iqx6889/CVE-2026-52813-Gogs-RCE CVE-2026-52813 (Gogs Path Traversal → Git Hooks RCE) defensive writeup: root-cause & patch analysis, Sigma/SIEM detection rules, IOCs, non-intrusive version scanner. No weaponized PoC. Create: 2026-07-21 15:19:49 +0000 UTC Push: 2026-07-21 15:20:00 +0000 UTC |

pvharmo2/cve-repro-cve-2025-47928 Create: 2026-07-21 14:19:29 +0000 UTC Push: 2026-07-21 14:19:30 +0000 UTC |

oscerd/CVE-2026-53913 PoC reproducer for CVE-2026-53913 (Apache Camel camel-keycloak): KeycloakSecurityPolicy fails open in the Basic Setup — with no required roles/permissions the token is never verified, so any forged/garbage bearer token bypasses authentication (unauthenticated RCE). Fixed in 4.18.3/4.21.0. Create: 2026-07-21 12:46:27 +0000 UTC Push: 2026-07-21 12:46:30 +0000 UTC |

Debajyoti0-0/CVE-2026-27654 Create: 2026-07-21 12:05:07 +0000 UTC Push: 2026-07-21 12:05:08 +0000 UTC |

Debajyoti0-0/CVE-2026-27654-PoC Proof-of-Concept and technical analysis for CVE-2026-27654, a heap-based buffer overflow vulnerability in the NGINX HTTP WebDAV module, including root cause analysis, reproduction, and mitigation. Create: 2026-07-21 12:05:07 +0000 UTC Push: 2026-07-21 12:26:50 +0000 UTC |

jaf0rk/CVE-2026-9973-exploit Create: 2026-07-21 11:57:43 +0000 UTC Push: 2026-07-21 11:57:43 +0000 UTC |

Petalrain224/CVE-2026-43499-Redmi-Turbo5 Use CVE-2026-43499 on Redmi Turbo 5 to escalate privilege Create: 2026-07-21 11:28:41 +0000 UTC Push: 2026-07-21 11:28:42 +0000 UTC |

0xdak/CVE-2026-9198_exploit Create: 2026-07-21 11:14:59 +0000 UTC Push: 2026-07-21 11:15:06 +0000 UTC |

sentinel-aidefense/CVE-2025-20352 CVE-2025-20352 Research writeup Create: 2026-07-21 10:39:27 +0000 UTC Push: 2026-07-21 10:39:51 +0000 UTC |

BardLaudian/CVE-2025-64512 Create: 2026-07-21 09:56:44 +0000 UTC Push: 2026-07-21 09:56:44 +0000 UTC |

oscerd/CVE-2026-49365 PoC reproducer for CVE-2026-49365 (Apache Camel camel-netty-http / camel-undertow): muteException defaults to false, so an uncaught exception's full Java stack trace is returned to the HTTP client (CWE-209). Fixed in 4.14.8/4.18.3/4.21.0. Create: 2026-07-21 09:55:57 +0000 UTC Push: 2026-07-21 09:56:01 +0000 UTC |

KuniNogu/drupal-openai-provider-ssrf-cve-2026-13233 CVE-2026-13233 (Drupal OpenAI Provider, SA-CONTRIB-2026-053): response-URL SSRF / local file read. Untrusted upstream, not the prompt. Safe reproducer + detections. Fixed in 1.1.1/1.2.2. Create: 2026-07-21 09:27:25 +0000 UTC Push: 2026-07-21 09:37:51 +0000 UTC |

oscerd/CVE-2026-49099 PoC reproducer for CVE-2026-49099 (Apache Camel camel-salesforce): the non-Camel-prefixed sObjectQuery header escapes the HTTP header filter and overrides the producer's configured SOQL (SOQL injection / broken access control). Fixed in 4.14.8/4.18.3/4.21.0. Create: 2026-07-21 09:20:20 +0000 UTC Push: 2026-07-21 09:20:23 +0000 UTC |

johnhsb/dirty-frag-cve-2026-mitigation Create: 2026-07-21 08:59:31 +0000 UTC Push: 2026-07-21 08:59:36 +0000 UTC |

qianlijaingshan/n8n-cve-2026-21858 CVE-2026-21858 + CVE-2025-68613 — n8n unauthenticated file read to RCE chain exploit Create: 2026-07-21 08:36:18 +0000 UTC Push: 2026-07-21 08:36:39 +0000 UTC |

Ghalendar/CVE-2026-27971_POC CVE-2026-27971 qwik rce Create: 2026-07-21 07:55:45 +0000 UTC Push: 2026-07-21 07:57:04 +0000 UTC |

HORKimhab/CVE-2026-6875 CVE-2026-6875 - Draft Create: 2026-07-21 07:53:18 +0000 UTC Push: 2026-07-21 07:53:22 +0000 UTC |

YumeSecurity/CVE-2018-3214 my exploit for PrimeFaces EL Injection Create: 2026-07-21 05:36:23 +0000 UTC Push: 2026-07-21 05:36:24 +0000 UTC |

suominen/CVE-2026-42533 Create: 2026-07-21 05:27:18 +0000 UTC Push: 2026-07-21 05:27:19 +0000 UTC |

zavikhttak/Follina-CVE-2022-30190-Analysis Threat analysis writeup for Follina (CVE-2022-30190) — Microsoft MSDT RCE zero-day exploited in the wild. Covers static analysis, VirusTotal, OSINT, MITRE ATT&CK T1059, and detection engineering using Windows Event ID 4688. Create: 2026-07-21 03:59:10 +0000 UTC Push: 2026-07-21 03:59:10 +0000 UTC |