Duplicate Advisory: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

PoC: CVE-2026-85046

CVE-2026-85046

PoC: CVE-2026-62735

Windows HTTP.sys integer overflow -> nonpaged pool overflow LPE PoC (CVE-2026-62735): crash + full SYSTEM exploit; for authorized testing

PoC: CVE-2026-82329-JFrog-Artifactory-Auth-Bypass

CVE-2026-82329 — JFrog Artifactory (self-hosted) Auth Bypass

PoC: CVE-2026-65349

CVE-2026-65349 PoC — getattrlist OOB write in vfs_attr_pack_internal (iOS 26.6 / 23G71)

PoC: CVE-2026-65343

CVE-2026-65343 PoC — AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71)

PoC: CVE-2026-65330

CVE-2026-65330 PoC — setxattr PAC bypass via fixed #0x307a diversifier (iOS 26.6 / 23G71)

PoC: CVE-2026-64788

CVE-2026-64788 PoC — IOGPUFamily Use-After-Free (iOS 26.6 / 23G71)

PoC: cve-2024-55591-poc

Educational implementation in Go for CVE-2024-55591 (Fortinet FortiOS Authentication Bypass). Designed for security research, vulnerability assessment, and understanding WebSocket-based auth bypass mechanisms.

PoC: cve-2026-82329-jfrog-artifactory

CVE-2026-82329 JFrog Artifactory unauthenticated auth-bypass: reproducible Docker lab + URL-parameter validator PoC + patch-diff analysis

PoC: CVE-2026-82592

D-Link DIR-825M formDiskFormat stack overflow + command injection RCE PoC (CVE-2026-82592); for authorized security testing

PoC: CVE-2026-63077

CVE-2026-63077 - Unauthenticated RCE exploit for JetBrains TeamCity via Agent Polling Deserialization. Supports mass scanning, multi-threading, and interactive shell. For authorized security testing only.

PoC: CVE-2026-6471

CVE-2026-6471 - Draft or TODO

PoC: CVE-2026-73554

CVE-2026-73554 - Draft or TODO

PoC: CVE-2026-19516

CVE-2026-19516

PoC: gha-lab-51c6b6d0a0

Lab reproducing CVE-2025-67727 (parse-community/parse-server ci-performance.yml pull_request_target RCE at e78e58d) — authorized security research

PoC: gha-lab-6904b2ccbe

Security-research lab: reproduction of CVE-2025-61584 (GHSA-9g7x-737f-5xpc) — command injection via github.head_ref in pull_request_target workflow (.github/workflows/pr.yml)

PoC: CVE-2026-85046-Patch-confusion-zero-day-vulnerability-in-Google-Chrome-s-V8-engine

Conceptual C++ patch and structural analysis for CVE-2026-85046, a critical type confusion zero-day vulnerability in Google Chrome's V8 engine

PoC: cve-disclosures

CVE-2024-57551, CVE-2024-57552, CVE-2024-57553 advisories by Aman Bahiniya

PoC: unit-01-severity-vs-risk-reflection

cve-2026-25524 Holds no customer payment data, no monitoring in place, monitored 24/7 The CVSS score is technically serious, but it doesn't tell how exposed it is, weather our existing defenses would stop or contain an attack. We should confirm the vulnerable component is reachable by untrust input in our environment.

PoC: gha-lab-d14c91f1bb

Security-research lab: reproduction of CVE-2025-58371 (GitHub Actions command injection via PR title in Discord PR Notifier), snapshot of RooCodeInc/Roo-Code @ 08a825f9bb0086a88cff5a79b9af4731bba7d076

PoC: thymeleaf-check

Offline checker for Thymeleaf CVE-2026-40477 / CVE-2026-41901 — tells you which of the two CVSS 9.0 SSTI flaws you are exposed to, and whether your version line has a fix at all (3.0.x: it does not)

PoC: CVE-2024-36058

CVE-2024-36058 — Authenticated Time-Based Blind SQL Injection in Koha Library Software < 22.05.22 (opac-sendbasket.pl). Advisory + PoC by Hacklantic.

PoC: CVE-2024-36057

CVE-2024-36057 — Authenticated OS Command Injection in Koha Library Software < 22.05.22 (upload-cover-image.pl). Advisory + PoC by Hacklantic.

