## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-489w-w794-jq94. This link is maintained to preserve external references. ## Original Description vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.
PoC: AVETemporalPoC-CVE-2026-112705
PoC & panic evidence for CVE-2026-112705: AppleAVE2 kernel OOB write on iOS 27.0.1 (fixed in 27.2) via VideoToolbox NumberOfTemporalLayers. Independent reproduction; original discovery by Calif / Chollima team.
PoC: cve-2020-5902
by yora cve-2020-5902
PoC: CVE-2021-3156
Baron Samedit (CVE-2021-3156): sudo heap-based buffer overflow giving local root. PoC packaged with a static/musl launcher so it runs against older-glibc (2.31) targets.
PoC: php-secure-patch
Bash toolkit that finds and fixes PHP CVEs — PHP2Shell (CVE-2026-109618/109619), CVE-2026-115560, CVE-2024-4577, CVE-2019-11043 — on Linux and macOS. Detects runtimes, audits config, applies source patches, hardens php.ini / FPM / nginx / Apache, hunts compromise, rolls back cleanly. MIT.
PoC: CVE-2026-98260-IQOO-13
Temporary root for the Vivo iQOO 13 via CVE-2026-98260 posix-cpu-timer UAF, with KernelSU and FinaSU late-load
PoC: CVE-2026-98432-POC
Toy project
PoC: Probe-CVE-2026-98432
Local kernel version checker, remote MPTCP capability probe, and interactive scan-and-probe CLI for assessing exposure to the Linux kernel IPv4 TCP use-after-free (CVSS 9.8).
PoC: factorytalk-assetcentre-rce
Research PoC for FactoryTalk AssetCentre HTTP Remoting RCE (CVE-2021-27460 and CVE-2021-27466)
PoC: php-patch-check
Check whether a PHP version is patched against PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Stdlib-only Python.
PoC: php2shell-lab-verification
Defensive lab verification & IR note for php2shell (CVE-2026-109618 / CVE-2026-109619) — patch matrix, mitigation, hunt one-liners. No PoC.
PoC: cve-2026-18649
GStreamer RTP Depayloader Memory Exhaustion Analysis
PoC: WapGuard
Tiny Shizuku app that clears stuck 'SMS of Death' (CVE-2026-58882) WAP Push messages. Material 3 Expressive.
PoC: CVE-2026-112487
macOS revisiond local privilege escalation to root (CVE-2026-112487)
PoC: CVE-2026-120218
CVE-2026-120218: bilingual TypeMill stored XSS analysis and safe SVG/XSLT PoC
PoC: CVE-2026-98432
PoC for CVE-2026-98432 (Linux kernel IPv4 TCP inet_opt/ireq_opt use-after-free, CVSS 9.8): KASAN-verified UAF reproduction in inet_csk_route_req with A/B fixed-kernel control
PoC: debian-cve-2026-98432-fix
One-click kernel security update for CVE-2026-98432 on Debian 12/13.
PoC: CVE-2026-103039
CVE-2026-103039: Gravity Forms <= 3.1.2 PHP object injection to RCE. PoC by NOXCRYPT (noxcrypt-x). gen_payload.php is not included.
PoC: php2shell-ubuntu
Analisa e corrige as vulnerabilidades php2shell do PHP (CVE-2026-109618 e CVE-2026-109619) no Ubuntu
PoC: whatsapp-valleyrat-analysis
WhatsApp-delivered Winos 4.0 / ValleyRAT stager: DLL sideloading, BYOVD Defender kill (CVE-2026-36425), custom C2 protocol on TCP 443, and previously unreported C2 infrastructure.
PoC: CVE-2026-111585
CVE-2026-111585 — TeamViewer Remote-Control Screen Decompression Integer Overflow → Heap Buffer Overflow (PoC, fixed in 15.83, CVSS 8.8). Containerized lab + one-command repro with vulnerable/fixed differential evidence.
PoC: plr110-6.12.38-cve-2026-64560-ksu
Use cve-2026-64560 to root OneOlus ACE 6T
PoC: cve-2026-98432-ebpf
eBPF (XDP/tc) mitigation for CVE-2026-98432 / RHSB-2026-016 - untested draft
PoC: SG-2026-0037
CVE-2026-54523 Kyverno cross-namespace resource generation PoC and exploit
PoC: motogstylus2023-root
Root exploit for Motorola Moto G Stylus 5G 2023 (genevn) via GhostLock (CVE-2026-43499) — locked bootloader, no flashing
PoC: cve-2026-98432-ubuntu-mitigation
Check an Ubuntu host for CVE-2026-98432 and, after you confirm, apply the interim Red Hat RHSB-2026-016 mitigation. Ubuntu 20.04 to 26.10.
