### Impact When we pass a multi-dimensional array (like `[[1, 2], [3, 4]]`) as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct. Example code: ```python @internal def test_input(arr: int128[2][1], i: int128) -> (int128[2][1], int128): return arr, i @external def test_values(arr: int128[2][1], i: int128) -> (int128[2][1], int128): return self.test_input(arr, i) ``` Please see #2183 for further information ### Patches This problem was fixed in #2184, and released as a part of [`v0.2.6`](https://github.com/vyperlang/vyper/releases/tag/v0.2.6).
PoC: CVE-2026-98260
6.12.69-android16-6-g242e1a07f878
PoC: php2shell-scanner
Scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
PoC: CVE-2026-112611-cg-shading
CVE-2026-112611/112610: CoreGraphics PDF out-of-bounds writes (fixed in iOS 27.2) — fix-diff analysis, on-device proof, methodology, and PoC generator scripts. No prebuilt PoCs, no crash reports.
PoC: PHP2SHELL-Checker-v-2.0-CVE-2026-115560-
Versión 2.0 — añade barrido de hosts remotos vía HTTP a la v1.0. Cuando se ejecuta sin argumentos muestra un menú interactivo.
PoC: ghostlock-tv
adb-to-root kernel LPE (GhostLock CVE-2026-43499) for the onn 4K Pro Google TV: futex PI UAF to write primitive to credential swap to uid 0, on locked verified-boot hardware
PoC: CVE-2026-71195
Offline Python detector for CVE-2026-71195 exposure in OpenStack Manila, with branch-aware rules, CSV/JSON inventories, and auditable reports.
PoC: CVE-2026-94300
Offline Python detector for CVE-2026-94300 exposure in ISC BIND 9, with edition-aware rules, CSV/JSON inventories, and auditable reports.
PoC: CVE-2023-7356
Offline Python detector for CVE-2023-7356 exposure in upstream Linux kernels, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-113870
Offline Python detector for CVE-2026-113870 exposure in MongoDB Compass inventories, with CSV/JSON input and auditable reports.
PoC: CVE-2026-89035
Offline Python detector for CVE-2026-89035 exposure in MikroTik RouterOS inventories, with CSV/JSON input and auditable reports.
PoC: CVE-2026-76475
Offline Python detector for CVE-2026-76475 exposure in Cisco UC inventories, with CSV/JSON input, versioned rules, and auditable reports.
PoC: CVE-2026-76474
Offline Python detector for CVE-2026-76474 exposure in Cisco UC inventories, with CSV/JSON input, versioned rules, and auditable reports.
PoC: CVE-2026-76473
Offline Python detector for CVE-2026-76473 release exposure in Cisco UC inventories, with CSV/JSON input and auditable reports.
PoC: CVE-2026-84636-PoC
Proof of concept of CVE-2026-84636, WiFi SSID Info Disclosure
PoC: TICKETS
Log4Shell (CVE-2021-44228) CTF: vulnerable Spring Boot support-ticket app. Get RCE, decompile the JAR, pivot to admin, grab the flag.
PoC: cve-scanner
weblogic CVE-2026-70748,CVE-2026-60672,CVE-2026-35301;PHP CVE-2026-109618 CVE-2026-109619,Node.js CVE-2026-111497,NGINX CVE-2026-42945 CVE-2026-42533 CVE-2026-15176 CVE-2026-93479,Apache HTTPD 2.4.66 CVE-2026-23918,IIS CVE-2026-70024,HTTP.sys CVE-2026-47291... RCE CVE scanner
PoC: CVE-2025-27740_POC
CVE-2025-27740 — AD CS Subject Key Identifier Injection
PoC: CVE-2026-86426
PoC / exploit archive for CVE-2026-86426
PoC: cve-2026-43499-mt6896-pd2238
cve-2026-43499 exploit on vivo's MT6896 device PD2238.
PoC: trojan-source-check
CI scanner for Trojan Source attacks: bidi control characters (CVE-2021-42574), mixed-script identifiers (CVE-2021-42694), invisible zero-width chars. Stdlib only.
PoC: php2shell-cve-2026-109618-109619
calibrated php2shell payloads for common docker images
PoC: mlflow-scorer-scanner
Detection-only triage scanner for MLflow scorer RCE CVE-2026-116692: version check via the /version endpoint. No payloads, no scorer invocation.
PoC: cve-2026-98260-nezha
CVE-2026-98260: Xiaomi 17 Ultra (nezha) temporary root + KernelSU PoC - scripts, docs and logs only; exploit built from upstream source
PoC: work1-secure-api
HDU IS Work 1 - Secure REST API (Flask) with CI/CD (pytest + bandit + pip-audit) and CVE-2018-17246 analysis
PoC: php80-scl-el7-rebuild
Unofficial rebuild of Remi's php80-php 8.0.30-21 SCL packages for CentOS/RHEL 7 (EOL). Includes all 44 CVE fixes between Remi -6 and -21, among them CVE-2026-109618 / CVE-2026-109619 (PHP2Shell).