PoC: gha-lab-aa1cbc9bcf

Authorized security-research reproduction of CVE-2025-54594 (GHSA-588g-38p4-gr6x): privileged issue_comment-triggered canary release workflow checking out untrusted fork code and running its npm scripts with GITHUB_TOKEN/NPM_TOKEN in env. Snapshot of callstackincubator/react-native-bottom-tabs @ d765b1f695762490327dcb8f6a2f17542cf0abdb.

PoC: CVE-2026-82329-poc

CVE-2026-82329 Poc

PoC: CVE-2025-34158-CVE-2020-5741

CVE-2025-34158, CVE-2020-5741 - Draft or TODO

PoC: gha-lab-ba981941f0

Security-research lab reproducing CVE-2025-54430 (GHSA-wrg3-xqw8-m85p): secrets exfiltration via issue_comment-triggered Benchmark Bot in dedupeio/dedupe. Snapshot of dedupeio/dedupe@54ecfe77d41390da66899596834a2bde3712c966.

PoC: gha-lab-f894926966

Authorized security-research reproduction lab for CVE-2025-54415 (GHSA-g5hx-xv45-9whg): astronomer/dag-factory snapshot at 464c75a — pull_request_target head-SHA checkout executes attacker-controlled hatch scripts in base-repo context

PoC: gha-lab-6926364d94

Security research lab reproducing CVE-2025-53546 (GHSA-h87r-5w74-qfm4): pull_request_target arbitrary code execution in RSSNext/Folo's auto-fix lint workflow — authorized, isolated reproduction

PoC: CVE-2025-8518

CVE-2025-8518 - Draft or TODO

PoC: gha-lab-3b0a828a69

Security-research lab reproducing CVE-2025-53104 (GHSA-432r-9455-7f9x): command injection in discussion-to-slack.yml of gluestack/gluestack-ui

PoC: gha-lab-e8902eccd3

Security research lab: reproduction of CVE-2025-52467 (pgai pull_request_target workflow code execution / GITHUB_TOKEN exfiltration) — snapshot of timescale/pgai

PoC: tomcatfileread

CVE-2020-1938 (Ghostcat) Tomcat AJP file read/file include PoC with python3 port

PoC: CVE-Chamilo-LMS

CVE-2026-61578, CVE-2026-61582, CVE-2026-61583, CVE-2026-61584, CVE-2026-61585, CVE-2026-61587, CVE-2026-61600, CVE-2026-61601, CVE-2026-61602, CVE-2026-70647, CVE-2026-70648 - Draft or TODO

PoC: gha-lab-2f775f277c

Authorized lab reproduction of CVE-2025-47928 (spotipy-dev/spotipy pull_request_target secrets exfiltration) — snapshot at vulnerable commit 4f5759d

PoC: CVE-2026-31787

Linux kernel double free in Xen privcmd driver

PoC: gha-lab-fb6df3d456

Authorized security-research lab reproducing CVE-2025-46820 (GHSA-cwj7-6v67-2cm4): GITHUB_TOKEN persisted into publicly downloadable CI artifacts in phpgt/Dom. Snapshot of phpgt/Dom @ b73d7e8.

PoC: CVE-2026-20212

CVE-2026-20212 - Draft or TODO

PoC: CVE-2026-56718

AJCloud AJY IPC Firmware Path Traversal via jdbhttpd

PoC: psa-2026-00043-recovery

Recovery notes for proxmox advisory ID: PSA-2026-00043-1 (CVE-2023-54391)

PoC: gha-lab-ba8e0c4217

Authorized security-research lab: reproduction of CVE-2024-42370 / GHSA-4hq2-rpgc-r8r7 (env injection in docs-preview.yml) — snapshot of litestar-org/litestar@18d84d84

PoC: CVE-2026-65643-PoC-Toolkit

🧰 CVE-2026-65643 – cPanel Domain Parking RCE Toolkit (CVSS 8.7) | Red/Blue Team suite for unpatched cPanel & WHM 11.x (110,134,136,138). 2 tools: Full Exploit (reverse shell, webshell, persistence, root passwd, file R/W, mass scan, Tor), Blue Team PoC (detection, reporting, audit). w/Python. 🦾 Only Use Ethically, Stay Legal <3

PoC: CVE-2026-4813

PoC for CVE-2026-4813

PoC: cve-2026-75604

Research lab and exploit chain for CVE-2026-75604: path traversal in the Next.js incremental cache, to RCE on Windows.

