## Summary Using `Database#create_aggregate`, `#create_aggregate_handler`, or `Database#define_aggregator` to define an aggregate function that takes two or more arguments, and then evaluating it over TEXT or BLOB column values, can free the Ruby objects holding those arguments while a later argument is still being converted, during ordinary garbage collection. The aggregate's `step` method then receives an incorrect object, or the process crashes with a segmentation fault. ## Mitigation Upgrade to sqlite3 gem v2.9.6 or later. There is no reliable workaround. If you cannot upgrade, avoid defining aggregate functions that take two or more arguments. Restricting column value sizes is not a mitigation: smaller values make the defect fire less often but do not prevent it. ## Severity The sqlite3-ruby maintainers assess this as Medium severity (CVSS 4.0 score 6.3). It is reached through ordinary garbage collection without any unusual code structuring: an application is exposed whenever it evaluates a multi-argument aggregate over TEXT or BLOB values whose size an attacker can influence. The demonstrated impact is an incorrect value passed to the aggregate's `step` method, or a process crash; no controlled memory write or general denial-of-service exploit has been demonstrated. ## Credits Reported by Jeremy Daer ([@jeremy](https://github.com/jeremy)).
PoC: CVE-2026-112445
CVE-2026-112445: The Simplest macOS Local Privilege Escalation to Date
PoC: CVE-2026-112706-CoreMedia-fd-leak
Independent discovery & coordinated disclosure: CoreMedia bytestream XPC (mediaplaybackd) vended live file descriptors for protected paths to any sandboxed app on iOS 26.5–27.0.1. Fixed in iOS 27.2 as CVE-2026-112706. PoC + evidence.
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: brotli-node2shell-check
Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder
PoC: php2shell-lab
Lab reproduction, exposure probe and detection content for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell). Defensive research; no exploit.
PoC: PHP2SHELL-Checker-v-2.0-CVE-2026-115560-
Versión 2.0 — añade barrido de hosts remotos vía HTTP a la v1.0. Cuando se ejecuta sin argumentos muestra un menú interactivo.
PoC: ghostlock-tv
adb-to-root kernel LPE (GhostLock CVE-2026-43499) for the onn 4K Pro Google TV: futex PI UAF to write primitive to credential swap to uid 0, on locked verified-boot hardware
PoC: CVE-2026-71195
Offline Python detector for CVE-2026-71195 exposure in OpenStack Manila, with branch-aware rules, CSV/JSON inventories, and auditable reports.
PoC: CVE-2026-94300
Offline Python detector for CVE-2026-94300 exposure in ISC BIND 9, with edition-aware rules, CSV/JSON inventories, and auditable reports.
PoC: cve-2026-109618-cve-2026-109619-poc
pHp2Shell CVE 2016 109618 - 109619
PoC: php2shell
Realistic multi-version lab + toolkit for the PHP php2shell pre-auth RCE (CVE-2026-109618/109619): detect, blindly prove, and understand it. No shared mounts, no planted files, no LFI.
PoC: charla-php2shell
PHP2Shell (CVE-2026-109618/109619): demos reproducibles y guia de parcheo paso a paso.
PoC: PHP2shell
CVE-2026-109618_CVE-2026-109619
PoC: waffers
The layer that protects you. Proactive defense-in-depth Web Application Firewall mitigating recent critical PHP engine vulnerabilities including PHP2Shell (CVE-2026-109618/9), PHP-CGI Argument Injection (CVE-2024-4577), iconv Filter Chains (CVE-2024-2961), and stream wrapper abuse.
PoC: node2shell-inventory-scanner
Local inventory triage for Node2Shell (CVE-2026-111497): grade every Node, Bun and Brotli copy on disk. Detection-only, no network probes, no payloads.
PoC: php2shell-check
A Claude Skill that passively checks whether a website (and optionally its subdomains) runs PHP, confirms the version where possible, and flags exposure to PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: CVE-2026-97631-PoC
An educational laboratory for studying a PXE network-boot vulnerability in EDK II / OVMF. It builds a pinned EDK II revision, boots a UEFI virtual machine in QEMU, and includes Python proof-of-concept scripts for investigating denial of service (DoS) and memory corruption.
PoC: practica-integradora-ciberseguridad
Práctica Integradora de Ciberseguridad (Comisión 1) - Investigación, análisis técnico y laboratorio práctico de CVE-2021-41773 (Apache HTTP Server)
PoC: node2shell-audit
Read-only audit for Node2Shell (CVE-2026-111497): Node.js/Bun Brotli decoder out-of-bounds write
PoC: cve-2026-111497-wordpress-poc
CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress
PoC: demo-zip-rce-sandbox
Live demo: the same vulnerable Rust zip crate (RUSTSEC-2026-0367 setuid + CVE-2026-115905 zip cloaking) contained by a deny-by-default Cosmonic WebAssembly sandbox.
