## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r7wm-3cxj-wff9. This link is maintained to preserve external references. ## Original Description The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a . or e/E is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller. As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes. The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase. Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected. Exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed. This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, from 2.19.0 through 2.21.3, and from 2.22.0 through 2.22.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3 and from 3.2.0 through 3.2.0. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound.
PoC: CVE-2026-104748
Unauthenticated privilege escalation in SimpleForm WordPress plugin <= 3.10.0. Registers an administrator account without authentication
PoC: CVE-2026-97229-PoC
GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image
PoC: CVE-2026-97657
CVE-2026-97657 – Authentication Bypass & Account Takeover | Pocbit
PoC: CVE-2026-109721
Write-up for CVE-2026-109721
PoC: CVE-2026-85097-Toolkit
CVE-2026-85097 – Bricksforge WordPress Plugin Unauth File Upload to RCE Toolkit (CVSS 10.0) | Red/Blue Team suite for Bricksforge Pro Forms < 3.1.8.9. 2 tools: Full Exploit (polyglot upload, web shell, mass scan, OPSEC, SQLite/JSON output) + SafeChecker (version detect, non-intrusive audit). Ethical & educational use only.
PoC: CVE-2026-102489
CVE-2026-102489 exploit in golang
PoC: sqli-cve-2026-102428
PoC: OrdaSoft Joomla OS CCK (com_os_cck) 8.3.15 unauth SQLi —mass+exploit+dork
PoC: linux-kernel-cve-2026-74580-vghost
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
PoC: CVE-2026-85046
V8 inlined Array.prototype.sort elements-kind confusion - PoC + addrof (N-day research)
PoC: CVE-2025-13224
V8 super receiver confusion - PoC + unreachability research
PoC: CVE-2025-12433
V8 hole-check elision merge bug - PoC + exploit
PoC: CVE-2024-5274
V8 parser x bytecode-flush NativeContext leak - PoC
PoC: CVE-2024-2887
V8 Wasm GC type confusion - two PoCs (kExtern / kNone paths)
PoC: CVE-2024-23222
JSC DFG TOCTOU stale JSCell - deterministic UAF PoCs + race harness
PoC: CVE-2018-4125-4161-4162-4163
JSC side-effect type confusion family (4 CVEs) - family PoC + full exploit
PoC: cve-2026-44825-challenge
cve2026-44825_ctf_test
PoC: CVE-2023-41993
JSC DFG CSE offset-key bug, GetterSetter leak - PoC + exploit
PoC: CVE-2023-2033
V8 TheHole leak - PoC
PoC: CVE-2022-1364
V8 escape-analysis object materialization confusion - PoC
PoC: CVE-2021-38003
V8 TheHole leak via JSON.stringify - PoC + OrderedHashMap amplification
PoC: CVE-2021-30517
V8 SuperIC confusion - PoC + addrof/fakeobj/arb-rw exploit snippets
PoC: CVE-2019-0567
ChakraCore InitProto type confusion - PoC
PoC: CVE-2026-104711-POC---Brand-New
CVE-2026-104711 POC - Brand New
PoC: BLU_G35
A self-contained Linux kit for BLU G35 (Unisoc SC9863A): unlock the bootloader via the publicly documented CVE-2022-38694 BootROM method, insure first with three cross-verified backups, gate every write behind typed consent, and roll back to full box state. Security research — read the pinned issue before running anything.
PoC: CVE-2026-85097
For WordPress
PoC: CVE-2021-21413
CVE-2021-21413 isotaled-vm Sandbox Escape PoC
PoC: CVE-2026-110025
CVE-2026-110025: bilingual analysis and safe local PoC for phpwcms unrestricted upload to RCE
PoC: CVE-2026-108924
CVE-2026-108924: didactic PoC for Kirby dynamic option authorization bypass
PoC: factura-malware-analysis-lab
Malware analysis of a malicious RTF document exploiting CVE-2017-11882, done in a REMnux lab with static analysis and shellcode emulation.
PoC: Reflected-XSS-Bludit-CVE-2026-41456
Implementation of varios cross site scripting payloads to exploit CVE-2026-41456
PoC: tmog-rapl-gate
Let Task Manager TMOG read RAPL power on Linux only while it runs — no permanent udev grant (CVE-2020-8694)
PoC: CVE-2026-85884
CVE-85884 POC
PoC: CVE-2026-104935-Proof-of-concept
Unauthenticated remote code execution in Ivanti Connect Secure (CWE-290, CVSS 8.6)
PoC: CVE-2026-82957
SSRF in Hyperledger FireFly Webhook Subscriptions (CVE-2026-82957)
PoC: CVE-2026-76268
CVE-2026-76268 PoC: Splunk Enterprise SHC Patroni REST unauth RCE — PATCH /config archive_command + POST /restart. Check + mass exploit, OOB POCBIT-76268-OK, CVSS 9.8. https://pocbit.org/pocs/cve-2026-76268
PoC: CVE-2026-86086
Zephyr Project: under embargo until 2026-12-01
PoC: POC-for-CVE-2026-104711---New
POC for CVE-2026-104711 - New
PoC: CVE-2025-41450_poc
Code Of The Day
PoC: CVE-2026-102718
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length.