PoC: cve-2026-98432-nft-mitigation
Interim nftables mitigation for Linux kernel CVE-2026-98432 (IPv4-options UAF in tcp_v4_syn_recv_sock) as a reproducible agent skill
PoC: php-7.4-cve-2026-docker
PHP 7.4.33 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libraries. Documented builds, source and patch checksums, focused regression tests, Trivy reports, and non-root defaults. Linux amd64. UNVERIFIED development preview; independent mysqlnd review remains incomplete.
PoC: cve-2026-98432
Stopgap firewall mitigation for CVE-2026-98432 on Ubuntu 16.04/24.04
PoC: quarkus-brotli-audit
Audit statique de l'exposition d'une application Quarkus au décodeur Brotli vulnérable (CVE-2026-111497). Généré avec Claude Code.
PoC: Samba_Fruit_Vuln
CVE-2021-44142 — Samba vfs_fruit heap OOB read/write lab demo (educational)
PoC: CVE-2026-101767
Unauthenticated SQL injection (CVSS 9.8) in the Oracle EBS 12.2.312.2.15 TCF servlet
PoC: php-8.1-cve-2026-docker
PHP 8.1.34 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libraries. Documented builds, source and patch checksums, focused regression tests, Trivy reports, and non-root defaults. Linux amd64. UNVERIFIED development preview; independent mysqlnd review remains incomplete.
PoC: CVE-2026-63686
CVE-2026-63686 demo
PoC: CVE-2026-100105
Grafana alerting contact point authorization bypass via schema downgrade (CVSS 7.7) — containerized lab, full PoC, plus 2 unreported findings reproducible on 13.2.5
PoC: synipopt
IPv4 SYN with IP options, one lab target per run, for CVE-2026-98432 research. Header-offset parser, regression tests, and a postmortem of a broken auto-exploiter.
PoC: CVE-2026-116244
pgAdmin 4 server mode: libpq answers GSSAPI with the service account's Kerberos credentials (CVE-2026-116244, fixed in v9.19) — containerized lab + PoC
PoC: CVE-2026-116366
PoC for CVE-2026-116366 — ClickHouse Server unauthenticated RCE (brotli v1.2.0 decoder out-of-bounds write): differential detector, weaponized DoS, containerized vulnerable-vs-fixed lab, root-cause analysis
PoC: cve-2026-98432-guard
Temporary mitigation for CVE-2026-98432 on AlmaLinux 8/9/10 and Ubuntu. Not a kernel fix.
PoC: php2shell-lab
Isolated Docker lab for studying PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.
PoC: fragnesia-scanner
Detection-only local triage scanner for Linux kernel Fragnesia CVE-2026-46300: grade a running or installed kernel against upstream and distro fixed builds. No payloads, no network.
PoC: ddld36-solar-aegis
⛩️☀️ Zero-cost Cloudflare Edge Defense (CVE-2026-109618) + HTTP x402 AI Crawler Monetization. Earn 20% USDC. Landauer Thermodynamics on Base L2.
PoC: CVE-2012-0002
PoC de exploração do CVE-2012-0002 em equipamentos legados com SO já não suportados.
PoC: TryHackMe-OverlayFS---CVE-2021-3493
Here, We go
PoC: CVE-pipeshub
CVE-2026-119712 (CVSS 8.5 High) — PipesHub < 0.10.0 SSRF via image URLs in indexed documents (CWE-918). Verified PoC.
PoC: cve-2026-98432
Detector and local lab for CVE-2026-98432 (IPv4 TCP UAF in inet_opt/ireq_opt): static analysis, kprobes, the tcp2kaslr trigger vector, and remote-risk evidence. Not an exploit; no RCE.
PoC: pillow-patched-brotli
Pillow 13.0.0 wheel rebuilt with Brotli 1.2.1 for CVE-2026-111497, until Pillow 13.1.0 ships
PoC: fix_CVE-2026-98432
Ansible playbook to mitigate CVE-2026-98432
PoC: qt-t-shield
QT Analytics — Operation Fire Pole: Free 60-Second Emergency Defense & Reverse-Proxy Shield for PHP2Shell (CVE-2026-109618 / 109619)
PoC: whichphp
Is the PHP in your container image really fixed for PHP2Shell (CVE-2026-109618, CVE-2026-109619)? Finds every PHP build without running the image, with backport-aware verdicts and evidence.
