`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`. Because this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service. Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed. ## Proof of concept ```rust fn main() { let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog let _ = lopdf::Document::load_mem(&bytes); // stack overflow -> SIGABRT } ``` An equivalent PoC is a minimal PDF whose Catalog `/X` value is `"[" * 10380 + "]" * 10380`. ## Suggested fix Enforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.
PoC: plz110-6.12.69-cve-2026-64560-ksu
一加 15T（PLZ110）临时 root + KernelSU per-boot 接管：CVE-2026-64560 移植，不写分区、重启即失效。内核 6.12.69-android16-6-g242e1a07f878。
PoC: CVE-2026-96889-nextjs-rce
Lab PoC for CVE-2026-96889: Next.js Image Optimization SVG typed as AVIF reaches librsvg UAF (RUSTSEC-2026-0305). Unauthenticated RCE on glibc Linux.
PoC: CVE-2026-89079
CVE-2026-89079 — WordPress Theme My Login multisite unauth password overwrite PoC (check, verify, exploit). Not version-only: requires MS + tml_user_passwords.
PoC: Gitlab-RCE-CVE-2026-97229
CVE-2026-97229: GitLab RCE Unauthenticated via CI Lint
PoC: vivo-dirtyfrag-root
Temporary root on locked-bootloader vivo devices (tested: S17 Pro / PD2284 / MT6896Z / 5.10.233) without wiping data. Root cause: vivo prepends "vivo " to MODULE_ARCH_VERMAGIC, so every prebuilt arm64 kernel module is rejected by insmod. Includes a patch script + a quantified refutation of GhostLock (CVE-2026-43499).
PoC: CVE-2026-110912
CVE-2026-110912
PoC: CVE-2020-25213-exploit
Exploit para explotar la vulnerabilidad CVE-2020-25213 en WPFileManager < 6.9
PoC: vghost-watch
Passive internet-wide discovery + responsible-disclosure helper for CVE-2026-74580 (Linux vhost metadata-cache bug) — queries existing scan data (Sonar/Shodan/Censys), triages exposure, and drafts (never auto-sends) notices to owners.
PoC: CVE-2026-53995-mlflow-path-traversal
MLflow <=3.17.1 path traversal allows trace file writes outside the intended directory.
PoC: mikrotrick-verifier
Non-destructive behavioral verifier for the MikroTik RouterOS SSH auth-bypass (CVE-2026-67279 / MikroTrick). Measures server reaction only — no exploit payload.
PoC: apache_poc
CVE-2024-38475
PoC: CVE-2026-38838
Path traversal (CWE-22) in the Akai MPC Sample built-in web server CVE-2026-38838
PoC: Vulnerability-Analysis-and-Mitigation
Vulnerability analysis, exploitation, and multi-layered defense hardening for Apache Struts 2 (CVE-2017-5638) & Windows Print Spooler / PrintNightmare (CVE-2021-34527) with ELK SIEM monitoring and Windows Event Log auditing.
PoC: CVE-2026-94169
WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability
PoC: cve-2026-97229-lab
CVE-2026-97229 GitLab CI lint regex integer overflow RCE — InstaBox version matrix reproduction & libruby gadget reverse engineering
PoC: mcp-oauth-discovery-prober
Probe MCP OAuth discovery issuer validation (CVE-2026-104850 class)
PoC: CVE-2026-111437-Denial-of-Service-Advisory-Technical-Report
Official security advisory and technical report for CVE-2026-111437: CPU resource exhaustion and Denial of Service (DoS) in django-import-export (v2.7.0 to v4.4.1) via unvalidated integer conversion in IntegerWidget.clean()
PoC: CVE-2024-32507
CVE-2024-32507: login-with-phone-number Unauthenticated Password Reset (Account Takeover)
PoC: cve-2026-64560-rmx6699
CVE-2026-64560 temporary-root exploit for realme RMX6699 (Snapdragon 8 Elite, kernel 6.6.118, Android 17/COOS17)
PoC: prague-CVE-2026-64560-OS4.0
REDMI K90 Max在OS4.0.0.14.XAACNXM利用CVE-2026-64560获取ROOT权限。
PoC: CVE-2026-111823
PoC for CVE-2026-111823 — Mage AI OAuth session auth bypass (POST /api/sessions). Check + exploit modes. Authorized testing only.
