mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
0xMarcio
ff11c84652
git would not expand [12][0-9][0-9][0-9] as a pathspec, so the job did its work and then died on the commit. Everything it touches is already tracked apart from nuclei.json, so stage tracked changes and name that one file.
Exploit repositories with a commit in the last 90 days, newest first. 
marks a CVE CISA lists as exploited in the wild.
2026 · newest 20 of 253
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 80⭐ | 6d ago | CVE-2026-75604-poc | CVE-2026-75604 Next.js Windows RCE poc |
| 153⭐ | 9d ago | CVE-2026-62911 | POC pre-auth RCE on Exchange |
| 53⭐ | 10d ago | CVE-2026-64638-PoC-XSS2Shell- | XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain - PoC exploit + defensive audit tool + nuclei… |
| 37⭐ | 11d ago | CVE-2026-18963-Exploit | Exploit for KeyCloak CVE-2026-18963 |
| 406⭐ | 11d ago | CVE-2026-9830 | CVE-2026-9830 Proof of Concept |
| 531⭐ | 11d ago | cve-2026-41940-PoC |
A cPanel and WHM authentication bypassing tool |
| 824⭐ | 11d ago | CVE-2026-24061 |
CVE-2026-24061 exploit PoC |
| 60⭐ | 17d ago | watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452 |
CVE-2026-8452 PreAuth RCE |
| 24⭐ | 18d ago | CVE-2026-66804-CrossDevice-Service-EoP | CVE-2026-66804 Windows Cross Device virtual camera EoP - Standard user to SYSTEM |
| 33⭐ | 19d ago | CVE-2026-68138 | CVE-2026-68138 Linux qdisc rate-table race local privilege escalation PoC |
| 19⭐ | 24d ago | CVE-2026-63077 |
Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077) |
| 58⭐ | 25d ago | CVE-2026-55040 |
Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040) |
| 53⭐ | 28d ago | CVE-2026-64560-Analysis | |
| 17⭐ | 28d ago | CVE-2026-60004-POC |
CVE-2026-60004 Pre-Auth RCE Exploit - Gitea <= 1.27.0 diffpatch git hook injection (CVSS 9.8) |
| 81⭐ | 32d ago | CVE-2026-43499-Poc-Analysis | Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For… |
| 23⭐ | 33d ago | CVE-2026-66066-POC | PoC for CVE-2026-66066 in Ruby on Rails |
| 11⭐ | 34d ago | CVE-2026-16232 |
A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login… |
| 325⭐ | 35d ago | CVE-2026-54121 | Certighost POC |
| 35⭐ | 35d ago | CVE-2026-42533 | nginx heap buffer overflow PoC - CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed… |
| 27⭐ | 36d ago | CVE-2026-54121-PoC-Exploit | 👻 CVE-2026-54121 - Best CertiGhost AD CS Multi-Exploit Framework / Advanced toolkit with rogue DC/LDAP… |
2025 · newest 16 of 24
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 6⭐ | 4d ago | vivo_iqoo_neo_9_root_research_on_CVE-2025-21479 |
|
| 4⭐ | 12d ago | cve-2025-21479_iqooneo8 |
Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables… |
| 20⭐ | 21d ago | CVE-2025-7771 | ThrottleStop.sys Arbitrary Physical Memory R/W |
| 6⭐ | 25d ago | CVE-2025-8045 | Dirty Pagetable Exploit for CVE-2025-8045 |
| 6⭐ | 29d ago | SELinux-Permissive-Only-CVE-2025-21479 |
This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the… |
| 4⭐ | 41d ago | CVE-2025-32432 |
Exploit, POC for CVE-2025-32432, CraftCMS2Shell |
| 4⭐ | 43d ago | CVE-2025-64512 | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads |
| 5⭐ | 45d ago | CVE-2025-8110-gogs-poc |
PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink |
| 7⭐ | 54d ago | CVE-2025-30065 | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… |
| 4⭐ | 60d ago | CVE-2025-69212-PoC | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M… |