PoC: CVE-2026-102827
Command execution and patch bypass of CVE-2026-28291 in git-js.
PoC: telegram-account-takeover-poc
CVE-2026-107181 Proof Of Concept for telegram Desktop account take over in windows
PoC: CVE-2026-105950
Bilingual PoC and technical analysis for CVE-2026-105950 — Formwork formaction URI sanitizer bypass
PoC: POC-EXPLOIT-CVE-2026-104711
POC EXPLOIT CVE-2026-104711
PoC: CVE-2026-68582-PoC
PoC for CVE-2026-68582 / GHSA-rj9j-8772-4h6c — Vikunja link-share BOLA
PoC: pentest-kioptrix
Test d’intrusion sur Kioptrix Level 1 : exploitation d’une faille Apache/mod_ssl (OpenFuck, CVE-2002-0082) jusqu’à l’accès root, en environnement de laboratoire isolé.
PoC: dymo-id-cve-poc
PoCs for CVE-2026-102262 & CVE-2026-101893 — code execution and XXE in DYMO ID (reported & fixed)
PoC: pentest-metasploitable
Test d’intrusion sur Metasploitable 2 : exploitation de la backdoor vsftpd 2.3.4 (CVE-2011-2523) pour obtenir un accès root sans authentification.
PoC: CVE-2026-72898-metabase
CVE-2026-72898 Metabase Security Tools
PoC: CVE-2026-107159
MiniUPnPd <= 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header
PoC: CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE
CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE
PoC: CVE-2026-104711-Advanced-Variant
POC for CVE-2026-104711-Advanced-Variant
PoC: KDSExtract
Exploits CVE-2026-58222 to recover Samba KDS root keys and derive gMSA credentials from a low-privilege domain account.
PoC: CVE-2026-104711-exploit-payload-4
POC for the CVE-2026-104711 new variants
PoC: CVE-2026-104711-POC-Variant3
POC for the CVE-2026-104711 which is a new variant
PoC: CVE-2026-104711
POC for the CVE-2026-104711
PoC: CVE-2026-85097
POC CVE-2026-85097
PoC: CVE-2026-41992-poc
POC for the CVE-2026-41992
PoC: fromagegate
FROMAGEGATE — PoC + detection toolkit for Danfoss AK-SM 8xxA CVE-2025-41450/-41451/-41452 (code-of-the-day auth bypass, alarm-to-mail RCE, nginx config injection). For detection-signature development.
PoC: rails-doubletap-py
Automated Ruby on Rails doubletap RCE (CVE-2019-5418 + CVE-2019-5420) in pure Python, using the ERB#def_module gadget for modern Ruby.
PoC: CVE-2026-3888-PoC
CVE-2026-3888 PoC; discovered by the Qualys Threat Research Unit (TRU).
PoC: CVE-2025-32432-craftcms-rce
Working PoC + debugging writeup for CVE-2025-32432 (Craft CMS pre-auth RCE)
PoC: CVE-2026-84411-reproduction
CVE-2026-84411 root cause notes and a non-destructive probe (RouterOS before 7.24)
PoC: sonicwall-sma-1000-cve-2026-102255
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
PoC: smartermail
CVE-2026-104082, CVE-2026-104083, CVE-2026-104084
PoC: CVE-2026-91737
CVE-2026-91737 Chrome renderer RCE PoC (PDFium)
PoC: CVE-2026-102255
CVE-2026-102255 - Draft or TODO
PoC: CraftCMS-CVE-2026-79987
Authenticated RCE exploit for Craft CMS 5.9.0–5.10.12 (CVE-2026-79987). Time-based save-action oracle + raw-TCP exfil. Verified on vanilla lab.
PoC: kgsl-1905-msm8953
Research notes & harnesses: KGSL SVM use-after-free (CVE-2021-1905) on Qualcomm MSM8953 / Adreno 506 / kernel 3.18 armv7. Credits upstream patches and prior art.
PoC: CVE-2026-107692
Unencrypted JWT Transmission in War Thunder's Initial Client-Server Handshake
PoC: postgres-basebackup-symlink
PostgreSQL 18.6 - High - Remote - File write - pg_basebackup follows absolute tar symlink leftover of CVE-2026-6475
PoC: CVE-2026-103889
Proof of concept and isolated Docker lab for CVE-2026-103889, an unauthenticated RCE vulnerability in Expivi 3D Product Configurator for WooCommerce ≤ 2.16.2.
