## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2v2p-6j97-cjg9. This link is maintained to preserve external references. ## Original Description vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process.
PoC: AVETemporalPoC-CVE-2026-112705
PoC & panic evidence for CVE-2026-112705: AppleAVE2 kernel OOB write on iOS 27.0.1 (fixed in 27.2) via VideoToolbox NumberOfTemporalLayers. Independent reproduction; original discovery by Calif / Chollima team.
PoC: GhostLock-CVE-2026-98260
基于ghostlock-app与CVE-2026-98260漏洞开发的提权项目
PoC: cve-2020-5902
by yora cve-2020-5902
PoC: CVE-2021-3156
Baron Samedit (CVE-2021-3156): sudo heap-based buffer overflow giving local root. PoC packaged with a static/musl launcher so it runs against older-glibc (2.31) targets.
PoC: php-secure-patch
Bash toolkit that finds and fixes PHP CVEs — PHP2Shell (CVE-2026-109618/109619), CVE-2026-115560, CVE-2024-4577, CVE-2019-11043 — on Linux and macOS. Detects runtimes, audits config, applies source patches, hardens php.ini / FPM / nginx / Apache, hunts compromise, rolls back cleanly. MIT.
PoC: CVE-2026-98260-IQOO-13
Temporary root for the Vivo iQOO 13 via CVE-2026-98260 posix-cpu-timer UAF, with KernelSU and FinaSU late-load
PoC: CVE-2026-98432-POC
Toy project
PoC: Probe-CVE-2026-98432
Local kernel version checker, remote MPTCP capability probe, and interactive scan-and-probe CLI for assessing exposure to the Linux kernel IPv4 TCP use-after-free (CVSS 9.8).
PoC: CVE-2026-115965
CVE-2026-115965
PoC: PROTECTION2Shell
Dependency-free toolkit that contains, patches and verifies the *2Shell families: PHP2Shell (CVE-2026-109618/109619), HTTP2Shell/Brotli (CVE-2026-111497), CVE-2024-4577, CVE-2019-11043. Cuts exploitation channels at the edge in minutes, applies verified upstream source patches, recycles workers, then re-checks every fix. Unattended: setup.sh --auto
PoC: wsftp-server-scanner
Detection-only local triage scanner for Progress WS_FTP Server October 2026 patch batch: CVE-2026-84295 (CVSS 10.0) and 14 more, graded per group against the split 2024.0.6/2025.0.3 vs 2024.0.7/2025.0.4 fix table. No payloads, no remote probing.
PoC: CVE-2026-116521-poc
CVE-2026-116521-poc
PoC: php2shell-2026-incident-analysis
Independent technical analysis of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), covering root cause, disclosure, honeypot evidence, business risk, open-source security governance, and PHP ecosystem resilience.
PoC: CVE-2026-88773
CVE-2026-88773 - NetScaler nsppe 32-bit chunk-size accumulator wrap (HTTP Request Smuggling)
PoC: factorytalk-assetcentre-rce
Research PoC for FactoryTalk AssetCentre HTTP Remoting RCE (CVE-2021-27460 and CVE-2021-27466)
PoC: php-patch-check
Check whether a PHP version is patched against PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Stdlib-only Python.
PoC: php2shell-lab-verification
Defensive lab verification & IR note for php2shell (CVE-2026-109618 / CVE-2026-109619) — patch matrix, mitigation, hunt one-liners. No PoC.
PoC: cve-2026-18649
GStreamer RTP Depayloader Memory Exhaustion Analysis
PoC: WapGuard
Tiny Shizuku app that clears stuck 'SMS of Death' (CVE-2026-58882) WAP Push messages. Material 3 Expressive.
PoC: CVE-2026-112487
macOS revisiond local privilege escalation to root (CVE-2026-112487)
PoC: CVE-2026-120218
CVE-2026-120218: bilingual TypeMill stored XSS analysis and safe SVG/XSLT PoC
PoC: CVE-2026-98432
PoC for CVE-2026-98432 (Linux kernel IPv4 TCP inet_opt/ireq_opt use-after-free, CVSS 9.8): KASAN-verified UAF reproduction in inet_csk_route_req with A/B fixed-kernel control
PoC: debian-cve-2026-98432-fix
One-click kernel security update for CVE-2026-98432 on Debian 12/13.
PoC: CVE-2026-103039
CVE-2026-103039: Gravity Forms <= 3.1.2 PHP object injection to RCE. PoC by NOXCRYPT (noxcrypt-x). gen_payload.php is not included.
