## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qqj6-54q6-cxv6. This link is maintained to preserve external references. ## Original Description Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in the patched versions listed above. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.
PoC: CVE-2026-119977-Toolkit
CVE-2026-119977 – WordPress Core Upgrade-Window RCE (CVSS 8.1) | Red/Blue Team Toolkit. Predictable staging dir takeover, wp-config.php promotion, Bait MySQL proof, WAF origin discovery, rate-limited race oracle, admin shell deploy, version triage. Async, CI-tested. Only ethical & authorized use, stay legal.
PoC: CVE-Disclosures
30 CVE disclosures (CVE-2026-117226 to CVE-2026-117255) — SQL Injection, Broken Access Control, File Upload RCE, Information Disclosure across 11 open-source applications. Discovered by Mohamed Aziz Tounsi.
PoC: CVE-2026-83844
Microsoft Paint CVE-2026-83844 Verification Script
PoC: CVE-2026-123158
sshole (CVE-2026-123158): OpenSSH password bypass on alpine Linux
PoC: CVE-2026-123158
OpenSSH + musl password authentication bypass (sshole) checker: local precondition audit + remote verification; for authorized testing
PoC: CVE-2026-123158
Exploit para explotar la vulnerabilidad CVE-2026-123158 (conocida como sshole).
PoC: CVE-2026-116214
CVE-2026-116214: unauthenticated account takeover in MacCMS v10 via an unbound password-recovery code. Full technical writeup + self-contained Docker lab (maccms10 2021.1000.2000, PHP 7.4, MariaDB, Mailpit). For authorized testing only.
PoC: cve-2026-123158-sshole
Scanner CVE-2026-123158 *SSHHole
PoC: CVE-2025-50579-CORS-Misconfiguration-Exploit
nginx CVE-2025-50579 CORS Exploit
PoC: CVE-2026-102334-exploit
CVE-2026-102334 nginx proxy manager Exploit
PoC: CVE-2026-123158
CVE-2026-123158
PoC: cve-2026-109518-apt-patch-proxmox-and-generic
Silly little patch for cve-2026-109518 for apt targeting generic linux and Proxmox host, VM's, containers. CVE happily fixed now by post package maintainers but could be of use. This is how I fixed it while an actual fix was being developed. Tested to work and vibe coded with Claude Opus 5.5.
PoC: CVE-2026-109618
Test the CVE-2026-109618 in a safe environment (VMware, VirtualBox,...)
PoC: redmi-k50-temp-root
Redmi K50 (rubens) 临时 Root 教程 — 基于 DirtyFrag (CVE-2026-43284) + libbase fallback
PoC: keycloak-saml-scanner
Detection-only triage for CVE-2026-117691 (CVSS 9.1): Keycloak SAML HTTP-Redirect binding signature bypass, fixed in 26.8.2
PoC: CVE-2026-123014---iTerm2-Terminal
PoC and research for CVE-2026-123014: iTerm2 x-man-page NUL-byte argument injection.
PoC: sshole
A simple reproducer for CVE-2026-123158
PoC: CVE-2026-83844-Detection
Detection and remediation scripts for CVE-2026-83844, Windows Paint remote code execution (CVSS 8.1)
PoC: cve-2026-123158-openssh-musl-lab
Automated Terraform lab environment for OpenSSH on Linux with musl libc without PAM (CVE-2026-123158 research)
PoC: CVE-2026-123488-POC
POC exploit for CVE-2026-123488 - unauthenticated SQL injection vulnerability in Craft CMS (MySQL/MariaDB backend). Admin takeover.
PoC: cve-2026-48356-magento-file-upload-rce
CVE-2026-48356 - Adobe Commerce/Magento Unrestricted File Upload RCE | CVSS 9.3 | By Gh0st-Bx1
PoC: cve-2025-32433-erlang-ssh-preauth-rce
CVE-2025-32433 - Erlang/OTP SSH Pre-Authentication RCE | CVSS 10.0 | By Gh0st-Bx1
PoC: cve-2026-97229-gitlab-ci-rce
CVE-2026-97229 - GitLab CE/EE CI/CD Integer Overflow RCE | CVSS 10.0 | By Gh0st-Bx1
PoC: CVE-2026-118423-WP-Libre-Form
Sable Research — Analysis of CVE-2026-118423: Unauthenticated Arbitrary File Upload to RCE in WP Libre Form (≤ 1.5.0.1)
PoC: mysql-connector-j-cve-2026-101678-repro
Reproducer for CVE-2026-101678 (MySQL Connector/J <= 26.7.0) - malicious server reporting huge result-set column count
PoC: php2shell-lab
PHP session.upload_progress CVE-2026-109618 lab PoC and research notes
PoC: CVE-2026-123158_SSHRole_PoC
Prova de conceito para exploração da vulnerabilidade CVE-2026-123158.
