## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9fpm-3445-2vx4. This link is maintained to preserve external references. ## Original Description A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file src/lfx/src/lfx/components/llm_operations/lambda_filter.p of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
PoC: plz110-6.12.69-cve-2026-64560-ksu
一加 15T（PLZ110）临时 root + KernelSU per-boot 接管：CVE-2026-64560 移植，不写分区、重启即失效。内核 6.12.69-android16-6-g242e1a07f878。
PoC: CVE-2026-104748
Unauthenticated privilege escalation in SimpleForm WordPress plugin <= 3.10.0. Registers an administrator account without authentication
PoC: CVE-2026-97229-PoC
GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image
PoC: vivo-dirtyfrag-root
Temporary root on locked-bootloader vivo devices (tested: S17 Pro / PD2284 / MT6896Z / 5.10.233) without wiping data. Root cause: vivo prepends "vivo " to MODULE_ARCH_VERMAGIC, so every prebuilt arm64 kernel module is rejected by insmod. Includes a patch script + a quantified refutation of GhostLock (CVE-2026-43499).
PoC: CVE-2026-110912
CVE-2026-110912
PoC: CVE-2020-25213-exploit
Exploit para explotar la vulnerabilidad CVE-2020-25213 en WPFileManager < 6.9
PoC: AhsayCBS-Auth-Bypass-RCE
A proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS
PoC: CVE-2026-97657
CVE-2026-97657 – Authentication Bypass & Account Takeover | Pocbit
PoC: CVE-2026-109721
Write-up for CVE-2026-109721
PoC: wp2shell-PoC
CVE-2026-63030 + CVE-2026-60137 exploit RCE chain.
PoC: Driftnet
CTF writeup: rooting a Linux box via CVE-2024-23334 (directory traversal) and CVE-2025-32463 (sudo privilege escalation)
PoC: CVE-2026-108578
Neterbit NW-431F unauthenticated SMS disclosure
PoC: cve-2026-110447-checker
Free CLI: check a Nextcloud instance for CVE-2026-110447 exposure. Stdlib only, honest verdicts. By Ingenious AI.
PoC: CVE-2026-85097
CVE-2026-85097 — Bricksforge <= 3.1.8.9 unauth file upload to RCE. GIF/PHP polyglot + temporaryFileUploads.url mismatch. python3 exploit.py --url http://TARGET
PoC: cve-2026-77521-lab
Benign, self-contained reproduction of CVE-2026-77521 (MaxKB prompt-injectable command execution)
PoC: CVE-2026-18963-PoC
Proof of concept and vulnerability checker for CVE-2026-18963, the Keycloak reset-credentials flow bypass
PoC: Lenovo_Qcom_RPMB_Tool
Educational proof-of-concept (PoC) research tool demonstrating CVE-2026-24090 ABL verification bypass to inspect and test Qualcomm Keymaster RPMB state on Lenovo devices.
PoC: ghostlock-brt-w09
⚠️ NOT SUCCESSFUL - GhostLock (CVE-2026-43499) adaptation attempt for Honor Pad V8 (BRT-W09 / MediaTek MT8797 / kernel 4.14.186+). Verified offsets + why KernelSnitch fails on 4.14.
PoC: cve-2025-66645
NiceGUI Path Traversal CTF Challenge
PoC: CVE-2026-20896-Gitea-CTF
CVE-2026-20896 Gitea Docker CTF Challenge
PoC: CVE-2026-12118-POC-
CVE-2026-12118 POC
PoC: CVE-2026-110912
A PoC for CVE-2026-110912 'arpbleed'
PoC: CVE-2026-104711-POC-NEW-VARIANT
POC for the CVE-2026-104711 - New Variant
PoC: CVE-2026-47644
CVE-2026-47644 ($12,000): Edge Copilot Prompt Injection Leads to Cross-Tab Data Exfiltration - PoC & full writeup
PoC: MOcha
CVE-2023-41991 vulnerability exploitation
PoC: CVE-vulnerability
CVE-2026-0322
PoC: ivanti-cve-2026-104935-check
Detection-only check for the Ivanti Connect Secure authentication bypass (CVE-2026-104935)
PoC: microsoft-security-advisory-cv
Autonomous submission for "Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability" (MSRC / GitHub Security Advisory)
PoC: CVE-2026-107081
SQL Injection via identifier injection in SLiMS 9.8.0 admin AJAX endpoints (tableName/tableFields). Any authenticated staff can dump password hashes.