PoC: php2shell-ubuntu
Analisa e corrige as vulnerabilidades php2shell do PHP (CVE-2026-109618 e CVE-2026-109619) no Ubuntu
PoC: whatsapp-valleyrat-analysis
WhatsApp-delivered Winos 4.0 / ValleyRAT stager: DLL sideloading, BYOVD Defender kill (CVE-2026-36425), custom C2 protocol on TCP 443, and previously unreported C2 infrastructure.
PoC: CVE-2026-111585
CVE-2026-111585 — TeamViewer Remote-Control Screen Decompression Integer Overflow → Heap Buffer Overflow (PoC, fixed in 15.83, CVSS 8.8). Containerized lab + one-command repro with vulnerable/fixed differential evidence.
PoC: plr110-6.12.38-cve-2026-64560-ksu
Use cve-2026-64560 to root OneOlus ACE 6T
PoC: cve-2026-98432-ebpf
eBPF (XDP/tc) mitigation for CVE-2026-98432 / RHSB-2026-016 - untested draft
PoC: SG-2026-0037
CVE-2026-54523 Kyverno cross-namespace resource generation PoC and exploit
PoC: motogstylus2023-root
Root exploit for Motorola Moto G Stylus 5G 2023 (genevn) via GhostLock (CVE-2026-43499) — locked bootloader, no flashing
PoC: cve-2026-98432-ubuntu-mitigation
Check an Ubuntu host for CVE-2026-98432 and, after you confirm, apply the interim Red Hat RHSB-2026-016 mitigation. Ubuntu 20.04 to 26.10.
PoC: cve-2026-98432-nft-mitigation
Interim nftables mitigation for Linux kernel CVE-2026-98432 (IPv4-options UAF in tcp_v4_syn_recv_sock) as a reproducible agent skill
PoC: php-7.4-cve-2026-docker
PHP 7.4.33 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libraries. Documented builds, source and patch checksums, focused regression tests, Trivy reports, and non-root defaults. Linux amd64. UNVERIFIED development preview; independent mysqlnd review remains incomplete.
PoC: cve-2026-98432
Stopgap firewall mitigation for CVE-2026-98432 on Ubuntu 16.04/24.04
PoC: quarkus-brotli-audit
Audit statique de l'exposition d'une application Quarkus au décodeur Brotli vulnérable (CVE-2026-111497). Généré avec Claude Code.
PoC: Samba_Fruit_Vuln
CVE-2021-44142 — Samba vfs_fruit heap OOB read/write lab demo (educational)
PoC: CVE-2026-101767
Unauthenticated SQL injection (CVSS 9.8) in the Oracle EBS 12.2.312.2.15 TCF servlet
PoC: php-8.1-cve-2026-docker
PHP 8.1.34 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libraries. Documented builds, source and patch checksums, focused regression tests, Trivy reports, and non-root defaults. Linux amd64. UNVERIFIED development preview; independent mysqlnd review remains incomplete.
PoC: CVE-2026-63686
CVE-2026-63686 demo
PoC: CVE-2026-100105
Grafana alerting contact point authorization bypass via schema downgrade (CVSS 7.7) — containerized lab, full PoC, plus 2 unreported findings reproducible on 13.2.5
PoC: synipopt
IPv4 SYN with IP options, one lab target per run, for CVE-2026-98432 research. Header-offset parser, regression tests, and a postmortem of a broken auto-exploiter.
PoC: CVE-2026-116244
pgAdmin 4 server mode: libpq answers GSSAPI with the service account's Kerberos credentials (CVE-2026-116244, fixed in v9.19) — containerized lab + PoC
PoC: CVE-2026-116366
PoC for CVE-2026-116366 — ClickHouse Server unauthenticated RCE (brotli v1.2.0 decoder out-of-bounds write): differential detector, weaponized DoS, containerized vulnerable-vs-fixed lab, root-cause analysis
PoC: cve-2026-98432-guard
Temporary mitigation for CVE-2026-98432 on AlmaLinux 8/9/10 and Ubuntu. Not a kernel fix.
PoC: php2shell-lab
Isolated Docker lab for studying PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.
PoC: fragnesia-scanner
Detection-only local triage scanner for Linux kernel Fragnesia CVE-2026-46300: grade a running or installed kernel against upstream and distro fixed builds. No payloads, no network.
PoC: ddld36-solar-aegis
⛩️☀️ Zero-cost Cloudflare Edge Defense (CVE-2026-109618) + HTTP x402 AI Crawler Monetization. Earn 20% USDC. Landauer Thermodynamics on Base L2.