PoC: CVE-2026-118776
Advisory for node-forge ⌯⌲ 53 mill weekly downloads
PoC: CVE-2026-103688
CVE-2026-103688: Checkout Files Upload for WooCommerce < 2.4.0 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).
PoC: CVE-2026-109384
CVE-2026-109384: IvyForms <= 1.5.1 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).
PoC: cve-2026-98432-mitigation
Interim nftables mitigation for CVE-2026-98432, automatic rollback and Russian administrator guide. Not a kernel patch.
PoC: ntu-se6013-nextjs-auth-bypass
NTU SE6013 Software Security: Next.js CVE-2025-29927 group project. Maintainer-reviewed fork-and-PR contributions.
PoC: cve-2026-98432-validation-mitigation
Read-only patch-state and exposure check for CVE-2026-98432 (Linux kernel IPv4 TCP use-after-free, CVSS 9.8), with opt-in interim mitigation and exact rollback.
PoC: CVE-2023-43364
Exploit for CVE-2023-43364 | Searchor <2.4.2 - Arbitrary Code Execution
PoC: hidra
Hidra - A12 / iOS 18.7.2 jailbreak research. Kernel entry via AppleJPEGDriver CVE-2026-20687. No public build yet.
PoC: tcp2kaslr
CVE-2026-98432: a plain IPv4 TCP server is vulnerable, MPTCP is not the trigger. Bug trigger, evidence and analysis.
PoC: project2026_20261030_tokengate
Un fichier PHP, zéro dépendance : dit si laravel/framework est encore sous le correctif TokenGuard (CVE-2026-114509). Aucun exploit, aucun réseau.
PoC: php2shell-research-portfolio
PHP2Shell CVE-2026-109618 and CVE-2026-109619 research and isolated RCE lab
PoC: CVE-2026-104623
PoC and Docker lab for CVE-2026-104623 — SUSE Rancher Manager local-cluster-shell authorization bypass: any authenticated user spawns a shell pod on the management cluster via alternate request forms that dodge the authorization gate. Validated end-to-end on rancher 2.15.2 (vulnerable) vs 2.15.3 (patched).
PoC: CVE-2026-106378
CVE-2026-106378 is a privilege escalation in the Google Chrome sandbox on macOS. An attacker who has already compromised the renderer process can execute arbitrary code **outside the sandbox** via a crafted HTML page.
PoC: cve-2026-6516-scanner
Find ADAudit Plus web servers in nmap output and triage CVE-2026-6516 (pre-auth RCE) in a single dependency-free Python file.
PoC: CVE-aisoc
CVE-2026-103056 (CVSS 4.0 9.4 Critical) — AiSOC < 12.0.0 OS command injection into CrowdStrike RTR command strings. Verified standalone PoC.
PoC: cve-2025-14847-scanner
Unauthenticated MongoDB enumeration, compression enumeration and CVE-2025-14847 triage in a single dependency-free Python file.
PoC: CVE-rapyd-admin
CVE-2026-109566 (CVSS 9.8) — Rapyd Admin 9.0.0 < 9.20.0 hard-coded super-admin credentials via AuthSeeder (admin@laravel / admin). Standalone exploit PoC.
PoC: cve-2026-98432
Proof-only PoC for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free): race trigger, heap-reuse oracle, no code execution
PoC: CVE-2025-31277-WebKit-Memory-Corruption-Patch-Bypass
Bypass of the official patch for CVE-2025-31277 (WebKit memory corruption). Allows triggering the original issue on patched Safari / iOS / macOS builds through a modified trigger path.
PoC: ubuntu-noble-tcp-rcu-backport
Ubuntu Noble backport and regression evidence for the upstream CVE-2026-98432 IPv4 RCU lifetime repair
PoC: php2shell
PHP file-upload / code-exec toolkit → shell + PHP2Shell CVE-2026-109618/109619 modules
PoC: netprobe-cve-2026-98432
You should patch, but not worry about CVE-2026-98432
PoC: CVE-2026-38751-exploit
Python version of b0ySie7e/OpenSTAManager-RCE-Exploit-CVE-2026-38751 a rust-based POC
PoC: cs-build
ClearSword cloud build (iOS kernel exploit PoC, CVE-2025-43520)
PoC: php2shell-emergency
PHP脆弱性（PHP2Shell: CVE-2026-109618 / CVE-2026-109619）緊急対応プランのランディングページ
PoC: bash2shell
Joke CVE advisory for Bash2Shell (CVE-2026-1337).