PoC: php2leak
Remote Zend MM ASLR leak testbed (PHP CVE-2026-109618 / CVE-2026-109619)
PoC: CVE-2026-101767-research
Research notes on CVE-2026-101767 — unauthenticated vulnerability in Oracle Application Object Library (E-Business Suite)
PoC: threat-intelligence-log4shell-analysis
Cybersecurity research project analyzing threat intelligence feeds, Log4Shell (CVE-2021-44228), attack progression, remediation, incident response, and threat hunting.
PoC: CVE-2026-15723
Offline Python detector for CVE-2026-15723 version exposure in self-managed GitLab CE/EE, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-105014
Offline Python applicability detector for CVE-2026-105014 in Azure Pipelines, with strict CSV/JSON inventories and auditable reports.
PoC: CVE-2026-114625
Offline Python detector for CVE-2026-114625 exposure in on-premises VeloCloud Orchestrator, with train-specific build checks and auditable reports.
PoC: CVE-2026-97785
Offline Python applicability detector for CVE-2026-97785 in Microsoft Entra application proxy, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-83938
Offline Python applicability detector for CVE-2026-83938 in Azure Kubernetes Configuration Service, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-110063
Offline Python applicability detector for CVE-2026-110063 in Azure VM Inspector, with strict CSV/JSON inventories and auditable reports.
PoC: php56-amzn1-security
Security-patched php56 RPMs for Amazon Linux 1 (AMI 2018.03): PHP2Shell (CVE-2026-109618, CVE-2026-109619) and post-5.6.40 fixes backported from deb.sury.org
PoC: CVE-2026-109618-exploit
[PHP2Shell] Golang exploit for CVE-2026-109618 / CVE-2026-109619: Unauthenticated RCE in PHP 5.4–8.5.11 via OOM corruption + session.upload_progress UAF
PoC: CVE-2026-93903
Security advisory for CVE-2026-93903 affecting LiteSpeed Web Server.
PoC: s25u-ghostlock-kernelsu-lkm
Galaxy S25 Ultra (SM-S9380): GhostLock/CVE-2026-43499 memory-only root + KernelSU LKM via kallsyms prelink; Zygisk findings
PoC: cve-2026-98260-uaf
CVE-2026-98260 (posix-cpu-timers exec UAF) exploit research: S9280 Android 14 GKI 6.1 — UAF trigger + zero-write primitive + SELinux Permissive. Handoff doc in HANDOFF.md
PoC: copy-fail-CVE-2026-31431-aarch64
Linux 4.19 aarch64 PoC for CVE-2026-31431 (Copy Fail) - AF_ALG/authencesn page-cache write
PoC: aia-pdfjs-poc
CVE-2024-4367 PDF.js FontMatrix PoC - authorized pentest artifact
PoC: CVE-2025-10035
CVE-2025-10035 is a critical vulnerability in Fortra GoAnywhere MFT that may allow attackers to execute commands remotely on a vulnerable server.
PoC: CVE-2026-35223-Joomla-Access-Control
Proof of Concept for CVE-2026-35223 – Joomla Improper Access Control
PoC: php2shell-audit
Non-intrusive detector for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) - scans codebases and live hosts for vulnerable PHP versions and risky config. Detection, not exploitation.
PoC: TimerRoot
Android front end for CVE-2026-98260: root shell + KernelSU late-load through Shizuku
PoC: php2shell-fixed-images
Reproducible RHITE fixed PHP runtime images for CVE-2026-109618 and CVE-2026-109619
PoC: php-worker-pin
Multi-worker exploitation of the PHP 8.5 OOM-to-RCE chain (CVE-2026-109618/109619): pool pinning, measured
PoC: PHP2SHELL-Lab
Laboratorio para detectar y explotar las vulnerabilidades CVE-2026-109618 y CVE-2026-109619
PoC: CVE-2026-79397-Authenticated-OS-Command-Injection-in-ONT-4GE-RFDW-Ping-Diagnostics
Authenticated OS command injection in ONT-4GE-RFDW’s Ping diagnostics exploitable via default credentials.
PoC: rw-salon
CVE-2024-4442
PoC: rw-tutor
CVE-2024-4223
PoC: CVE-2026-111497-DOS-
CVE-2026-111497 DOS
PoC: rw-stock
CVE-2024-36779
PoC: php2shell-nse-scanner
Advanced Nmap Scripting Engine (NSE) script designed to identify PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619). Features multi-layer Black-Box analysis resilient against WAF, proxies, and header stripping.
PoC: rw-web-directory-free
CVE-2024-3552
PoC: cve-2025-27740
Proof-of-concept exploit for CVE-2025-27740 Subject Key Identifier injection in Active Directory Certificate Services
PoC: rw-country-state-city-auto-dropdown
cve-2024-3495
PoC: rw-fluentform
CVE-2024-2771
PoC: CVE-2023-42824
PoC / exploit archive for CVE-2023-42824
PoC: CVE-2024-4443
PoC / exploit archive for CVE-2024-4443
PoC: CVE-2024-7120
PoC / exploit archive for CVE-2024-7120
PoC: CVE-2024-8503
PoC / exploit archive for CVE-2024-8503
PoC: CVE-2025-24000
PoC / exploit archive for CVE-2025-24000
PoC: CVE-2025-30567
PoC / exploit archive for CVE-2025-30567
PoC: CVE-2025-54726
PoC / exploit archive for CVE-2025-54726
PoC: CVE-2025-58443
PoC / exploit archive for CVE-2025-58443
PoC: CVE-2026-19632
PoC / exploit archive for CVE-2026-19632
PoC: CVE-2026-31635
PoC / exploit archive for CVE-2026-31635
PoC: node2shell-status
Node2Shell / Broccoli2Shell (CVE-2026-111497) vendor and Linux distro status - AI-generated, verify before acting
PoC: PHP2shell
One-click exploit PoC for CVE-2026-109618 and CVE-2026-109619 against vulnerable PHP + Apache mod_php (prefork) targets.
