gree/jose - "None" Algorithm treated as valid in tokens

PoC: mikrotrick-poc

CVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC

PoC: xiaomi15-dada-cve-2026-64560

Device-bound CVE-2026-64560 adaptation for Xiaomi 15 dada OS4.0.0.8

PoC: cve-2026-32475-elementor-pro-lab

A/B Docker lab + PoC for CVE-2026-32475 (Elementor Pro Forms unauthenticated arbitrary file upload -> RCE via validation/move loop desync)

PoC: CVE-2026-28576-poc

SQL injection vulnerability in Android 17 (AOSP)

PoC: KeySniper

**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.

PoC: CVE-2026-58138

CVE-2026-58138

PoC: CVE-2026-41940

cPanel & WHM - Authentication Bypass via Session-File CRLF Injection

PoC: CVE-2024-12356

Unauthenticated RCE detector + RCA for BeyondTrust Remote Support / PRA (CVE-2024-12356 + CVE-2025-1094)

PoC: log4shell-exploitation-detection

Log4Shell (CVE-2021-44228) exploitation from a Kali VM against a vulnerable containerized app, with Splunk-based detection engineering and validated remediation. Covers the full attack lifecycle: exploitation, JNDI and host-level auditd detection, and before/after remediation proof.

PoC: cve-2015-3306-lab

Reproducible Docker lab + raw-socket exploit for CVE-2015-3306 (ProFTPD mod_copy pre-auth arbitrary file copy) — a patch-diffing learning exercise

PoC: CVE-2026-39987-PoC

CVE-2026-39987 Proof of Concept

PoC: misfortune-cookie

This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox credential leak), and the CVE-2021-27101 / CVE-2021-27102 exploit chain (Accellion FTA).

PoC: CVE-2023-52356-libtiff-analysis

Root-cause analysis and patch validation of CVE-2023-52356 in libtiff using AddressSanitizer and GDB.

PoC: BlueGate-CVE-2020-0609

BlueGate Exploit validator - RD Gateway validator for CVE-2020-0609 and CVE-2020-0610 (BlueGate) using OpenSSL DTLS over UDP/3391.

PoC: CVE-2026-81780-Hash-Form

CVE-2026-81780 — Hash Form RCE

PoC: CVE-2026-82329-JFrog-Artifactory-

CVE-2026-82329 — JFrog Artifactory Auth Bypass

PoC: cs50-cybersecurity-final-project

CS50 Cybersecurity Final Project: Technical Analysis of the XZ Utils Backdoor (CVE-2024-3094)

PoC: gha-lab-00d54c717d

Security-research lab: CVE-2026-47172 (workflow_run pwn request in deploy.yaml) — flattened snapshot of duck-organization/questbot at 1903b2f

PoC: CVE-2026-33234

SSRF via smtplib raw TCP sockets bypassing HTTP blocklist in AutoGPT SendEmailBlock

PoC: CVE-2025-5548

Buffer overflow in FreeFloat FTP Server 1.0

PoC: gitssrf-gim-cve-parent

gitssrf-gim CVE-2025-48384 parent

PoC: 2009

Linux Kernel Exploits -> CVE-2009-1185 + CVE-2009-1337 + CVE-2009-2692 + CVE-2009-2698 + CVE-2009-3547

PoC: 2008

Linux Kernel Exploits -> CVE-2008-0600 + CVE-2008-0900 + CVE-2008-4210

PoC: 2006

Linux Kernel Exploits -> CVE-2006-2451 + CVE-2006-3626

PoC: CVE-2026-86218

CVE-2026-86218 - Draft or TODO - N-central is vulnerable to a pre-auth remote code execution

PoC: 2005

Linux Kernel Exploits -> CVE-2005-0736 + CVE-2005-1263

PoC: 2004

Linux Kernel Exploits -> CVE-2004-0077 + CVE-2004-1235 + caps_to_root

PoC: galaxy-a37-root

CVE-2026-43499 exploit payload for Samsung Galaxy A37 (A376BXXS4AZG4, kernel 6.1.138-android14-11)

PoC: CVE-2026-13181-CVE-2026-13182-CVE-2026-13183-CVE-2026-13184

CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184

PoC: exploit-mikrotik-2026

CVE-2026-67276 MikroTik RouterOS SSH Authentication Bypass Exploit

PoC: gha-lab-8aba6b05dc

Security-research lab reproducing CVE-2026-45132 (pwn request via pull_request_target chart-name injection in generate-schema.yaml) — snapshot of CloudPirates-io/helm-charts @ 9f5a7186

PoC: CVE-2026-42031-SQL-Injection-Scanner

CVE-2026-42031 SQL Injection Scanner for CKAN DataStore

PoC: gha-lab-5511dc3f73

Authorized security-research lab reproducing CVE-2026-45131 (pwn request in .github/workflows/pull-request.yaml) — snapshot of CloudPirates-io/helm-charts @ 9f5a7186

PoC: ai-tool-poisoning-guard

Free security-baseline rule for Claude Code, Codex, and Cursor: treats MCP tool descriptions as untrusted input (OWASP MCP Top 10 MCP03, CVE-2025-54136).