PoC: CVE-2026-98432-PoC-Exploit
CVE-2026-98432 ( Linux IPv4 TCP use-after-free toolkit. Detect kernel exposure, trigger the race, analyze captures, recover KASLR slides, and lock down hosts. Single command, zero setup, standard library only. Built for real-world authorized security testing.
PoC: CVE-2026-114625-Proof-Of-Concept
VeloCloud Orchestrator session elevation + unsanitized diagnostics RCE
PoC: CVE-2026-112621-oob-write-poc
This is a fork of vinaykumar´s poc for CVE-2026-112621. This is for educational purposes only. I am only using this to host the website so that I can try the poc
PoC: CVE-2026-48500
CVE-2026-48500
PoC: CVE-2026-29000-jweforge
Educational PoC for an alg:none signature-bypass class in JWE-wrapped JWTs (pac4j-jwt)
PoC: CVE-2026-111497-Node2Shell
CVE-2026-111497 - Node2Shell / HTTP2Shell
PoC: cve-2026-98432-ubuntu-analisis
Analisis dan panduan remediasi CVE-2026-98432 untuk Ubuntu 22.04 LTS
PoC: cve-2026-98432-ubuntu-backport
Source-validated Ubuntu 6.8 backport candidate for Eric Dumazet’s upstream CVE-2026-98432 fix, with provenance and CI. Not yet compiled or boot-tested.
PoC: CVE-2026-116191
Offline Python detector for Rclone version exposure to CVE-2026-116191.
PoC: synology-dsm-vuln-scanner
Detection-only vulnerability scanner for Synology DSM — CVE-2024-10441 (SA-24:20, ransomware-exploited) and CVE-2026-13684/13639 (SA-26:13). Read-only fingerprinting, no exploits. Python 3.9+, zero dependencies.
PoC: CVE-2026-116165
Offline Python detector for CVE-2026-116165 using Parse Server versions and database backend inventory.
PoC: CVE-2026-114820
Offline Python inventory detector for Oracle Java and GraalVM builds affected by CVE-2026-114820.
PoC: php2shell-detections
Suricata rules + CI-proven regression suite for the php2shell PHP RCE chain (CVE-2026-109619 / CVE-2026-109618)
PoC: CVE-2026-117184
Unauthenticated Denial of Service (DoS) via GraphQL alias overloading in Traggo server v0.8.3. Pins CPU and exhausts memory without requiring authentication. CVE-2026-117184.
PoC: CVE-2026-117183
Build-time RCE via FeaturedImage path traversal in astro-notion-blog 0.13.0. Allows attackers with Notion edit access to overwrite files and execute commands on the build host. CVE-2026-117183.
PoC: CVE-2026-117182
Authenticated Stored XSS via SafeUrlValidator bypass on the rich-text render path in Spina CMS (<= 2.21.0). Payload executes on the public site. CVE-2026-117182.
PoC: CVE-2026-112705-poc
Crash-only public-API reproducer for CVE-2026-112705 in AVEVideoEncoder
PoC: CVE-2026-98260-vivo-s60-poc
CVE 2026 98260 vivo s60 poc
PoC: node2shell-two-stage
CVE-2026-111497 two-stage Brotli harness: local trigger/error-semantics verification, no exploitation
PoC: ArchonX-PHP2Shell
Pre-auth PHP RCE framework for CVE-2026-109618/619 — ArchonX_DeadLock_Security
PoC: Paranoid-CVE-2026-98432
Drop incoming IPv4 TCP packets whose IP header contains options.
PoC: cve-2026-98432-checker
Check a Linux server for CVE-2026-98432 (IPv4 TCP use-after-free, CVSS 9.8): root cause explained, read-only check script and mitigations.
PoC: gitlab-onigmo-scanner
Detection-only triage for GitLab CVE-2026-97229 (and CVE-2026-110264): grade a self-managed GitLab version plus its Ruby, catch the Oct-12-patch and custom-Ruby traps. No payloads, no network probes.
PoC: panos-php2shell-defense
Open-source hotfix for PAN-OS firewall chain attack PHP2Shell and Fragnesia CVE-2026-109618 and CVE-2026-46300
PoC: oauth-sink-check
Trace untrusted OAuth endpoint URLs from source to shell sink — the CVE-2026-119025 attack class, checked in your code, lockfile and MCP configs.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free