PoC: cve-2026-113615-poc
CVE-2026-113615 - GS JWT <= 1.0.0 unauthenticated SQLi to administrator JWT (PoC + exploit by thiscitze)
PoC: openssh-musl-enterprise--hardening-cve-2026-123158
openssh-musl-enterprise-hardening (CVE-2026-123158)
PoC: CVE-2015-1201-wordpress-Reflex-Gallery-plugin-RCE-PoC
PoC exploit for CVE-2015-1201 (EDB-36374) — Unauthenticated Arbitrary File Upload to Remote Code Execution in WordPress Reflex Gallery Plugin ≤ 3.1.3. Features interactive webshell, reverse shell mode, and multi-path upload fallback.
PoC: logsign-rce
Logsign Unified SecOps Platform: Pre-Auth Authentication Bypass (CVE-2024-5716) & RCE (CVE-2024-5717) Exploit Chain & Detection Suite
PoC: CVE-2026-118423
CVE-2026-118423 — WP Libre Form <= 1.5.0.1 unauthenticated file upload to RCE (PoC, lab-verified)
PoC: CVE-2026-83844-PoC-MS-paint-v-11.2609.401.0
A proof of concept for CVE-2026-83844. Microsoft paint version 11.2609.401.0
PoC: sshole_scanner-CVE-2026-123158
A scanner for *sshole SSH vulnerability (CVE-2026-123158)
PoC: cortex9-openssl-asn1-string-nul-scanner
Lexical scanner for ASN1_STRING uses that assume NUL termination (CVE-2021-3712). Labels are NUL_SINK_WARNING, BOUNDED_PATTERN or UNKNOWN; heuristic, not a flow analysis.
PoC: cortex9-rust-regex-empty-repetition-size-limit-model
Offline model of the regex 1.5.4 compile-size accounting for empty repetitions (CVE-2022-24713), checked against regex-syntax HIR and real compile results. Bounded cases are labelled MODEL_LIMIT.
PoC: cortex9-node-tar-path-sanitization-model
Offline Python port of node-tar path sanitization (CVE-2021-32804, CVE-2021-37713) with a differential check against the original CHECKPATH logic. No archives are extracted.
PoC: cve-2026-100109-poc
CVE-2026-100109 - Security For WooCommerce 1.0.10-1.0.16 unauthenticated admin creation (PoC by thiscitze)
PoC: cve-2026-114630-poc
CVE-2026-114630 - ELEX HelpDesk <= 3.3.8 unauthenticated arbitrary file deletion (PoC by thiscitze)
PoC: cve-2026-118423-poc
CVE-2026-118423 - WP Libre Form <= 1.5.0.1 unauthenticated upload to RCE (PoC by thiscitze)
PoC: cortex9-heartbleed-heartbeat-bounds-model
Offline model of the OpenSSL heartbeat bounds check (CVE-2014-0160) over an in-memory record and a labelled simulated region. No TLS, no real memory.
PoC: cortex9-rust-str-repeat-capacity-overflow-model
Abstract execution of Rust [T]::repeat capacity arithmetic in 1.29.0 vs 1.29.1 (CVE-2018-1000810) for 16/32/64-bit usize. Allocates nothing.
PoC: cortex9-expat-utf8-name-validation-model
Offline Python model of expat's UTF-8 name checks before/after the CVE-2022-25235 fix, with an independent RFC 3629 decoder. No XML parsing of untrusted input.
PoC: cortex9-dirtycow-gup-cow-state-model
Finite state/interleaving model of the GUP FOLL_WRITE/COW race vs MADV_DONTNEED (CVE-2016-5195). Abstract states only, no syscalls.
PoC: cortex9-expat-namespace-separator-model
Offline Python model of expat addBinding/namespace-separator handling in 2.4.4, 2.4.5 and 2.4.7 (CVE-2022-25236). String-level only.
PoC: cortex9-tmpfiles-hardlink-chown-race-model
Limited educational in-memory FS model of systemd-tmpfiles path_set_perms vs hardlinks (CVE-2017-18078). Not a finding; no real files.
PoC: vsftpd-2.3.4-backdoor-vulnerability_analysis
Hands-on vulnerability assessment of the vsftpd 2.3.4 backdoor (CVE-2011-2523) in an isolated lab.
PoC: cortex9-time-crate-env-race-interleaving-model
Finite interleaving model of time 0.2.22 tzset/getenv vs setenv realloc (CVE-2020-26235). No threads, libc or real environment.