PoC: Triagem-de-Explora-o-CVE-2024-49138-detectada
Triagem de Alerta SOC 335, que destaca a exploração da vulnerabilidade CVE-2024-49138 , uma vulnerabilidade de escalonamento de privilégios do Windows.
PoC: CVE-2026-42530
CVE-2026-42530 - NGINX HTTP/3 (QPACK) UAF
PoC: CVE-2026-1277
PoC / exploit archive for CVE-2026-1277
PoC: CVE-2026-105482-Reproduce
CVE-2026-105482漏洞复现
PoC: cve-gitea
CVE-2022-30781
PoC: shellshock-linux-host-hardening-lab
Controlled penetration testing and Linux host-hardening lab demonstrating Shellshock (CVE-2014-6271), privilege escalation, vulnerability assessment and defensive security controls.
PoC: php-scare-counted
Verification artifacts for 'How I replicated PHP2Shell, and 5 ways we got super lucky' — checkers for every claim: the fix that shipped nowhere, the four-architecture map, the two-gate leak bands, and the blind-fire arithmetic (CVE-2026-109618/109619)
PoC: CVE-2026-102785
PoC / exploit archive for CVE-2026-102785
PoC: php2shell-poc
PHP2Shell — CVE-2026-109618/109619 exploit toolkit: 5 chains + JA3 stealth + mass scan + safe webshell. Authorized testing only.
PoC: CVE-2026-5054
CVE-2026-5054: writeup + PoC
PoC: CVE-2026-5053
CVE-2026-5053: Writeup + PoC
PoC: brotli-pingback-lab
WordPress XML-RPC pingback lab and crash PoC for CVE-2026-111497 (Brotli decoder out-of-bounds write).
PoC: CVE-2026-48356
PoC / exploit archive for CVE-2026-48356
PoC: bkwld-decoy-cve-2026-116471
Security research and documentation for BKWLD Decoy 5.11.1 — CVE-2026-116471.
PoC: CVE-2026-40281
PoC / exploit archive for CVE-2026-40281
PoC: DotNet-HTTP2Shell-CVE-2026-111497
CVE-2026-111497 - .NET Brotli OOB Write PoC and Exploit (HTTP2Shell) | By Gh0st-Bx1
PoC: CVE-2026-102785
CVE-2026-102785: YOOtheme Pro 5.0.0-5.0.52 unauthenticated RCE via image handler signature reuse + path traversal + JPEG/PHP polyglot. CVSS 10.0. Check script, exploit, detection rules.
PoC: lg-webos2-root
Persistent root for LG webOS 2.x TVs (CVE-2014-3153)
PoC: brotli-k8s-scan
Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries themselves, not just version numbers, so it catches bundled copies in Node.js, Python, .NET, Bun and Envoy. Read-only, bash only.
PoC: CVE-2026-97798-exploit
CVE-2026-97798 Windows Error Reporting - Command Injection TO SYSTEM
PoC: ehax-log4shell-openhouse
EHAX DTU Open House: safe, isolated Log4Shell (CVE-2021-44228) wallpaper-reveal demo with Minecraft 1.8.8
PoC: CVE-2026-101767
PoC / exploit archive for CVE-2026-101767
PoC: CVE-2026-114509
PoC / exploit archive for CVE-2026-114509
PoC: CVE-2026-109618-109619
PHP2Shell CVE-2026-109618 / CVE-2026-109619 Mitigation work (Ansible Role)
PoC: plex2scan
Find Plex Media Servers affected by Plex2Shell (CVE-2026-96652 and three more)
PoC: CVE-2026-8467
PoC / exploit archive for CVE-2026-8467
PoC: brotli-check
Portable PHP Brotli decoder inventory for WordPress, Drupal and Symfony — CVE-2026-111497
PoC: TomcatRace-CVE-2024-50379
PoC and exploit for CVE-2024-50379 - Apache Tomcat Race Condition RCE (CVSS 9.8)
PoC: TomcatPartialPUT-CVE-2025-24813
PoC and exploit for CVE-2025-24813 - Apache Tomcat Partial PUT RCE (CVSS 9.8)
PoC: CVE-2026-98260
6.6.118-android15-8-g9bc34d5b0c79
PoC: hdu-is-lab1
Information Security Lab 1: secure REST API, CI security scans, and CVE-2024-1561 analysis
PoC: CVE-2026-117532-poc
PoC for CVE-2026-117532 in REDAXO Authentication bypass, full chain not yet implemented. CVSS score 9.3 critical
PoC: CVE-2026-16723-vul
CVE-2026-16723漏洞环境与poc
PoC: php2shell-cve-2026-109618
just an experiment
PoC: CVE-2026-96760
PoC / exploit archive for CVE-2026-96760
PoC: ConsulK8s-CVE-2026-110720
CVE-2026-110720 - HashiCorp consul-k8s Cross-Namespace ACL Bypass PoC & Exploit
PoC: AuthenticatorFlaw-CVE-2026-80097
CVE-2026-80097 - Microsoft Authenticator Android Token Theft PoC & Exploit
PoC: DotNet-Tarball-CVE-2026-114148
CVE-2026-114148 - .NET Linux Tarball Local Privilege Escalation PoC & Exploit
PoC: wasmtime-sweep
Find every Wasmtime engine embedded in binaries, wheels, NuGet packages and layers, and check CVE-2026-115889/115893
PoC: hdu-is-lab1-secure-api
HDU IS Lab 1: secure Flask REST API, CI/CD SAST+SCA pipeline and CVE-2021-43798 analysis
PoC: CVE-2024-47167
PoC / exploit archive for CVE-2024-47167
PoC: CVE-2026-1277
The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.