PoC: cve-2026-99999-audit
cve-2026-99999-audit script (PwnEscape)
PoC: pmx110-cve-2026-64560
PMX110 (OPPO MT6995, kernel 6.18.21) CVE-2026-64560 research: port, evidence, bounded run scripts
PoC: CVE-2026-99999
PoC for CVE-2026-99999 (PwnEscape) on a prepared TAP.
PoC: CVE-2026-89282
CVE-2026-89282: Apache Lounge Windows DLL Search Order Hijack → SYSTEM LPE PoC
PoC: CVE-2026-27280
Write up and PoC for CVE-2026-27280
PoC: cve-2025-54068-vuln-intel
Inteligencia de vulnerabilidade sobre o RCE no Laravel Livewire: CVSS v4 do zero e priorizacao com EPSS/KEV.
PoC: hlk-al00-kernel-build
HLK-AL00 (4.14.116 / Kirin 810) 内核云编译 — CVE-2026-43499 授权安全研究
PoC: cybersecurity
Projet de Cybersécurité (TP1 à TP9) Recherche réseau (Nmap, Scapy) • Attaques DDoS (hping3) • Force brute (Hydra, LaZagne) • Ingénierie sociale (Zphisher, Gophish) • Sécurité Wi-Fi (Airgeddon, Aircrack-ng) • Malwares (msfvenom) • Injection de code (Shellter) • MITM (Ettercap, Yersinia) • Vulnérabilités (CVE-2026-96889).
PoC: CVE-2026-107084
CSRF in SLiMS 9.8.0 loan history maintenance allowing unauthorized data loss (TRUNCATE). CVE-2026-107084.
PoC: CVE-2026-107083
SQL Injection via unquoted numeric concatenation in SLiMS 9.8.0 admin modules (subscription.php & dl_detail.php). CVE-2026-107083.
PoC: qemu-xhci-complete-uaf
QEMU 11.1.2 - High - Local - UAF - xhci_complete leftover of CVE-2026-17588 doorbell DMA
PoC: CVE-2026-107082
SQL Injection via opac_hide / promoted GET parameters in SLiMS 9.8.0 admin bibliography module. CVE-2026-107082.
PoC: qemu-nvme-sgl-bar
QEMU 11.1.2 - High - Local - UAF - NVMe SGL span into BAR0 incomplete CVE-2021-3929
PoC: cve-2026-111283-bmc-helix-network-management-local-administrator-any-password
CVE-2026-111283 - BMC Helix Network Management Local Administrator Account Accepts Any Password
PoC: CVE-2026-59970-poc
PoC for CVE-2026-59970 Blind SSRF in Tandoor Recipes, CWE-918
PoC: CVE-2026-31431-Copy-Fail
CVE-2026-31431 Exploit | by infrar3d
PoC: CVE-2014-6271-Shellshock
CVE-2014-6271 Exploit | by infrar3d
PoC: CVE-2025-55182-React2Shell
CVE-2025-55182 Exploit | by infrar3d
PoC: CVE-2026-38526-KrayinCRM-RCE
CVE-2026-38526 Exploit | by infrar3d
PoC: CVE-2026-33017-Langflow-RCE
CVE-2026-33017 Exploit | by infrar3d
PoC: CVE-2026-39987-Marimo-RCE
CVE-2026-39987 Exploit | by infrar3d
PoC: infosec-audit-tools
Ferramentas de auditoria em segurança da informação, reconhecimento de superfície com RDAP/DNS e análise defensiva web (CVE-2024-10924).
