## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6h2x-m376-mqjq. This link is maintained to preserve external references. ## Original Description joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.
PoC: CVE-2026-21155-SVE-2026-3546
Writeup CVE-2026-21155
PoC: CVE-2026-83844
Microsoft Paint CVE-2026-83844 Verification Script
PoC: CVE-2026-86777-AlchemyCMS-Navigation-Disclosure
Technical research and proof of concept for CVE-2026-86777 affecting AlchemyCMS.
PoC: CVE-2026-94113-ERPNext-Timesheet
Technical analysis and proof of concept for CVE-2026-94113 — Missing Authorization in ERPNext Timesheet endpoints.
PoC: CVE-2026-123158
sshole (CVE-2026-123158): OpenSSH password bypass on alpine Linux
PoC: CVE-2026-123158
OpenSSH + musl password authentication bypass (sshole) checker: local precondition audit + remote verification; for authorized testing
PoC: CVE-2026-123158
Exploit para explotar la vulnerabilidad CVE-2026-123158 (conocida como sshole).
PoC: CVE-2026-42016_CVE-2026-42018
CVE-2026-42018 / CVE-2026-42016 — JFrog Artifactory Token Chain (Scoped PoC)
PoC: php2shell-deep-dive
A deep technical walkthrough of PHP2Shell from memory visualization of a real exploit against PHP 8.4.26's Steal My Bitcoin challenge, to PHP's source code internals and engine, to the exploit code itself. How two CVEs in PHP's core (CVE-2026-109618 & CVE-2026-109619) chain an out-of-memory crash into remote code execution
PoC: MaSSHole
MaSSHole v1.3.0: detection-only checker for *sshole (CVE-2026-123158), with Docker test lab
PoC: check-sshole
Read-only exposure and compromise check for CVE-2026-123158, the musl-only OpenSSH password-auth bypass
PoC: CVE-2026-83844
Technical Exploitation Analysis of Paint2Shell CVE-2026-83844
PoC: CVE-2023-34468-Apache-NiFi-RCE
CVE-2023-34468: Apache NiFi 1.21.0 Remote Code Execution (ExecuteProcess Variant) - Security Research & Analysis by Mohammed Moshii
PoC: cve-2026-98432-mitigation
Temporary nftables mitigation for CVE-2026-98432 (critical TCP/IPv4 handshake use-after-free in the Linux kernel)
PoC: salt-cve-2020-11651-poc
Dependency-free PoC for SaltStack CVE-2020-11651/11652 that runs on modern Python (pyzmq + msgpack, no salt library)
PoC: GhostKey
Ephemeral root through CVE-2026-98260 vulnerability (GhostKey).
PoC: 360-kidwatch-11X-W370-Ghostroot
A stealthy, file-based Local Privilege Escalation (LPE) PoC for 360 11X W370 (Unisoc SC8541E, Android 8.1) exploiting CVE-2025-31710. No PC required. For research only.
PoC: CVE-2026-96838
CVE-2026-96838: Cross Site Request Forgery (CSRF) in Blacklist Manager for WooCommerce WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-95597
CVE-2026-95597: Unauthenticated Settings Change in PGALL for WooCommerce (????? ?? ????) WordPress Plugin. PoC by Mor Golan.
PoC: cve_2026_98432_livepatch
Reference livepatch for CVE-2026-98432 on Ubuntu 22 5.15.0-71-generic
PoC: CVE-2026-94641
CVE-2026-94641: Unauthenticated Cross Site Scripting (XSS) in UsersWP WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-94074
CVE-2026-94074: Unauthenticated Broken Access Control in Simply Schedule Appointments WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-61989
CVE-2026-61989: Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-39732
CVE-2026-39732: Unauthenticated SQL Injection in Transliterator WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-122675
CVE-2026-122675: Cross Site Request Forgery (CSRF) in Wp Social WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-115596
CVE-2026-115596: Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-112869
CVE-2026-112869: Unauthenticated Cross Site Scripting (XSS) in We're Open! WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-112222
CVE-2026-112222: Broken Access Control in Surfer WordPress Plugin. PoC by Mor Golan.
PoC: SOC-wordpress-compromise-report
Incident report: WordPress compromise via Simple File List RCE (CVE-2020-35489)
PoC: CVE-2026-19868
SonicWall SonicOS SSLVPN SAML / MFA bypass (Gen7 / Gen8)
PoC: w25-cve-2026-43499-notes
Field notes: CVE-2026-43499 on Samsung Galaxy W25 (SM-W9025, CHC) - offsets, failed routes, repro
PoC: module-sessionreaper-patch
Free security patch for Magento Open Source and Mage-OS by Big Cart Energy: closes CVE-2025-54236 (SessionReaper) on the Magento 2.3 and 2.4 releases that have no official fix, as one plugin on the Web API input processor that applies the allow-list of Adobe's fix. No core file is modified.