PoC: vsftpd-2.3.4-backdoor-vulnerability-analysis
Hands-on vulnerability assessment of the vsftpd 2.3.4 backdoor (CVE-2011-2523) using Kali Linux, Nmap, Metasploit and an isolated Metasploitable 2 lab.
PoC: CVE-2026-83844
CVE-2026-83844
PoC: check-sshole
Find Dockerfiles that ship an sshd exposed to *sshole (CVE-2026-123158). CLI, pre-commit hook and GitHub Action.
PoC: CVE-2026-123025
OS command injection as root via Google Cloud DNS challenge key
PoC: ansible-sshole-remediate
Ansible playbook that upgrades OpenSSH to 10.6p2 on Alpine Linux to remediate CVE-2026-123158
PoC: CVE-2026-98260-pkt110-kernelsu
CVE-2026-98260 (posix-cpu-timers UAF) to KernelSU on a bootloader-locked OPPO PKT110: exploit core, on-device app, and the research write-up.
PoC: cortex9-openssl-bn-mod-sqrt-loop-model
Pure-Python port of OpenSSL BN_mod_sqrt before/after the CVE-2022-0778 fix, with a step budget on the loops that can grow. Offline.
PoC: cortex9-lodash-defaultsdeep-prototype-pollution-model
Python model of lodash _.defaultsDeep 4.17.11 vs 4.17.12 (CVE-2019-10744) in a throwaway realm. No JS engine, no gadgets.
PoC: cortex9-git-case-insensitive-symlink-checkout-model
In-memory model of git's checkout lstat cache before/after 684dd4c2b414 (CVE-2021-21300). No git, no clone, nothing written to disk.
PoC: cortex9-rust-zip-size-hint-overflow-model
Safe-Rust model of core Zip TrustedRandomAccess before/after rust-lang/rust PR #82289 (CVE-2021-28879). Model indices only; not a reproduction.
PoC: cortex9-git-safe-directory-discovery-model
In-memory model of git repository discovery and the safe.directory ownership check (CVE-2022-24765). Never runs git or touches the real FS.
PoC: cortex9-http2-priority-churn-cost-model
Offline Rust model of the HTTP/2 priority tree with a work counter and nginx PRIORITY budget (CVE-2019-9513 study). No sockets; not a reproduction.
PoC: Shizuka
Post-root DirtyFrag (CVE-2026-43284) mitigation for Galaxy S25 — a build-gated KernelSU kernel module that privatizes ESP receive buffers. Verified on SM-S931Z / DZIF only.
PoC: CVE-2026-120209
Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation | RCE
PoC: sshole-bypass-openssh-password
sshole漏洞复现，CVE-2026-123158
PoC: cortex9-rust-batbadbut-args-model
Offline model of Rust std 1.77.1 vs 1.77.2 batch-file argument quoting (CVE-2024-24576). No processes, no cmd.exe; real cmd behaviour UNKNOWN.
PoC: cortex9-http2-rapid-reset-stream-accounting-model
Discrete-time Rust model of HTTP/2 stream accounting vs handler work for studying Rapid Reset (CVE-2023-44487). Not a reproduction, no sockets.
PoC: ghostlock-a55x
CVE-2026-43499 target port for Samsung Galaxy A55 5G (SM-A556, Exynos 1480, 6.1.157-android14-11) - offsets, P0 fingerprints, KernelSU pair
PoC: cortex9-terrapin-strict-kex-model
Abstract state model of SSH sequence numbers and OpenSSH strict KEX for studying Terrapin (CVE-2023-48795). Not a reproduction.
PoC: CVE-2026-98260-amg-an00
CVE-2026-98260 port for HONOR AMG-AN00 (SM8650 / 6.1.157-android14-11)
PoC: root-my-s24-on-oneui6.1
Using CVE-2026-43499 to root your Galaxy S24 Series on oneui 6.1(successful on 6.1.75-android14-11-29543898-abS9210ZHS4AYB3)
PoC: verification-gap-cve-2026-98432
A Patch Without Proof: the verification gap behind CVE-2026-98432
PoC: CVE-2026-118570
CVE-2026-118570 — CSRF on the Drupal fasttoggle toggle route
PoC: CVE-2026-109619-ZendPipelineLab
PHP CVE-2026-109619 stale session state: calibrated mod_php lab reproduction, evidence, and solver
PoC: CVE-2026-22765-poc
Unauthenticated RCE chain PoC for Dell Wyse Management Suite On-Prem < 5.5 (CVE-2026-22765 + CVE-2026-22766)
PoC: alpinegate
Find which images and containers run a vulnerable Alpine + OpenSSH combination (CVE-2026-123158) — five-condition check, zero network, first-hour playbook.