PoC: CVE-2026-102764-Proof-of-concept
CVE-2026-102764 BeyondTrust Remote Support unauthenticated file write / RCE proof of concept
PoC: sharepoint-zero-day-cs50-cybersecurity
CS50 Cybersecurity Final Project - Analysis of CVE-2025-53770 SharePoint Zero-Day Attacks
PoC: csumguard
Restricted eBPF TC ingress guard, CO-RE detector, verified loader, and C11 VMM launch supervisor for CVE-2026-99999
PoC: plex2shell
CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
PoC: CVE-2026-92209_NoMachine_LPE
CVE-2026-92209
PoC: CVE-2026-92208_remote_mDNS_overflow
CVE-2026-92208
PoC: POC-CVE-2026-94134
Exploitation POC for CVE-2026-94134
PoC: CVE-2026-79986
Reproducer for CVE-2026-79986 (Apache Camel camel-azure-files): the consumer builds the remote path from the share listing without containment (author-only; see CVE-2026-79983/79984 for the runnable mechanism) — Camel Spring Boot + Camel Quarkus
PoC: redcap_cve_2026_90817_scan
A read-only, passive scanner that checks a REDCap host for exposure to and compromise by **CVE-2026-90817** — the unauthenticated survey-endpoint remote-code-execution flaw abused by the XMRig cryptomining campaign documented by Palo Alto Unit 42
PoC: CVE-2026-79985
Reproducer for CVE-2026-79985 (Apache Camel camel-smb): the SMB consumer builds the remote path from the share listing without containment (author-only; see CVE-2026-79983/79984 for the runnable mechanism) — Camel Spring Boot + Camel Quarkus
PoC: CVE-2026-79984
Reproducer for CVE-2026-79984 (Apache Camel camel-mina-sftp): the consumer builds the remote path from the server's SFTP directory listing without containment, escaping the polled directory — Camel Spring Boot + Camel Quarkus
PoC: exiftool-7.44-12.23-exploit-CVE-2021-22204-
ExifToolExploit CVE-2021-22204 \\ Arbitrary Code Execution
PoC: CVE-2026-79983
Reproducer for CVE-2026-79983 (Apache Camel camel-ftp): the consumer builds the remote path from the server's directory listing without containment, escaping the polled directory — Camel Spring Boot + Camel Quarkus
PoC: GhostLock-HonorFne
Honor 70 (FNE-AN00) privilege escalation PoC: GhostLock (CVE-2026-43499) + custom KernelSU module loading
PoC: CVE-2026-78165
Reproducer for CVE-2026-78165 (Apache Camel camel-spring-redis): default JdkSerializationRedisSerializer deserializes Redis PUBLISH payloads with no ObjectInputFilter (RCE) — Camel Spring Boot + Camel Quarkus
PoC: CVE-2026-78164
Reproducer for CVE-2026-78164 (Apache Camel HTTP producers): property placeholders resolved on the message-supplied CamelHttpUri/CamelRestHttpUri headers leak secrets into the outbound request — Camel Spring Boot + Camel Quarkus
PoC: CVE-2026-51367-Insecure-Direct-Object-Reference-IDOR
Security advisory — Insecure Direct Object Reference (IDOR / BOLA) in Vedo Suite (Bottinelli Informatica). Responsible disclosure.
PoC: CVE-2026-51366-SQL-Injection-leading-to-Remote-Code-Execution
Security advisory — SQL Injection leading to RCE in Vedo Suite (Bottinelli Informatica). Responsible disclosure.
PoC: CVE-2026-78163
Reproducer for CVE-2026-78163 (Apache Camel camel-docling): unvalidated String body input source enables SSRF and local file disclosure in DoclingProducer — Camel Spring Boot + Camel Quarkus
PoC: CVE-2026-78162
Reproducer for CVE-2026-78162 (Apache Camel camel-hazelcast): ReplicatedHazelcastAggregationRepository starts a Hazelcast member with no Java deserialization filter — Camel Spring Boot + Camel Quarkus
PoC: magicpad3-root-research
荣耀 MagicPad3 (CGA-W00) 运行时 KernelSU Root 研究 —— 全自动提权循环 · 二进制补丁增强 · 社区方案深度逆向 | Runtime KernelSU root research (CVE-2026-43499)
PoC: CVE-2026-104745
CVE-2026-104745 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0.
PoC: CVE-2026-111444
Wheels SQL injection on MySQL/MariaDB with backslash escaping enabled
PoC: CVE-2026-111389
Frappe HRMS missing input validation SQL injection vulnerability
PoC: GlyphGuard
🔥 GlyphGuard — Lightweight Unicode Homoglyph & Invisible-Character Security Audit Engine | 轻量级 Unicode 同形字与不可见字符安全审计引擎 — Zero Dependencies, Trojan Source (CVE-2021-42574) Detection, Skeleton Mapping, CI Gate, Cross-Platform.
PoC: VsockDrop-Adapted-CVE-2026-53365
A slightly more robust version of MaherAzzouzi's POC, created by my agent on the fly during testing.
PoC: CVE-2026-64507
CVE-2026-64507 — PoC: IBPB flush on BPF JIT allocation
PoC: CVE-2026-104715
CVE-2026-104715: cifs-utils credentials-file option injection (local root)
PoC: CVE-2026-18963-PoC
Proof of concept and vulnerability checker for CVE-2026-18963, an unauthenticated account takeover in the Keycloak reset-credentials flow. Single-file Python, optional Playwright browser component.