PoC: module-cosmicsting-patch
Free security patch for Magento Open Source and Mage-OS by Big Cart Energy: closes CVE-2024-34102 (CosmicSting) on the Magento 2.3 and 2.4 releases that have no official fix, as one plugin on the Web API input processor that applies the rule of Adobe's fix. No core file is modified.
PoC: MiTV-MFTP0-GhostLock
GhostLock (CVE-2026-43499) port for Xiaomi MiTV-MFTP0 (alita / L65R8-X), MediaTek MT9652, Android 9, kernel 4.9.118 - futex PI UAF LPE, full partition map, TvService backdoor analysis.
PoC: CVE-2026-109618
Test the CVE-2026-109618 in a safe environment (VMware, VirtualBox,...)
PoC: redmi-k50-temp-root
Redmi K50 (rubens) 临时 Root 教程 — 基于 DirtyFrag (CVE-2026-43284) + libbase fallback
PoC: keycloak-saml-scanner
Detection-only triage for CVE-2026-117691 (CVSS 9.1): Keycloak SAML HTTP-Redirect binding signature bypass, fixed in 26.8.2
PoC: CVE-2026-123014---iTerm2-Terminal
PoC and research for CVE-2026-123014: iTerm2 x-man-page NUL-byte argument injection.
PoC: sshole
A simple reproducer for CVE-2026-123158
PoC: CVE-2026-83844-Detection
Detection and remediation scripts for CVE-2026-83844, Windows Paint remote code execution (CVSS 8.1)
PoC: cve-2026-123158-openssh-musl-lab
Automated Terraform lab environment for OpenSSH on Linux with musl libc without PAM (CVE-2026-123158 research)
PoC: CVE-2026-123488-POC
POC exploit for CVE-2026-123488 - unauthenticated SQL injection vulnerability in Craft CMS (MySQL/MariaDB backend). Admin takeover.
PoC: cve-2026-48356-magento-file-upload-rce
CVE-2026-48356 - Adobe Commerce/Magento Unrestricted File Upload RCE | CVSS 9.3 | By Gh0st-Bx1
PoC: cve-2025-32433-erlang-ssh-preauth-rce
CVE-2025-32433 - Erlang/OTP SSH Pre-Authentication RCE | CVSS 10.0 | By Gh0st-Bx1
PoC: cve-2026-97229-gitlab-ci-rce
CVE-2026-97229 - GitLab CE/EE CI/CD Integer Overflow RCE | CVSS 10.0 | By Gh0st-Bx1
PoC: CVE-2026-118423-WP-Libre-Form
Sable Research — Analysis of CVE-2026-118423: Unauthenticated Arbitrary File Upload to RCE in WP Libre Form (≤ 1.5.0.1)
PoC: mysql-connector-j-cve-2026-101678-repro
Reproducer for CVE-2026-101678 (MySQL Connector/J <= 26.7.0) - malicious server reporting huge result-set column count
PoC: php2shell-lab
PHP session.upload_progress CVE-2026-109618 lab PoC and research notes
PoC: CVE-2026-123158_SSHRole_PoC
Prova de conceito para exploração da vulnerabilidade CVE-2026-123158.
PoC: cve-2026-113615-poc
CVE-2026-113615 - GS JWT <= 1.0.0 unauthenticated SQLi to administrator JWT (PoC + exploit by thiscitze)
PoC: openssh-musl-enterprise--hardening-cve-2026-123158
openssh-musl-enterprise-hardening (CVE-2026-123158)
PoC: CVE-2015-1201-wordpress-Reflex-Gallery-plugin-RCE-PoC
PoC exploit for CVE-2015-1201 (EDB-36374) — Unauthenticated Arbitrary File Upload to Remote Code Execution in WordPress Reflex Gallery Plugin ≤ 3.1.3. Features interactive webshell, reverse shell mode, and multi-path upload fallback.