PoC: CVE-2026-118569
CVE-2026-118569 — any editor could publish every draft on a Drupal site
PoC: omada-advisory-check
Unofficial offline checker: Omada gateway firmware vs TP-Link bulletin 132084 (CVE-2026-19586). Not affiliated with TP-Link.
PoC: php2shell-coverage-check
Checks that Tenable scanning is set up to detect PHP2Shell (CVE-2026-109618, CVE-2026-109619) on every PHP host: plugin feed, credentials, and scan settings. Lists the hosts to rescan and flags end-of-life PHP. Works with Tenable Vulnerability Management, Security Center, and .nessus files. Claude Code skill or standalone script.
PoC: sshole-guide
OpenSSH sshole(CVE-2026-123158) 알파인 sshd 점검을 벨로키와 쉽게 보기
PoC: ofbiz-scanner
Detection-only local triage for Apache OFBiz CVE-2026-83542 (CVSS 9.8) and the 24.09.08 batch — grades installs against the fixed release. No probing, no payloads.
PoC: alpine-openssh-sshole-auth-bypass
Vulnerability research, PoC reproduction lab, and technical analysis for Alpine Linux OpenSSH authentication bypass (CVE-2026-123158 / sshole)
PoC: CVE-2026-33439-PoC
pre-authentication remote code execution vulnerability affecting OpenIdentityPlatform OpenAM in versions equal to or earlier than 16.0.5
PoC: CVE-2026-122158
CVE-2026-122158: InvoiceShelf cross-tenant privilege escalation analysis and safe local-lab PoC
PoC: cve-2026-41651-poc
CVE-2026-41651 - PackageKit 1.0.2-1.3.4 TOCTOU local privilege escalation, independent C implementation (PoC + exploit by thiscitze)
PoC: CVE-2026-76142
CVE-2026-76142 — Genian NAC/ZTNA pre-auth internal IPC routing flaw (gnrpcsvc), CVSS 9.3, fixed in build 148665+
PoC: CVE-2026-123158_SSHole
CVE-2026-123158 SSHole — OpenSSH authentication bypass via musl crypt() overflow on Alpine Linux (Exploit PoC)
PoC: sshole-check
Audit & interim mitigation for CVE-2026-123158 (*SSHole) — OpenSSH password bypass on musl/Alpine — across Docker containers, images and host
PoC: react--v19.2.1
Mirror of react/react at v19.2.1 (React2Shell / CVE-2025-55182 fix)
PoC: alpine-sshd-check
Read-only check for CVE-2026-123158: is your Alpine sshd affected by the password authentication bypass, fixed, or still running the old daemon? Tested on Alpine 3.21 to 3.24 and edge.
PoC: AGM3-W09HN-TempRoot
在 AGM3-W09HN 上通过 CVE-2022-38181 取得临时Root
PoC: cve-2024-26229-bof
Beacon Object File that exploits the Windows CSC (Client-Side Caching) driver for local privilege escalation.
PoC: cve-2026-98432
Temporary nftables mitigation + installer for CVE-2026-98432 (Ubuntu)
PoC: rgpd-cookie-legal
Fork de mantenimiento de 'Protección de Datos RGPD' (click-datos-lopd) con CVE-2023-46071 corregido. GPLv2.
PoC: root-key1
Temporary root for the BlackBerry KEYone BBB100-2 (ABS154, kernel 3.18.71) via GhostLock/CVE-2026-43499. No bootloader unlock, no EDL, no flashing.
PoC: php2shell-lean-plain
PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Lean 4 model, without a bug-specific property
PoC: php2shell-lean-chase
PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Lean 4 model, with the property that catches it
PoC: CVE-2026-98432-Ubuntu-Temporary-Mitigation
Temporary iptables mitigation for CVE-2026-98432 (CVSS 9.8) on Ubuntu Linux. Filters inbound IPv4 TCP packets containing IP options while awaiting kernel security updates. Not a kernel patch.
PoC: php2shell-plain
PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Rust/Verus model, without a bug-specific property
PoC: php2shell-chase
PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Rust/Verus model, with the property that catches it
PoC: CVEs
Lab, privilege-escalation check and detection for LiteLLM CVE-2026-114612 (internal user to proxy admin).
PoC: php-legacy-ubuntu
Signed apt repository with patched PHP 5.6-8.2 rebuilds (PHP2Shell CVE-2026-109618/109619) for Ubuntu 18.04 bionic and 20.04 focal
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free