PoC: CVE-2026-82329

CVE‑2026‑82329 is a critical authentication bypass in JFrog Artifactory (CVSS 9.8) allowing unauthenticated attackers to obtain full administrative privileges. Actively exploited in the wild. Affects self‑hosted versions before patches. PoC for authorized testing only.

PoC: CVE-2026-52810

CVE-2026-52810 - Draft or TODO

PoC: iOS26.6-CVE-2026-64788

CVE-2026-64788 PoC — IOGPUFamily Use-After-Free (iOS 26.6 / 23G71)

PoC: CVE-2026-80428

CVE-2026-80428 PoC

PoC: iOS26.6-CVE-2026-65343

CVE-2026-65343 PoC — AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71)

PoC: CVE-2026-80428

CVE-2026-80428 PoC

PoC: gha-lab-b1fe4918c0

Authorized security-research lab: reproduction of CVE-2025-32958 (GHSA-8c7v-vccv-cx4q) — GITHUB_TOKEN leaked into workflow artifacts by Adept's remoteBuild.yml (snapshot of AdeptLanguage/Adept @ 6a64554)

PoC: CVE-2026-83548-SonicWall-SMA1000-Analysis

Vulnerability Analysis of CVE-2026-83548 affecting SonicWall SMA1000 security systems.

PoC: CVE-2024-21546

This repository contains security assessment tooling, detection templates, and an automated exploit toolkit for identifying and exploiting Unauthenticated Remote Code Execution (RCE) in applications utilizing the `UniSharp/laravel-filemanager` package (Versions `< 2.9.1`).

PoC: CVE-2026-78071

Stored XSS via Location Title in DPCalendar Free

PoC: CVE-2026-78070

SQL Injection via ORDER BY Shortcode in plg_content_dpcalendar — DPCalendar Free ≤ 10.11.2

PoC: CVE-2026-19949

CVE-2026-19949 - Draft or TODO

PoC: CVE-2026-59822

CVE-2026-59822 - Draft or TODO

PoC: struts2-tool

Struts2 S2-045/S2-046 CVE-2017-5638 detection & exploitation tool

PoC: gha-lab-becf103a54

Authorized security-research reproduction of CVE-2025-15617 (GHSA-6xqr-4q5g-xc7x): artipacked GITHUB_TOKEN leak in wazuh FIM Windows integration workflow artifacts

PoC: CVE-2025-9974

Proof of Concept code for the CVE-2025-9974 affecting Nokia Beacon routers.

PoC: tfo-connect-bypass

Bypassing connect()-based syscall rules using TCP Fast Open (CVE-2026-63828 PoC)

PoC: CVE-2026-38577-by-deepak-Anmol

CVE-2026-38577

PoC: gha-lab-23db52563c

Security-research lab: reproduction of CVE-2025-10894 (PR-title injection in GitHub Actions) — snapshot of nrwl/nx

PoC: CVE-2026-9335-keras-hdf5-externallink

CVE-2026-9335: KerasFileEditor and load_weights follow h5py ExternalLinks, disclosing arbitrary local HDF5 file contents in keras ≤ 3.14.0. Advisory + verified PoCs.

PoC: vsFTPd-2.3.4-Exploit

Python exploit for the vsFTPd 2.3.4 backdoor (CVE-2011-2523).

PoC: CVE-2026-73296

CVE-2026-73296

PoC: CVE-2026-19490

NetScaler ADC/Gateway SAML unsigned-assertion bypass via HTTP-Redirect binding (CTX696939) - root cause analysis + PoC

PoC: dast

CVE-2026-0828

PoC: SmarterMail-CVE-2026-24423-

Exploit for CVE-2026-24423 — a critical unauthenticated RCE in SmarterMail's ConnectToHub API. Affects all builds prior to 9511.

PoC: gha-lab-d9fd584b12

Authorized security-research lab reproducing CVE-2024-47179 (GHSL-2024-178): artifact-poisoning pwn-request chain in RSSHub docker-test workflows (snapshot at 574d053)

PoC: LAB1-metasploitable

Exploitation des vulnérabilités sur la version vsftpd 2.3.4 du service ftp (CVE-2011-2523)

PoC: CVE-2022-25765

CVE-2022-25765 | pdfkit v0.8.6 Python PoC

PoC: CVE-2026-7899

CVE-2026-7899 - Draft or TODO

PoC: gha-lab-6ab39df295

Controlled security-research lab reproducing CVE-2024-45798 (GHSA-h52q-xhg2-6jw8) in espressif/arduino-esp32 — poisoned-artifact pwn request via tests_results.yml workflow_run