PoC: logsign-rce
Logsign Unified SecOps Platform: Pre-Auth Authentication Bypass (CVE-2024-5716) & RCE (CVE-2024-5717) Exploit Chain & Detection Suite
PoC: CVE-2026-118423
CVE-2026-118423 — WP Libre Form <= 1.5.0.1 unauthenticated file upload to RCE (PoC, lab-verified)
PoC: CVE-2026-83844-PoC-MS-paint-v-11.2609.401.0
A proof of concept for CVE-2026-83844. Microsoft paint version 11.2609.401.0
PoC: sshole_scanner-CVE-2026-123158
A scanner for *sshole SSH vulnerability (CVE-2026-123158)
PoC: cortex9-openssl-asn1-string-nul-scanner
Lexical scanner for ASN1_STRING uses that assume NUL termination (CVE-2021-3712). Labels are NUL_SINK_WARNING, BOUNDED_PATTERN or UNKNOWN; heuristic, not a flow analysis.
PoC: cortex9-rust-regex-empty-repetition-size-limit-model
Offline model of the regex 1.5.4 compile-size accounting for empty repetitions (CVE-2022-24713), checked against regex-syntax HIR and real compile results. Bounded cases are labelled MODEL_LIMIT.
PoC: cortex9-node-tar-path-sanitization-model
Offline Python port of node-tar path sanitization (CVE-2021-32804, CVE-2021-37713) with a differential check against the original CHECKPATH logic. No archives are extracted.
PoC: cve-2026-100109-poc
CVE-2026-100109 - Security For WooCommerce 1.0.10-1.0.16 unauthenticated admin creation (PoC by thiscitze)
PoC: cve-2026-114630-poc
CVE-2026-114630 - ELEX HelpDesk <= 3.3.8 unauthenticated arbitrary file deletion (PoC by thiscitze)
PoC: cve-2026-118423-poc
CVE-2026-118423 - WP Libre Form <= 1.5.0.1 unauthenticated upload to RCE (PoC by thiscitze)
PoC: cortex9-heartbleed-heartbeat-bounds-model
Offline model of the OpenSSL heartbeat bounds check (CVE-2014-0160) over an in-memory record and a labelled simulated region. No TLS, no real memory.
PoC: cortex9-rust-str-repeat-capacity-overflow-model
Abstract execution of Rust [T]::repeat capacity arithmetic in 1.29.0 vs 1.29.1 (CVE-2018-1000810) for 16/32/64-bit usize. Allocates nothing.
PoC: cortex9-expat-utf8-name-validation-model
Offline Python model of expat's UTF-8 name checks before/after the CVE-2022-25235 fix, with an independent RFC 3629 decoder. No XML parsing of untrusted input.
PoC: cortex9-dirtycow-gup-cow-state-model
Finite state/interleaving model of the GUP FOLL_WRITE/COW race vs MADV_DONTNEED (CVE-2016-5195). Abstract states only, no syscalls.
PoC: cortex9-expat-namespace-separator-model
Offline Python model of expat addBinding/namespace-separator handling in 2.4.4, 2.4.5 and 2.4.7 (CVE-2022-25236). String-level only.
PoC: cortex9-tmpfiles-hardlink-chown-race-model
Limited educational in-memory FS model of systemd-tmpfiles path_set_perms vs hardlinks (CVE-2017-18078). Not a finding; no real files.
PoC: vsftpd-2.3.4-backdoor-vulnerability_analysis
Hands-on vulnerability assessment of the vsftpd 2.3.4 backdoor (CVE-2011-2523) in an isolated lab.
PoC: cortex9-time-crate-env-race-interleaving-model
Finite interleaving model of time 0.2.22 tzset/getenv vs setenv realloc (CVE-2020-26235). No threads, libc or real environment.
PoC: vsftpd-2.3.4-backdoor-vulnerability-analysis
Hands-on vulnerability assessment of the vsftpd 2.3.4 backdoor (CVE-2011-2523) using Kali Linux, Nmap, Metasploit and an isolated Metasploitable 2 lab.
PoC: CVE-2026-83844
CVE-2026-83844
PoC: check-sshole
Find Dockerfiles that ship an sshd exposed to *sshole (CVE-2026-123158). CLI, pre-commit hook and GitHub Action.
PoC: CVE-2026-123025
OS command injection as root via Google Cloud DNS challenge key
PoC: ansible-sshole-remediate
Ansible playbook that upgrades OpenSSH to 10.6p2 on Alpine Linux to remediate CVE-2026-123158
PoC: CVE-2026-98260-pkt110-kernelsu
CVE-2026-98260 (posix-cpu-timers UAF) to KernelSU on a bootloader-locked OPPO PKT110: exploit core, on-device app, and the research write-up.