PoC: CVE-2012-0002
PoC de exploração do CVE-2012-0002 em equipamentos legados com SO já não suportados.
PoC: TryHackMe-OverlayFS---CVE-2021-3493
Here, We go
PoC: CVE-pipeshub
CVE-2026-119712 (CVSS 8.5 High) — PipesHub < 0.10.0 SSRF via image URLs in indexed documents (CWE-918). Verified PoC.
PoC: cve-2026-98432
Detector and local lab for CVE-2026-98432 (IPv4 TCP UAF in inet_opt/ireq_opt): static analysis, kprobes, the tcp2kaslr trigger vector, and remote-risk evidence. Not an exploit; no RCE.
PoC: pillow-patched-brotli
Pillow 13.0.0 wheel rebuilt with Brotli 1.2.1 for CVE-2026-111497, until Pillow 13.1.0 ships
PoC: fix_CVE-2026-98432
Ansible playbook to mitigate CVE-2026-98432
PoC: qt-t-shield
QT Analytics — Operation Fire Pole: Free 60-Second Emergency Defense & Reverse-Proxy Shield for PHP2Shell (CVE-2026-109618 / 109619)
PoC: whichphp
Is the PHP in your container image really fixed for PHP2Shell (CVE-2026-109618, CVE-2026-109619)? Finds every PHP build without running the image, with backport-aware verdicts and evidence.
PoC: CVE-2026-118776
Advisory for node-forge ⌯⌲ 53 mill weekly downloads
PoC: CVE-2026-103688
CVE-2026-103688: Checkout Files Upload for WooCommerce < 2.4.0 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).
PoC: CVE-2026-109384
CVE-2026-109384: IvyForms <= 1.5.1 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).
PoC: cve-2026-98432-mitigation
Interim nftables mitigation for CVE-2026-98432, automatic rollback and Russian administrator guide. Not a kernel patch.
PoC: ntu-se6013-nextjs-auth-bypass
NTU SE6013 Software Security: Next.js CVE-2025-29927 group project. Maintainer-reviewed fork-and-PR contributions.
PoC: cve-2026-98432-validation-mitigation
Read-only patch-state and exposure check for CVE-2026-98432 (Linux kernel IPv4 TCP use-after-free, CVSS 9.8), with opt-in interim mitigation and exact rollback.
PoC: CVE-2023-43364
Exploit for CVE-2023-43364 | Searchor <2.4.2 - Arbitrary Code Execution
PoC: hidra
Hidra - A12 / iOS 18.7.2 jailbreak research. Kernel entry via AppleJPEGDriver CVE-2026-20687. No public build yet.
PoC: tcp2kaslr
CVE-2026-98432: a plain IPv4 TCP server is vulnerable, MPTCP is not the trigger. Bug trigger, evidence and analysis.
PoC: project2026_20261030_tokengate
Un fichier PHP, zéro dépendance : dit si laravel/framework est encore sous le correctif TokenGuard (CVE-2026-114509). Aucun exploit, aucun réseau.
PoC: php2shell-research-portfolio
PHP2Shell CVE-2026-109618 and CVE-2026-109619 research and isolated RCE lab
PoC: CVE-2026-104623
PoC and Docker lab for CVE-2026-104623 — SUSE Rancher Manager local-cluster-shell authorization bypass: any authenticated user spawns a shell pod on the management cluster via alternate request forms that dodge the authorization gate. Validated end-to-end on rancher 2.15.2 (vulnerable) vs 2.15.3 (patched).
PoC: CVE-2026-106378
CVE-2026-106378 is a privilege escalation in the Google Chrome sandbox on macOS. An attacker who has already compromised the renderer process can execute arbitrary code **outside the sandbox** via a crafted HTML page.
PoC: cve-2026-6516-scanner
Find ADAudit Plus web servers in nmap output and triage CVE-2026-6516 (pre-auth RCE) in a single dependency-free Python file.
PoC: CVE-aisoc
CVE-2026-103056 (CVSS 4.0 9.4 Critical) — AiSOC < 12.0.0 OS command injection into CrowdStrike RTR command strings. Verified standalone PoC.
PoC: cve-2025-14847-scanner
Unauthenticated MongoDB enumeration, compression enumeration and CVE-2025-14847 triage in a single dependency-free Python file.
PoC: CVE-rapyd-admin
CVE-2026-109566 (CVSS 9.8) — Rapyd Admin 9.0.0 < 9.20.0 hard-coded super-admin credentials via AuthSeeder (admin@laravel / admin). Standalone exploit PoC.