PoC: CVE-2026-1306
The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution
PoC: cve-2026-15176
CVE-2026-15176 — NGINX alias+rewrite heap overflow: analysis, differential lab, PoC (WIP)
PoC: CVE-2026-1296
Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious site
PoC: php2shell
Pre-auth RCE exploit toolkit — CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF)
PoC: node2shell-scanner
Scanner for php2shell (CVE-2026-111497)
PoC: php2shell-scanner
Scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
PoC: brotli2scan
Is your website affected by HTTP2Shell (CVE-2026-111497)?
PoC: php2shell
CVE-2026-109618 · CVE-2026-109619
PoC: opd2415-6.6.118-cve-2026-64560-ksu
Per-boot KernelSU late-load via CVE-2026-64560 — OnePlus Pad 3 (OPD2415, SM8750, kernel 6.6.118-android15-8, 4K, locked bootloader): payload port, device profile + kallsyms evidence, host driver, companion APK (me.exo1i.opd2415)
PoC: php2shell-checks
Read-only exposure checks for PHP2Shell (CVE-2026-109618 / -109619): accuracy-hardened scanner + two on-box auditors.
PoC: CVE-2026-115893-wasmtime-sandbox-escape
CVE-2026-115893: full Wasmtime aarch64 Cranelift br_table sandbox-escape exploit, PoV, calibration notes, and verification evidence.
PoC: CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string API credentials
PoC: php2shell-version-frontier
Measured php2shell (CVE-2026-109618/109619) RCE frontier on amd64: 8.3.35 closed via gdb crash forensics (HTDATA=chunk+0x6a0d8); per-build profiles, tools, method
PoC: CVE-2026-33825
PoC / exploit archive for CVE-2026-33825
PoC: CVE-2026-77647
PoC / exploit archive for CVE-2026-77647
PoC: CVE-2026-90817
PoC / exploit archive for CVE-2026-90817
PoC: CVE-2026-93399
PoC / exploit archive for CVE-2026-93399
PoC: CVE-2026-109619
PoC / exploit archive for CVE-2026-109619
PoC: php2shell-poc
PHP2Shell — CVE-2026-109618/109619 pre-auth RCE exploit. Production chain + 8M lab chain + local UAF + handler mismatch.
PoC: CVE-2026-97629
PoC / exploit archive for CVE-2026-97629
PoC: CVE-2026-97205
PoC / exploit archive for CVE-2026-97205
PoC: php2shell-scan
Exposure triage, host verification and remediation tracking for PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
PoC: php2shell-exposure-scanner
Detection-only PHP version/exposure scanner for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Fingerprints PHP version via standard HTTP headers, no exploit payload sent.
PoC: zip-cloaking-scanner
Detection-only triage scanner for Rust zip cloaking CVE-2026-115905: Cargo version check plus Central vs Local header comparison. No payloads, no extraction.
PoC: CVE-2026-98260-pandora-lpe
小米17 Pro 4.0.5.0 本地提权
PoC: crypto_quinxin
PHP2Shell (CVE-2026-109618/109619) exposure sweep and takeover assessment across 56 vulnerable TZ/KE hosts
PoC: CVE-2026-111497
Security audit and remediation agent for CVE-2026-111497, an out-of-bounds write in the Google Brotli decoder: detect, patch and verify on Debian and Ubuntu
PoC: cve-2026-93328-gate
The authorization layer CVE-2026-93328 was missing: scoped grants, path confinement, and signed receipts in front of MCP storage tools. CVE reproduction + gated proof, 10/10 tests.
PoC: php2shell
php2shell (CVE-2026-109618/109619) research: lab + analysis
PoC: phpscan
Detect-only PHP2Shell (CVE-2026-109618/109619) exposure check for websites and local network devices
PoC: CVE-2017-7921-2026-writeup
Vulnerability research write-up on CVE-2017-7921 — a critical unauthenticated auth bypass in Hikvision IP cameras/DVRs/NVRs, covering root cause, exploitation path, detection, and remediation.
PoC: Cve-2026-55944
This PoC simulates an XML parsing vulnerability where configuration data is parsed and passed directly to ProcessStartInfo. It extracts executable paths and arguments from XML markup to spawn a system process, demonstrating how unsafe input handling can lead to arbitrary command execution.
PoC: hdu-is-work1
HDU IS Work 1 - secure REST API, CI/CD security pipeline, CVE-2024-1561 remediation
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free