PoC: gha-lab-733c168b88

Authorized security-research lab reproducing CVE-2026-44246 (GHSA-63mx-j37w-gh59): prompt injection via verbatim issue title/body inlining into the claude-code-action triage agent in nnU-Net's issue-triage workflow. Snapshot of MIC-DKFZ/nnUNet @ 9a1db0dd1c74894fa17e79014be4097f546a51be.

PoC: CVE-2021-1675

Simulated PoC — PrintNightmare Windows Print Spooler RCE/LPE (CVE-2021-1675 + CVE-2021-34527). Non-functional payload for detection engineering. CISA KEV · Patched July 2021 · MITRE T1068.

PoC: CVE-2025-31324

PoC — SAP NetWeaver Visual Composer unauthenticated file upload (CVSS 10.0). Benign JSP payload. CISA KEV May 2025 · Patched April/May 2025 · T1190 ·

PoC: gha-lab-677752506e

Authorized security-research lab reproducing CVE-2026-42298 (pull_request_target docker-build RCE in pr-docker-build.yml) — flattened snapshot of gitroomhq/postiz-app

PoC: CVE-2026-42559

Docker lab + Python PoC for CVE-2026-42559 - DNS rebinding via unvalidated Host header in the rmcp (Rust MCP SDK) Streamable HTTP server transport

PoC: CVE-2024-7804

Docker lab + Python exploit for CVE-2024-7804 (PyTorch torch.distributed.rpc unsafe pickle deserialization RCE, CWE-502, torch <= 2.3.1)

PoC: gha-lab-456dd8a245

Security-research lab reproducing CVE-2026-41414 (pull_request_target pwn in .github/workflows/pr.yml) — snapshot of skim-rs/skim @ ca986f4, not a fork.

PoC: gha-lab-5bce203f66

Security-research lab: reproduction of CVE-2026-41249 (GHSA-q58j-g3f4-h26h) — pull_request_target pwn request in .github/workflows/static.yml, snapshot of coreshop/CoreShop@cc1e3f54

PoC: CVE-2025-57819

CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE (PoC)

PoC: gha-lab-360f77d0d4

Authorized security-research lab: reproduction of CVE-2026-39866 (GHSA-9prc-pp2c-3427) — workflow_dispatch input template injection in .github/workflows/release_update.yml of LawnchairLauncher/lawnchair @ b089bae8c007f36a8ce0346725182a107d97cd05. Snapshot pinned to the vulnerable commit; owner-gated sign-info step retargeted for the lab.

PoC: CVE-2026-44578-next-js-ssrf

este laboratorio puede estar bien o mal esta el pruebas pero debe funcionar preguntale a la IA hahah

PoC: log4shell-exploitation-lab

CVE-2021-44228 Log4Shell reproduced end to end: exploitation through remediation

PoC: CVE-2026-67276

CVE-2026-67276 - Draft or TODO

PoC: GitLab-CVE-2023-7028

A mock app for the GitLab CVE-2023-7028, which allow multile email adresses when ordering a password reset.

PoC: CVE-2026-64849-poc-lab

este laboratorio puede estar bien o mal preguntale a la IA estoy probando pero debe funcionar hahahah

PoC: CVE-2021-3030

Advisory: Cute Editor 6.4 reflected XSS via 'Theme' parameter in colorpicker_more.aspx

PoC: CVE-2026-27876

Grafana SQL Expressions Arbitrary File Write to RCE

PoC: CVE-2026-28956-jxl-messages-surface

JPEG XL auto-decodes in the iOS Messages preview path — delivery-surface finding for CVE-2026-28956 (AppleJPEGXL), with patch-diff attribution (libjxl 0.10.4->0.10.5) and an honest reliability check on the public PoC.