PoC: cve-2026-98432
Proof-only PoC for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free): race trigger, heap-reuse oracle, no code execution
PoC: CVE-2025-31277-WebKit-Memory-Corruption-Patch-Bypass
Bypass of the official patch for CVE-2025-31277 (WebKit memory corruption). Allows triggering the original issue on patched Safari / iOS / macOS builds through a modified trigger path.
PoC: ubuntu-noble-tcp-rcu-backport
Ubuntu Noble backport and regression evidence for the upstream CVE-2026-98432 IPv4 RCU lifetime repair
PoC: php2shell
PHP file-upload / code-exec toolkit → shell + PHP2Shell CVE-2026-109618/109619 modules
PoC: netprobe-cve-2026-98432
You should patch, but not worry about CVE-2026-98432
PoC: CVE-2026-38751-exploit
Python version of b0ySie7e/OpenSTAManager-RCE-Exploit-CVE-2026-38751 a rust-based POC
PoC: cs-build
ClearSword cloud build (iOS kernel exploit PoC, CVE-2025-43520)
PoC: php2shell-emergency
PHP脆弱性（PHP2Shell: CVE-2026-109618 / CVE-2026-109619）緊急対応プランのランディングページ
PoC: bash2shell
Joke CVE advisory for Bash2Shell (CVE-2026-1337).
PoC: CVE-2026-98432-PoC-Exploit
CVE-2026-98432 ( Linux IPv4 TCP use-after-free toolkit. Detect kernel exposure, trigger the race, analyze captures, recover KASLR slides, and lock down hosts. Single command, zero setup, standard library only. Built for real-world authorized security testing.
PoC: CVE-2026-114625-Proof-Of-Concept
VeloCloud Orchestrator session elevation + unsanitized diagnostics RCE
PoC: CVE-2026-112621-oob-write-poc
This is a fork of vinaykumar´s poc for CVE-2026-112621. This is for educational purposes only. I am only using this to host the website so that I can try the poc
PoC: CVE-2026-48500
CVE-2026-48500
PoC: CVE-2026-29000-jweforge
Educational PoC for an alg:none signature-bypass class in JWE-wrapped JWTs (pac4j-jwt)
PoC: CVE-2026-111497-Node2Shell
CVE-2026-111497 - Node2Shell / HTTP2Shell
PoC: cve-2026-98432-ubuntu-analisis
Analisis dan panduan remediasi CVE-2026-98432 untuk Ubuntu 22.04 LTS
PoC: cve-2026-98432-ubuntu-backport
Source-validated Ubuntu 6.8 backport candidate for Eric Dumazet’s upstream CVE-2026-98432 fix, with provenance and CI. Not yet compiled or boot-tested.
PoC: CVE-2026-116191
Offline Python detector for Rclone version exposure to CVE-2026-116191.
PoC: synology-dsm-vuln-scanner
Detection-only vulnerability scanner for Synology DSM — CVE-2024-10441 (SA-24:20, ransomware-exploited) and CVE-2026-13684/13639 (SA-26:13). Read-only fingerprinting, no exploits. Python 3.9+, zero dependencies.
PoC: CVE-2026-116165
Offline Python detector for CVE-2026-116165 using Parse Server versions and database backend inventory.
PoC: CVE-2026-114820
Offline Python inventory detector for Oracle Java and GraalVM builds affected by CVE-2026-114820.
PoC: php2shell-detections
Suricata rules + CI-proven regression suite for the php2shell PHP RCE chain (CVE-2026-109619 / CVE-2026-109618)
PoC: CVE-2026-117184
Unauthenticated Denial of Service (DoS) via GraphQL alias overloading in Traggo server v0.8.3. Pins CPU and exhausts memory without requiring authentication. CVE-2026-117184.
PoC: CVE-2026-117183
Build-time RCE via FeaturedImage path traversal in astro-notion-blog 0.13.0. Allows attackers with Notion edit access to overwrite files and execute commands on the build host. CVE-2026-117183.
PoC: CVE-2026-117182
Authenticated Stored XSS via SafeUrlValidator bypass on the rich-text render path in Spina CMS (<= 2.21.0). Payload executes on the public site. CVE-2026-117182.
PoC: CVE-2026-112705-poc
Crash-only public-API reproducer for CVE-2026-112705 in AVEVideoEncoder
PoC: CVE-2026-98260-vivo-s60-poc
CVE 2026 98260 vivo s60 poc
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free