PoC: blindllama-cve-2026-102697
BlindLlama: CVE-2026-102697 Reproduction
PoC: wp2shell-PoC
CVE-2026-63030 + CVE-2026-60137 exploit RCE chain.
PoC: Driftnet
CTF writeup: rooting a Linux box via CVE-2024-23334 (directory traversal) and CVE-2025-32463 (sudo privilege escalation)
PoC: CVE-2026-108578
Neterbit NW-431F unauthenticated SMS disclosure
PoC: CVE-2026-108097
Defensive, non-exploit detector for CVE-2026-108097 (SA-CORE-2026-014) — Drupal core Field UI RCE
PoC: cve-2026-110447-checker
Free CLI: check a Nextcloud instance for CVE-2026-110447 exposure. Stdlib only, honest verdicts. By Ingenious AI.
PoC: CVE-2026-85097
CVE-2026-85097 — Bricksforge <= 3.1.8.9 unauth file upload to RCE. GIF/PHP polyglot + temporaryFileUploads.url mismatch. python3 exploit.py --url http://TARGET
PoC: cve-2026-77521-lab
Benign, self-contained reproduction of CVE-2026-77521 (MaxKB prompt-injectable command execution)
PoC: CVE-2026-18963-PoC
Proof of concept and vulnerability checker for CVE-2026-18963, the Keycloak reset-credentials flow bypass
PoC: Lenovo_Qcom_RPMB_Tool
Educational proof-of-concept (PoC) research tool demonstrating CVE-2026-24090 ABL verification bypass to inspect and test Qualcomm Keymaster RPMB state on Lenovo devices.
PoC: ghostlock-brt-w09
⚠️ NOT SUCCESSFUL - GhostLock (CVE-2026-43499) adaptation attempt for Honor Pad V8 (BRT-W09 / MediaTek MT8797 / kernel 4.14.186+). Verified offsets + why KernelSnitch fails on 4.14.
PoC: cve-2025-66645
NiceGUI Path Traversal CTF Challenge
PoC: CVE-2026-20896-Gitea-CTF
CVE-2026-20896 Gitea Docker CTF Challenge
PoC: CVE-2026-12118-POC-
CVE-2026-12118 POC
PoC: CVE-2026-110912
A PoC for CVE-2026-110912 'arpbleed'
PoC: CVE-2026-104711-POC-NEW-VARIANT
POC for the CVE-2026-104711 - New Variant
PoC: CVE-2026-47644
CVE-2026-47644 ($12,000): Edge Copilot Prompt Injection Leads to Cross-Tab Data Exfiltration - PoC & full writeup
PoC: CVE-2026-108598
Unauthenticated RCE via Velocity Template Language (VTL) injection in Floci API Gateway mapping templates (versions 1.1.0–2.2.0). CVSS 9.8 Critical.
PoC: MOcha
CVE-2023-41991 vulnerability exploitation
PoC: CVE-vulnerability
CVE-2026-0322
PoC: ivanti-cve-2026-104935-check
Detection-only check for the Ivanti Connect Secure authentication bypass (CVE-2026-104935)
PoC: microsoft-security-advisory-cv
Autonomous submission for "Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability" (MSRC / GitHub Security Advisory)
PoC: CVE-2026-107081
SQL Injection via identifier injection in SLiMS 9.8.0 admin AJAX endpoints (tableName/tableFields). Any authenticated staff can dump password hashes.
PoC: CVE-2021-4034
CVE-2021-4034 (PwnKit) - Python PoC
PoC: CVE-2026-76519-POC
Unauthenticated remote code execution on Cisco Secure Email Gateway via crafted email attachment. Path traversal in AMP File Reputation handling allows arbitrary file write as root when the service is enabled on a mail policy.
PoC: CVE-2026-109506
Technical writeup of CVE-2026-109506, a vulnerability I found in multiple TP-Link Wi-Fi Range Extenders
PoC: CVE-2026-104748
CVE-2026-104748 POC
PoC: DirtyFrag
DirtyFrag (CVE-2026-43284) pro Galaxy A57 5G (SM-A576B, A576BXXS6AZI2): gatilho libbase pro One UI 8.5 + dfroot.ko compilado exato pro 6.12.38-android16-5 do aparelho
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free