PoC: CVE-2026-73570

Zimbra Collaboration Suite RCE — SMTP log poisoning → swatchdog → OS Command Injection (CVSS 8.9, CISA KEV)

PoC: CVE-2020-10770-keycloak-exploit-poc

Keycloak Blind SSRF POC

PoC: CVE-2026-1529-Keycloak-Exploit-Tool

Keycloak: Unauthorized organization registration via improper invitation token validation

PoC: CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak reset-credentials bypass -> Account Takeover

PoC: CVE-2026-64747

Root cause + macOS reachability PoC for CVE-2026-64747 (AppleAVE2 kext buffer overflow, fixed 26.6 / 905.40.1). Fully reversed AppleAVE2UserClient wire protocol, mode-5 LRB overflow math, IOKit PoC driving the configure path.

PoC: CVE-2026-64705

Root cause + PoC for CVE-2026-64705 (macOS HFS xattr kernel heap overflow, fixed 14.8.7). Weaponized HFS+ image: unbounded bcopy loop -> kernel heap overflow -> panic on pre-fix systems; validator rejection on patched. Kext diff, mechanism, rebuild recipe.

PoC: CVE-2026-78938

Root cause analysis + working R/W exploit for CVE-2026-78938 (V8 TurboFan CheckMaps instance-migration type confusion, Chrome 152, exploited in the wild). Crash PoC + addrof/fakeobj/arbitrary R/W over the compressed heap.

PoC: Jozini-network-scanner

# Jozini Network Scanner Built in Termux at KwaQondile Library, Jozini KZN Tools: - scanner.py: Port scanner with banner grabbing (20 ports + report saving) - cve_check.py: Maps RouterOS version to known CVEs Finding: MikroTik RouterOS 6.46.8 vulnerable to CVE-2020-2021 (Critical) Author: [Your Name] - Aspiring Pentester

PoC: CVE-2026-52774-YESWIKI-XSS

a reflected XSS vulnerability in YesWiki's Bazar widget handler.

PoC: netty-http2-check

CVE-2025-55163 / CVE-2026-56819: offline checker for the 7 netty-codec-http2 CVEs. Tells you which ones you are exposed to, and the one version that fixes all seven (4.1.136.Final / 4.2.16.Final) - written on none of the advisories. Does not scan pom.xml on purpose: WebFlux pulls it in transitively.

PoC: CVE-2026-0920

A PoC exploit for CVE-2026-0920 - LA-Studio Element Kit / Unauthenticated Privilege Escalation

PoC: CVE-2026-84645

Jenkins PersistenceRoot Deserialization RCE (SECURITY-3972) — PoC & analysis. Requires Item/Configure; affects weekly <= 2.579 / LTS <= 2.568.2

PoC: cyberthreat_DBSproject

threat = { "id": "CVE-2026-0001", "title": "Apache HTTP Server Remote Code Execution", "vendor": "Apache", "product": "HTTP Server", "description": "A vulnerability in Apache HTTP Server allows remote attackers to execute arbitrary code.", "cvss": 9.8, "kev": True, "published": "2026-06-30" }

PoC: CVE-2026-6471

CVE-2026-6471

PoC: CVE-2026-75865

Unauthenticated arbitrary file upload -> RCE in WPLP Cookie Consent (gdpr-cookie-consent) <= 4.4.1 - technical write-up and PoC

PoC: CVE-2026-32475

CVE-2026-32475 PoC : Elementor Pro Unauthenticated Arbitrary File Upload to RCE

PoC: CVE-2023-42793-TeamCity-Unauthenticated-RCE

A PoC and automated version detection/exploit tool for JetBrains TeamCity Authentication Bypass & RCE (CVE-2023-42793).

PoC: cve-2026-6471-postgres-logical-decoding-dlopen

postgres CVE-2026-6471 Exploit

PoC: gpgsm-cve-2026-57062-cms-gcm-short-tag

gpgsm CVE-2026-57062 exploit POC

PoC: CVE-2025-4255---Buffer-Overflow

Exploit Framework for CVE-2025-4255

PoC: gha-lab-4a8fad8536

Security-research lab reproducing CVE-2026-39382 (GHSA-5jxf-vmqr-5g82): command injection in dbt-labs reusable workflow open-issue-in-repo.yml, driven by a dbt-core-style docs-issue.yml caller

PoC: gha-lab-ed7a1740c4

Security-research lab: controlled reproduction of GHSA-3g6g-gq4r-xjm9 / CVE-2026-35580 (GitHub Actions workflow_dispatch input shell injection) against a pinned snapshot of NationalSecurityAgency/emissary

PoC: gha-lab-85f022290a

Research lab reproduction of CVE-2026-34243 (GHSA-r4fj-r33x-8v88): command injection via issue_comment.body in .github/workflows/comment.yaml — snapshot of njzjz/wenxian@ca4e04de86aa970c0e3cb1c7f2bd103d339fbe51

PoC: gha-lab-9b5e3ccfbe

Security-research lab: reproduction of CVE-2026-33475 (GitHub Actions script injection via PR branch name in deploy-docs-draft.yml), snapshot of langflow-ai/langflow

PoC: research-cve-2026-85649

[MIRROR] The CVE-2026-85649 Security Research Publication.