PoC: CVE-2021-4034
CVE-2021-4034 (PwnKit) - Python PoC
PoC: CVE-2026-76519-POC
Unauthenticated remote code execution on Cisco Secure Email Gateway via crafted email attachment. Path traversal in AMP File Reputation handling allows arbitrary file write as root when the service is enabled on a mail policy.
PoC: CVE-2026-109506
Technical writeup of CVE-2026-109506, a vulnerability I found in multiple TP-Link Wi-Fi Range Extenders
PoC: CVE-2026-104748
CVE-2026-104748 POC
PoC: DirtyFrag
DirtyFrag (CVE-2026-43284) pro Galaxy A57 5G (SM-A576B, A576BXXS6AZI2): gatilho libbase pro One UI 8.5 + dfroot.ko compilado exato pro 6.12.38-android16-5 do aparelho
PoC: CVE-2024-36057
CVE-2024-36057 - Authenticated OS Command Injection in Koha Library Software < 23.05.10 (upload-cover-image.pl). Advisory + PoC by Hacklantic.
PoC: CVE-2024-36058
CVE-2024-36058 - Authenticated Time-Based Blind SQL Injection in Koha Library Software < 23.05.10 (opac-sendbasket.pl). Advisory + PoC by Hacklantic.
PoC: cve-2025-24801-glpi
Reproducible local lab and source analysis for CVE-2025-24801 in GLPI 10.0.16
PoC: CVE-2017-7921
A Python-based tool for security assessment of Hikvision devices affected by CVE-2017-7921.
PoC: DC1-Penetration-Testing-Report
Penetration test report for the DC-1 VulnHub machine: Drupalgeddon2 (CVE-2018-7600) RCE, credential discovery, and SUID privilege escalation to root. Includes CVSS-rated findings and a remediation roadmap.
PoC: CVE-2026-92392
Defensive exposure checker and poc for cURL CVE-2026-92392
PoC: wazuh-unauth-chain
Wazuh PoC chaining CVE-2026-74034 file read and CVE-2026-74041 command execution; fixed in 4.14.8. Python standard library only.
PoC: Heartbleed-CSP-project
Heartbleed (CVE-2014-0160) reproduction and analysis —CSP Application Security project
PoC: linux-kernel-cve-2026-74580-vghost
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
PoC: merkle-lab
针对比特币 Merkle 根算法（含 CVE-2012-2459 变异检测机制）设计并实施自动化测试方案，覆盖功能正确性、边界场景与安全回归。
PoC: CVE-2026-85046
V8 inlined Array.prototype.sort elements-kind confusion - PoC + addrof (N-day research)
PoC: CVE-2025-13224
V8 super receiver confusion - PoC + unreachability research
PoC: CVE-2025-12433
V8 hole-check elision merge bug - PoC + exploit
PoC: CVE-2024-5274
V8 parser x bytecode-flush NativeContext leak - PoC
PoC: CVE-2024-2887
V8 Wasm GC type confusion - two PoCs (kExtern / kNone paths)
PoC: CVE-2024-23222
JSC DFG TOCTOU stale JSCell - deterministic UAF PoCs + race harness
PoC: CVE-2018-4125-4161-4162-4163
JSC side-effect type confusion family (4 CVEs) - family PoC + full exploit
PoC: cve-2026-44825-challenge
cve2026-44825_ctf_test
PoC: CVE-2023-41993
JSC DFG CSE offset-key bug, GetterSetter leak - PoC + exploit
PoC: CVE-2023-2033
V8 TheHole leak - PoC
PoC: CVE-2022-1364
V8 escape-analysis object materialization confusion - PoC
PoC: CVE-2021-38003
V8 TheHole leak via JSON.stringify - PoC + OrderedHashMap amplification
PoC: CVE-2021-30517
V8 SuperIC confusion - PoC + addrof/fakeobj/arb-rw exploit snippets
PoC: CVE-2019-0567
ChakraCore InitProto type confusion - PoC
PoC: CVE-2026-104711-POC---Brand-New
CVE-2026-104711 POC - Brand New
PoC: BLU_G35
A self-contained Linux kit for BLU G35 (Unisoc SC9863A): unlock the bootloader via the publicly documented CVE-2022-38694 BootROM method, insure first with three cross-verified backups, gate every write behind typed consent, and roll back to full box state. Security research — read the pinned issue before running anything.
PoC: CVE-2026-85097
For WordPress
PoC: CVE-2021-21413
CVE-2021-21413 isotaled-vm Sandbox Escape PoC
PoC: CVE-2026-110025
CVE-2026-110025: bilingual analysis and safe local PoC for phpwcms unrestricted upload to RCE
PoC: CVE-2026-108924
CVE-2026-108924: didactic PoC for Kirby dynamic option authorization bypass
PoC: factura-malware-analysis-lab
Malware analysis of a malicious RTF document exploiting CVE-2017-11882, done in a REMnux lab with static analysis and shellcode emulation.
