.json
curl -s https://cve.codepwn.win/epss.json -o epss.json
jq -n --slurpfile kev kev.json --slurpfile epss epss.json \
'[$kev[0] | keys[] | select($epss[0][.]) | {cve: ., epss: $epss[0][.][0]}]
| sort_by(-.epss) | .[:10]'
| Endpoint | Holds |
|---|---|
CVE_list.json |
Every indexed CVE, its description and its poc, nuclei, msf and edb links. 48 MB, 10 MB over the wire |
epss.json |
Exploitation probability and percentile, for nearly every CVE indexed |
nuclei.json |
Severity, CVSS with its vector, EPSS and CWE, for the CVEs a template rates |
kev.json |
CISA known exploited, keyed by CVE id |
repo_meta.json |
Stars and last push date per PoC repository, keys lowercased |
trending_poc.json |
Trending repositories plus index totals |
2026/CVE-2026-68138.md |
Markdown copy of one CVE, one directory per year |
Sources
| Source | What it contributes |
|---|---|
| GitHub | Repositories naming a CVE, checked for code before they are linked |
| Nuclei | Runnable templates, and the severity, CVSS, EPSS and CWE ratings |
| ExploitDB | Archived exploits, mapped by their own CVE column |
| Metasploit | Modules, best ranked first |
| EPSS | Daily exploitation probability from FIRST |
| CISA KEV | What is being exploited in the wild |
| NVD, MITRE | The CVE record itself |
Build
| Job | Cadence | Picks up |
|---|---|---|
| PoC sweep | hourly | New and updated exploit repositories |
| CVE sync | daily | New CVEs and references from NVD and MITRE |
| Nuclei sync | daily | New templates and rating changes |
| Exploit archives | daily | New ExploitDB entries and Metasploit modules |
| Link audit | weekly | Repositories that went dead, dropped from the index |
A repository counts as updated only when a commit touches something other than paperwork, so a README tweak cannot pass a year-old exploit off as recent, and one that holds nothing but paperwork is not linked at all.
Contributing
Missing PoC, wrong link, dead repository: open an issue with the CVE id and the repository URL.