| 3⭐ | 60d ago | CVE-2025-57819 |
CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE) |
| 4⭐ | 65d ago | CVE-2025-69212-PoC | |
| 5⭐ | 67d ago | CVE-2025-8110 |
PoC exploit for CVE-2025-8110 |
| 14⭐ | 80d ago | vulnerable-nextjs-14-CVE-2025-29927 | |
| 13⭐ | 86d ago | FreePBX-CVE-2025-57819-RCE |
|
| 7⭐ | 86d ago | CVE-2025-57819-poc |
CVE-2025-57819 -> rce |
2024, 2023, 2022
2024 · newest 7 of 10
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 16⭐ | 15d ago | CVE-2024-56426 | A PoC of the CVE-2024-56426 vulnerability. |
| 3⭐ | 16d ago | CVE-2024-56426 | CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F |
| 3⭐ | 33d ago | CVE-2024-36104-PoC | PoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path… |
| 31⭐ | 64d ago | CVE-2024-24919-Bulk-Scanner |
CVE-2024-24919 [Check Point Security Gateway Information Disclosure] |
| 3⭐ | 71d ago | CVE-2024-36991 | Exploit for CVE-2024-36991 , written by me, enumerates a handfull of things, not all, cause not needed. |
| 7⭐ | 80d ago | CVE-2024-27983-nodejs-http2 | CVE-2024-27983 this repository builds up a vulnerable HTTP2 Node.js server (server-nossl.js) based on… |
| 4⭐ | 86d ago | CVE-2024-1065 | Page Cache Exploit for CVE-2024-1065 |
2023 · newest 5 of 8
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 3⭐ | 35d ago | CVE-2023-52076-PoC | PoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary… |
| 5⭐ | 40d ago | CVE-2023-36003 | PoC for CVE-2023-36003: Windows Exploit Security Feature Bypass Vulnerability in Windows Defender. |
| 3⭐ | 55d ago | cve-2023-4911-exploit-optimized |
Pure C exploit for CVE-2023-4911 (Looney Tunables) - x86_64 & aarch64 implementations. Multi-processing… |
| 15⭐ | 57d ago | CVE-2023-32315-EXPLOIT |
A PoC exploit for CVE-2023-32315 - Openfire Authentication Bypass |
| 6⭐ | 73d ago | CVE-2023-6019 | PoC exploit for CVE-2023-6019 - Remote Code Execution via unauthenticated Ray Dashboard Jobs API. |
2022 · newest 1 of 11
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 6⭐ | 75d ago | NimbusPWN-CVE-2022-29799-29800 | NimbusPwn (CVE-2022-29799/29800) local privilege escalation PoC in C. |
Data
Every file is plain JSON on the CDN. No key, no rate limit.
curl -s https://cve.codepwn.win/CVE_list.json | jq '.[] | select(.cve=="CVE-2026-75604")'
curl -s https://cve.codepwn.win/kev.json | jq 'keys | length'
curl -s https://cve.codepwn.win/repo_meta.json | jq '."sfewer-r7/CVE-2026-55040"'
curl -s https://cve.codepwn.win/trending_poc.json | jq '{total_cves, with_pocs}'
| Endpoint | Holds |
|---|---|
CVE_list.json |
Every indexed CVE, its description and its PoC links |
kev.json |
CISA known exploited, keyed by CVE id |
repo_meta.json |
Stars and last push date per PoC repository |
trending_poc.json |
Trending repositories plus index totals |
2026/CVE-2026-75604.md |
Markdown copy of one CVE, one directory per year |
Build
| Job | Cadence | Picks up |
|---|---|---|
| PoC sweep | hourly | New and updated exploit repositories |
| CVE sync | daily | New CVEs and references from NVD and MITRE |
| Link audit | weekly | Repositories that went dead, dropped from the index |
A repository counts as updated only when a commit touches something other than paperwork, so a README tweak cannot pass a year-old exploit off as recent.
Contributing
Missing PoC, wrong link, dead repository: open an issue with the CVE id and the repository URL.