PoC: Reflected-XSS-Bludit-CVE-2026-41456
Implementation of varios cross site scripting payloads to exploit CVE-2026-41456
PoC: tmog-rapl-gate
Let Task Manager TMOG read RAPL power on Linux only while it runs — no permanent udev grant (CVE-2020-8694)
PoC: CVE-2026-85884
CVE-85884 POC
PoC: CVE-2026-104935-Proof-of-concept
Unauthenticated remote code execution in Ivanti Connect Secure (CWE-290, CVSS 8.6)
PoC: CVE-2026-82957
SSRF in Hyperledger FireFly Webhook Subscriptions (CVE-2026-82957)
PoC: CVE-2026-76268
CVE-2026-76268 PoC: Splunk Enterprise SHC Patroni REST unauth RCE — PATCH /config archive_command + POST /restart. Check + mass exploit, OOB POCBIT-76268-OK, CVSS 9.8. https://pocbit.org/pocs/cve-2026-76268
PoC: CVE-2026-86086
Zephyr Project: under embargo until 2026-12-01
PoC: POC-for-CVE-2026-104711---New
POC for CVE-2026-104711 - New
PoC: CVE-2025-41450_poc
Code Of The Day
PoC: CVE-2026-102718
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length.
PoC: CVE-2026-102827
Command execution and patch bypass of CVE-2026-28291 in git-js.
PoC: telegram-account-takeover-poc
CVE-2026-107181 Proof Of Concept for telegram Desktop account take over in windows
PoC: CVE-2026-105950
Bilingual PoC and technical analysis for CVE-2026-105950 — Formwork formaction URI sanitizer bypass
PoC: POC-EXPLOIT-CVE-2026-104711
POC EXPLOIT CVE-2026-104711
PoC: CVE-2026-68582-PoC
PoC for CVE-2026-68582 / GHSA-rj9j-8772-4h6c — Vikunja link-share BOLA
PoC: cve-2025-68613-ctf
ctf 문제 만들기
PoC: pentest-kioptrix
Test d’intrusion sur Kioptrix Level 1 : exploitation d’une faille Apache/mod_ssl (OpenFuck, CVE-2002-0082) jusqu’à l’accès root, en environnement de laboratoire isolé.
PoC: dymo-id-cve-poc
PoCs for CVE-2026-102262 & CVE-2026-101893 — code execution and XXE in DYMO ID (reported & fixed)
PoC: pentest-metasploitable
Test d’intrusion sur Metasploitable 2 : exploitation de la backdoor vsftpd 2.3.4 (CVE-2011-2523) pour obtenir un accès root sans authentification.
PoC: CVE-2026-72898-metabase
CVE-2026-72898 Metabase Security Tools
PoC: CVE-2026-107159
MiniUPnPd <= 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header
PoC: CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE
CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE
PoC: CVE-2026-104711-Advanced-Variant
POC for CVE-2026-104711-Advanced-Variant
PoC: KDSExtract
Exploits CVE-2026-58222 to recover Samba KDS root keys and derive gMSA credentials from a low-privilege domain account.
PoC: CVE-2026-104711-exploit-payload-4
POC for the CVE-2026-104711 new variants
PoC: CVE-2026-104711-POC-Variant3
POC for the CVE-2026-104711 which is a new variant
PoC: CVE-2026-104711
POC for the CVE-2026-104711
PoC: CVE-2026-85097
POC CVE-2026-85097
PoC: CVE-2026-41992-poc
POC for the CVE-2026-41992
PoC: fromagegate
FROMAGEGATE — PoC + detection toolkit for Danfoss AK-SM 8xxA CVE-2025-41450/-41451/-41452 (code-of-the-day auth bypass, alarm-to-mail RCE, nginx config injection). For detection-signature development.
PoC: rails-doubletap-py
Automated Ruby on Rails doubletap RCE (CVE-2019-5418 + CVE-2019-5420) in pure Python, using the ERB#def_module gadget for modern Ruby.
PoC: CVE-2026-3888-PoC
CVE-2026-3888 PoC; discovered by the Qualys Threat Research Unit (TRU).
PoC: CVE-2025-32432-craftcms-rce
Working PoC + debugging writeup for CVE-2025-32432 (Craft CMS pre-auth RCE)
PoC: CVE-2026-84411-reproduction
CVE-2026-84411 root cause notes and a non-destructive probe (RouterOS before 7.24)
PoC: sonicwall-sma-1000-cve-2026-102255
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free