PoC: CVE-2026-9586

CVE-2026-9586 - Draft or TODO

PoC: mojarra-2.2.13-patched

CVE-2020-6950 backport for legacy Mojarra 2.2.13

PoC: artifactory-CVE-2026-82329-poc.py

CVE-2026-82329 — JFrog Artifactory unauthenticated authentication bypass ("phantom join key" -> forged service admin token)

PoC: gha-lab-40e23db109

Security-research lab: controlled reproduction of CVE-2024-4254 (GHSA-fc78-c36r-cc59) — deploy-website.yml fork checkout/code execution in gradio-app/gradio @ d4c503a

PoC: root-s24-e1s

Galaxy S24 SM-S921B S921BXXSDCZB2 RAM-only KernelSU Next (CVE-2026-43499) + Root S24 app

PoC: CVE-2024-49138-SOC-Investigation

SOC investigation of CVE-2024-49138 exploitation involving brute-force activity, PowerShell execution, malicious payload analysis, privilege escalation, and incident response.

PoC: gha-lab-ee08e207a8

Authorized security-research lab reproducing CVE-2024-4253 (GHSA-r897-wrpm-h4vw): workflow_run command injection in gradio-app/gradio's test-functional.yml

PoC: CVE-2026-24061-Telnetd

CVE-2026-24061 GNU Inetutils Telnetd Authentication Bypass

PoC: Fortigate-SSL-VPN-Exploit-Kit

The FortiGate SSL-VPN pot of gold. CVE-2024-21762 and CVE-2023-27997. 79 working exploit clients. 53 hardware SKUs. 55 FortiOS builds.

PoC: CVE-2026-33017

CVE-2025-62593 — Ray Unauthenticated RCE Exploit is an unauthenticated remote code execution vulnerability in the Ray distributed AI compute engine.

PoC: CVE-2026-13753-poc

Poc of CVE-2026-13753

PoC: CVE-2026-82221

PoC for Unauthenticated Reflected Cross-Site Scripting (XSS) in RegistrationMagic WordPress Plugin

PoC: ActiveMQ-CVE-2023-46604

Exploit POC for Apache ActiveMQ CVE-2023-46604

PoC: gha-lab-0ba60e6456

Authorized security-research lab reproducing CVE-2024-39700 / GHSA-45gq-v5wm-82wg (JupyterLab extension-template update-integration-tests pwn request)

PoC: CVE-2026-36130

CVE-2026-36130

PoC: CVE-2026-31321

CVE-2026-31321

PoC: postgresql-cve-2026-14662

PostgreSQL の全文検索(tsvector/tsquery)に見つかった範囲外書き込み脆弱性 CVE-2026-14662 を、修正前(18.4)と修正後(18.6)を Docker で並べて動かして検証した記録と発表資料

PoC: CVE-2026-27472-and-CVE-2026-27474

PoC for CVE-2026-27472 and CVE-2026-27474

PoC: CVE-2026-27475

PoC for CVE-2026-27475

PoC: CVE-2026-18963

Unauthenticated account takeover via reset-credentials flow bypass

PoC: CVE-2026-0768

CVE-2026-0768 - Draft or TODO

PoC: CVE-2026-82329

CVE-2026-82329 - Draft or TODO

PoC: tomcat-line-check

CVE-2026-24880: does Apache's upgrade advice actually apply to your Tomcat? Detects the fix by class presence, not version comparison. Covers 7.0/8.0/8.5/9.0/10.0/10.1/11.0 lines.

PoC: tomcat85-check

CVE-2025-55752 CVE-2025-55754 CVE-2025-48988 CVE-2025-52520 CVE-2025-53506 CVE-2025-61795 CVE-2025-66614:Tomcat 8.5 已 EOL,终版 8.5.100。Apache 逐条声明「8.5 也受影响」的 2025 CVE 有 14 条,其中 10 条在 NVD 按 8.5.100 查不到。离线单 jar,读 conf/ 判断你到底中了哪几条。

PoC: log4j2-vuln-lab

CVE-2021-44228 (Log4Shell) 漏洞复现靶场 | SpringBoot + Log4j2 2.14.1 | 3 个攻击向量 PoC 验证

PoC: CVE-2021-3493-Exploit

It's a CVE-2021-3493 Exploit written in C