Do Son Fenrisk releases full PoC exploit for CVE-2025-48703, a critical CWP RCE flaw. Learn how unauthenticated attackers hijack non-root users. Patch now!
PoC
Full disclosure: Technical details and a GitHub PoC for CVE-2025-39946 are live. This Linux TLS vulnerability allows root escalation via memory shaping.
Rapid7 publicly discloses a critical zero-day and PoC (CVE-2026-2329) for Grandstream GXP1600 VoIP phones allowing remote root access. Patch now.
Exploit code released for Zabbix flaw CVE-2025-27237. Low-level users can gain SYSTEM privileges on Windows via OpenSSL config. Update now.
D4mianWayne details CVE-2025-68615, a 9.8 critical flaw in Net-SNMP allowing unauthenticated RCE. Update to v5.9.5 or v5.10.pre2 now!
Joseph Goydish uncovers a critical integer overflow in iOS 26.2’s WebKit. Proof of Concept shows how attackers can crash browsers or trigger RCE.
MongoBleed (CVE-2025-14847) allows unauthenticated MongoDB memory leaks. With Joe Desimone's PoC released, upgrade to v8.0.17 or v7.0.28 now!
A Windows Agere Modem EoP flaw (CVE-2025-24990) under active exploit allowed arbitrary kernel R/W even when unused. Microsoft removed the driver in the October update. PoC is available.
A new PoC reveals a race condition in Qualcomm's KGSL GPU driver (CVE-2024-38399). Two threads can access the same list simultaneously, leading to a Use-After-Free vulnerability.
A public PoC has been released for CVE-2025-24085, a zero-day flaw in Apple's Core Media framework that allows a malicious app to elevate its privileges. Update now.
A PoC has been released for two High-severity flaws in the Linux HID core, allowing malicious USB devices to leak up to 64KB of kernel memory.
A new report reveals a CWMP service flaw in TP-Link routers that can be exploited for RCE. Researchers have published a detailed write-up and a PoC on GitHub.
A new Linux kernel flaw (CVE-2025-38617) in the af_packet subsystem can cause a kernel panic. A PoC has been released, and admins are urged to update patched kernels.
A critical flaw (CVE-2025-24103) in macOS InstallAssistant allows a normal user to bypass TCC, exposing private data. A PoC is public, urging users to update to 15.3.
A critical UAF flaw in the Linux kernel (CVE-2025-38236) allows for privilege escalation. A PoC exploit is now public, demonstrating how to escape the Chrome sandbox and gain kernel control.
A Windows CLFS zero-day (CVE-2025-29824) actively exploited by RansomEXX and Play ransomware gangs for privilege escalation, with a public PoC. Patch now!
A critical CSRF flaw (CVE-2025-53095, CVSS 9.7) in Sunshine game streaming host allows remote attackers to execute arbitrary system commands with admin privileges.
Two Sudo flaws (CVE-2025-32463 & CVE-2025-32462) allow local users full root via PoC. Critical privilege escalation vulnerabilities revealed by Stratascale CRU.
Critical CVSS 9.9 RCE, IDOR, and path traversal flaws in InnoShop with full PoC exploit. No patch available—eCommerce sites at serious risk.
Two flaws in Versa Director SD-WAN allow authenticated RCE via insecure file uploads and privilege escalation via webhook abuse. PoC code is public.
PoCGen is a new AI tool using LLMs, static, and dynamic analysis to automate PoC exploit generation for npm vulnerabilities, achieving high success rates at low cost.
Two Windows Kernel vulnerabilities allow SYSTEM-level privilege escalation. PoC exploit code is publicly available.