PoC: gha-lab-61c59f4acb

Security-research lab: controlled reproduction of CVE-2026-33075 (pwn request in labring/FastGPT preview-image workflow, pull_request_target + checkout-of-fork + privileged buildx push)

PoC: gha-lab-3f1ff30e9c

Authorized security-research lab reproducing CVE-2026-31852 (jellyfin/jellyfin-ios pull_request_target pwn in code-quality.yml) — isolated snapshot, not the upstream project

PoC: ghostlock-s25fe

GhostLock (CVE-2026-43499) for the Galaxy S25 FE (W.I.P)

PoC: gha-lab-ca4fa82ac5

Security-research lab: reproduction of CVE-2026-29075 (GHSA-3j55-5q6x-2h48) in mesa/mesa benchmarks.yml pull_request_target workflow — single-commit snapshot for authorized vulnerability reproduction.

PoC: gha-lab-6c3094af9e

Authorized security-research lab reproducing CVE-2026-27941 (pwn request in pull_request_target workflows) — snapshot of openlit/openlit

PoC: gha-lab-a7f6217d26

Security-research reproduction of CVE-2026-27938 / GHSA-4q9f-mjxf-rx7x (GitHub Actions expression injection in release workflows) — snapshot of wp-graphql/wp-graphql at b216fe22f3a119f256511ec7353f536fee6886ac

PoC: cve-2026-19900-PoC

cve-2026-19900-PoC

PoC: CVE-2026-85769

Heap out-of-bounds read in libtpms TPM 2.0 state deserialization — CVE-2026-85769

PoC: CVE-2026-19632

Unauthenticated account takeover PoC for TranslatePress Multilingual <= 3.3.1 (WordPress)

PoC: CVE-2026-11613

Divi Ajax Filter <= 5.1.2 Unauthenticated Local File Inclusion via 'custom_loop_template'

PoC: gha-lab-25b7988758

Authorized security-research reproduction of CVE-2026-27701 / GHSA-xh9w-5859-x97j (live-codes/livecodes @ 8017e01): untrusted PR title interpolated into i18n-update-pull github-script block.

PoC: copy-fail-CVE-2026-31431-cpp

https://github.com/theori-io/copy-fail-CVE-2026-31431 but ported to c++ for fun

PoC: CVE-2026-83548-checker

Non-intrusive detector for SonicWall SMA 1000 exposure to CVE-2026-83548/-83549 (version/patch-state check; no exploitation)

PoC: gha-lab-b16a4f3554

Security-research lab: CVE-2026-24480 pull_request_target pre-commit RCE in qgis/QGIS (snapshot at vulnerable commit)

PoC: Yordam-Kutuphane-Otomasyonunda-Coklu-HTML-Enjeksiyonu

CVE-2026-77818 - Yordam Kütüphane Otomasyon Sistemi - Üç ayrı noktada yansıtılmış HTML enjeksiyonu, form action ele geçirme ve kimlik bilgisi hırsızlığı (CWE-79)

PoC: jsherp-user-info-idor

VulDB advisory: jshERP authenticated /user/info IDOR and password-digest replay after CVE-2025-60800

PoC: gha-lab-7927d7d06f

Security-research lab reproducing CVE-2026-22869 (pwn) — arbitrary code execution in privileged pull_request_target run via npx local-bin hijack, snapshot of eigent-ai/eigent @ 2a406536

PoC: cve-2026-31431

PoC for CVE-2026-31431

PoC: gha-lab-b5c1313658

Authorized security-research lab reproducing CVE-2026-1699 (pwn request in preview.yml) — snapshot of eclipse-theia/theia-website

PoC: CVE-2026-63077

CVE-2026-63077 - Unauthenticated RCE exploit for JetBrains TeamCity via Agent Polling Deserialization. Supports mass scanning, multi-threading, and interactive shell. For authorized security testing only.

PoC: CVE-2026-6471

CVE-2026-6471 - Draft or TODO

PoC: CVE-2026-73554

CVE-2026-73554 - Draft or TODO

PoC: CVE-2026-19516

CVE-2026-19516