PoC: cortex9-openssl-bn-mod-sqrt-loop-model
Pure-Python port of OpenSSL BN_mod_sqrt before/after the CVE-2022-0778 fix, with a step budget on the loops that can grow. Offline.
PoC: cortex9-lodash-defaultsdeep-prototype-pollution-model
Python model of lodash _.defaultsDeep 4.17.11 vs 4.17.12 (CVE-2019-10744) in a throwaway realm. No JS engine, no gadgets.
PoC: cortex9-git-case-insensitive-symlink-checkout-model
In-memory model of git's checkout lstat cache before/after 684dd4c2b414 (CVE-2021-21300). No git, no clone, nothing written to disk.
PoC: cortex9-rust-zip-size-hint-overflow-model
Safe-Rust model of core Zip TrustedRandomAccess before/after rust-lang/rust PR #82289 (CVE-2021-28879). Model indices only; not a reproduction.
PoC: cortex9-git-safe-directory-discovery-model
In-memory model of git repository discovery and the safe.directory ownership check (CVE-2022-24765). Never runs git or touches the real FS.
PoC: cortex9-http2-priority-churn-cost-model
Offline Rust model of the HTTP/2 priority tree with a work counter and nginx PRIORITY budget (CVE-2019-9513 study). No sockets; not a reproduction.
PoC: Shizuka
Post-root DirtyFrag (CVE-2026-43284) mitigation for Galaxy S25 — a build-gated KernelSU kernel module that privatizes ESP receive buffers. Verified on SM-S931Z / DZIF only.
PoC: CVE-2026-120209
Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation | RCE
PoC: sshole-bypass-openssh-password
sshole漏洞复现，CVE-2026-123158
PoC: cortex9-rust-batbadbut-args-model
Offline model of Rust std 1.77.1 vs 1.77.2 batch-file argument quoting (CVE-2024-24576). No processes, no cmd.exe; real cmd behaviour UNKNOWN.
PoC: cortex9-http2-rapid-reset-stream-accounting-model
Discrete-time Rust model of HTTP/2 stream accounting vs handler work for studying Rapid Reset (CVE-2023-44487). Not a reproduction, no sockets.
PoC: ghostlock-a55x
CVE-2026-43499 target port for Samsung Galaxy A55 5G (SM-A556, Exynos 1480, 6.1.157-android14-11) - offsets, P0 fingerprints, KernelSU pair
PoC: cortex9-terrapin-strict-kex-model
Abstract state model of SSH sequence numbers and OpenSSH strict KEX for studying Terrapin (CVE-2023-48795). Not a reproduction.
PoC: CVE-2026-98260-amg-an00
CVE-2026-98260 port for HONOR AMG-AN00 (SM8650 / 6.1.157-android14-11)
PoC: root-my-s24-on-oneui6.1
Using CVE-2026-43499 to root your Galaxy S24 Series on oneui 6.1(successful on 6.1.75-android14-11-29543898-abS9210ZHS4AYB3)
PoC: verification-gap-cve-2026-98432
A Patch Without Proof: the verification gap behind CVE-2026-98432
PoC: CVE-2026-118570
CVE-2026-118570 — CSRF on the Drupal fasttoggle toggle route
PoC: CVE-2026-109619-ZendPipelineLab
PHP CVE-2026-109619 stale session state: calibrated mod_php lab reproduction, evidence, and solver
PoC: CVE-2026-22765-poc
Unauthenticated RCE chain PoC for Dell Wyse Management Suite On-Prem < 5.5 (CVE-2026-22765 + CVE-2026-22766)
PoC: alpinegate
Find which images and containers run a vulnerable Alpine + OpenSSH combination (CVE-2026-123158) — five-condition check, zero network, first-hour playbook.
PoC: CVE-2026-118569
CVE-2026-118569 — any editor could publish every draft on a Drupal site
PoC: omada-advisory-check
Unofficial offline checker: Omada gateway firmware vs TP-Link bulletin 132084 (CVE-2026-19586). Not affiliated with TP-Link.
PoC: php2shell-coverage-check
Checks that Tenable scanning is set up to detect PHP2Shell (CVE-2026-109618, CVE-2026-109619) on every PHP host: plugin feed, credentials, and scan settings. Lists the hosts to rescan and flags end-of-life PHP. Works with Tenable Vulnerability Management, Security Center, and .nessus files. Claude Code skill or standalone script.
PoC: sshole-guide
OpenSSH sshole(CVE-2026-123158) 알파인 sshd 점검을 벨로키와 쉽게 보기
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free