PoC: CVE-2026-9586_POC_EXPLOIT
For new CVEs without existing/working/non-mangled POCs
PoC: CVE-2026-91136
CVE-2026-91136 Divi Plus <= 2.4.0 unauthenticated arbitrary file read (mass scanner + exploit)
PoC: langflow-cve-2026-9198
Independent reconstruction, lab validation, and PoC for CVE-2026-9198, the Langflow unauthenticated RCE (fixed in 1.10.1)
PoC: metabase-cve-2026-72898
Independent reconstruction, lab validation, and PoC for CVE-2026-72898 — Metabase unauthenticated SQLi (patched in 0.63.5)
PoC: CVE-2026-15748
Unauthenticated RCE in WordPress Forminator Forms <= 1.56.1 (CVSS 9.8)
PoC: CVE-2026-104286-PoC
PoC CVE-2026-104286 FortiMail
PoC: ReactorWriteUp-HackTheBox
Reactor es una máquina Linux fácil vulnerable a CVE-2025-55182 (React2Shell), RCE sin autenticación en React Server Components. Accedemos como node, crackeamos un hash MD5 de una base de datos SQLite y pivotamos a engineer por SSH. La escalada abusa del flag --inspect de Node.js para ejecutar código como root vía depuración V8.
PoC: CVE-2026-105306
CVE-2026-105306: Token Introspection Audience Bypass via Dynamic Client Registration in Keycloak - Writeup by DungSoCool
PoC: GhostLock-Next
The next implementation of GhostLock CVE-2026-43499
PoC: ElasticRift
A vulnerable-by-design, secure-by-deployment NGINX pipeline centered around the aftermath of CVE-2026-42945 (NGINX Rift).
PoC: CVE-2026-27626
CVE-2026-27626 - OliveTin <3000.10.0 OS command injection via password-typed arguments, escalating to root when OliveTin runs as root.
PoC: Exploit-CVE-2026-40224
CVE-2026-40224: systemd-machined local privilege escalation
PoC: CVE-2026-41940-PoC
cPanel & WHM Authentication Bypass via CVE-2026-41940 explotation
PoC: CVE-2025-57819
FreePBX unauthenticated SQLi (endpoint module)
PoC: CVE-2026-43805
Binary diff analysis and non-destructive PoC for CVE-2026-43805
PoC: diskcache-community
Community-maintained hard fork of grantjenks/python-diskcache: SQLite-backed persistent cache for Python, with a fix path for CVE-2025-69872
PoC: CVE-2026-108592-poc
CVE-2026-108592 — Environment Variable Exposure PoC in mini-swe-agent
PoC: odin-od105-devkit
CVE-2019-2215 temporary root toolkit for Smartisan Nut Pro (OD105)
PoC: CVE-2026-84568
Reproducible macOS automountd research and lab PoCs for CVE-2026-84568 and CVE-2026-84570: fstype path traversal, NFS payload delivery, Gatekeeper behavior, and root code execution.
PoC: cs50-cybersecurity-final-project
Technical analysis of Log4Shell (CVE-2021-44228) for CS50 Cybersecurity.
PoC: CVE-2026-84411
CVE-2026-84411 — MikroTik RouterOS WebFig Integer Underflow Exploit
PoC: CVE-2025-9548
CVE-2025-9548: Lenovo Power Management Driver null-pointer dereference research and gated PoC
PoC: CVE-2026-69414
**CVE-2026-69414** is an elevation of privilege vulnerability in the **Microsoft Malware Protection Engine** (part of Windows Defender / Microsoft Defender Antivirus), publicly referred to as **"RoguePlanet"**. It represents a **patch bypass** of the original vulnerability **CVE-2026-50656**.
PoC: CVE-2026-103690
SQL injection (CWE-89) in itsourcecode Leave Management System 1.0 - CVE-2026-103690 / VulDB VDB-412559
PoC: CVE-2026-102428
CVE-2026-102428 PoC: OrdaSoft Joomla OS CCK (com_os_cck) <=8.3.15 unauth SQLi — order_field/order_direction ORDER BY injection on public listings. Check + mass exploit, POCBIT-102428-OK marker, CVSS 9.3. https://pocbit.org/pocs/cve-2026-102428
PoC: CVE-2026-106445
CVE-2026-106445 — Handlebars 4.0.0–4.7.9 RCE via Function.prototype.constructor bypass (GHSA-p8wg-vrv2-v86f). PoCbit PoC + Docker lab (4.7.9), check/exploit HTTP client, GHSA template chain. Fixed 4.7.10. https://pocbit.org/pocs/cve-2026-106445
PoC: CVE-2026-107806
CVE-2026-107806 — nginx-ui 2.3.8–2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET /api/backup, tamper app.ini, POST /api/restore, POST /api/nginx/test. check/exploit, batch url|JWT. Fixed 2.5.0. https://pocbit.org/pocs/cve-2026-107806
PoC: ModelSim-Decryptor
CVE-2021-42023
PoC: CVE-2026-94503
Zombify <= 1.7.7 Unauthenticated Arbitrary File Upload
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free