PoC: CVE-2026-116692
PoC / exploit archive for CVE-2026-116692
PoC: CVE-2026-114595
CVE-2026-114595
PoC: CVE-2026-86426
PoC / exploit archive for CVE-2026-86426
PoC: CVE-2026-98260-y700-TB321FU-lpe
CVE-2026-98260 adaptation for Lenovo Legion Y700 2025 (TB321FU) / 1.1.10.138 boot image, kernel 6.1.112-android14-11
PoC: CVE-2019-18935
PoC / exploit archive for CVE-2019-18935
PoC: cve-2026-43499-mt6896-pd2238
cve-2026-43499 exploit on vivo's MT6896 device PD2238.
PoC: trojan-source-check
CI scanner for Trojan Source attacks: bidi control characters (CVE-2021-42574), mixed-script identifiers (CVE-2021-42694), invisible zero-width chars. Stdlib only.
PoC: php2shell-cve-2026-109618-109619
calibrated php2shell payloads for common docker images
PoC: mlflow-scorer-scanner
Detection-only triage scanner for MLflow scorer RCE CVE-2026-116692: version check via the /version endpoint. No payloads, no scorer invocation.
PoC: cve-2026-98260-nezha
CVE-2026-98260: Xiaomi 17 Ultra (nezha) temporary root + KernelSU PoC - scripts, docs and logs only; exploit built from upstream source
PoC: work1-secure-api
HDU IS Work 1 - Secure REST API (Flask) with CI/CD (pytest + bandit + pip-audit) and CVE-2018-17246 analysis
PoC: php80-scl-el7-rebuild
Unofficial rebuild of Remi's php80-php 8.0.30-21 SCL packages for CentOS/RHEL 7 (EOL). Includes all 44 CVE fixes between Remi -6 and -21, among them CVE-2026-109618 / CVE-2026-109619 (PHP2Shell).
PoC: Triagem-de-Explora-o-CVE-2024-49138-detectada
Triagem de Alerta SOC 335, que destaca a exploração da vulnerabilidade CVE-2024-49138 , uma vulnerabilidade de escalonamento de privilégios do Windows.
PoC: CVE-2026-42530
CVE-2026-42530 - NGINX HTTP/3 (QPACK) UAF
PoC: CVE-2026-1277
PoC / exploit archive for CVE-2026-1277
PoC: CVE-2026-105482-Reproduce
CVE-2026-105482漏洞复现
PoC: cve-gitea
CVE-2022-30781
PoC: shellshock-linux-host-hardening-lab
Controlled penetration testing and Linux host-hardening lab demonstrating Shellshock (CVE-2014-6271), privilege escalation, vulnerability assessment and defensive security controls.
PoC: php-scare-counted
Verification artifacts for 'How I replicated PHP2Shell, and 5 ways we got super lucky' — checkers for every claim: the fix that shipped nowhere, the four-architecture map, the two-gate leak bands, and the blind-fire arithmetic (CVE-2026-109618/109619)
PoC: CVE-2026-102785
PoC / exploit archive for CVE-2026-102785
PoC: php2shell-poc
PHP2Shell — CVE-2026-109618/109619 exploit toolkit: 5 chains + JA3 stealth + mass scan + safe webshell. Authorized testing only.
PoC: CVE-2026-5054
CVE-2026-5054: writeup + PoC
PoC: CVE-2026-5053
CVE-2026-5053: Writeup + PoC
PoC: brotli-pingback-lab
WordPress XML-RPC pingback lab and crash PoC for CVE-2026-111497 (Brotli decoder out-of-bounds write).
PoC: CVE-2026-48356
PoC / exploit archive for CVE-2026-48356
PoC: bkwld-decoy-cve-2026-116471
Security research and documentation for BKWLD Decoy 5.11.1 — CVE-2026-116471.
PoC: CVE-2026-40281
PoC / exploit archive for CVE-2026-40281
PoC: DotNet-HTTP2Shell-CVE-2026-111497
CVE-2026-111497 - .NET Brotli OOB Write PoC and Exploit (HTTP2Shell) | By Gh0st-Bx1
PoC: CVE-2026-102785
CVE-2026-102785: YOOtheme Pro 5.0.0-5.0.52 unauthenticated RCE via image handler signature reuse + path traversal + JPEG/PHP polyglot. CVSS 10.0. Check script, exploit, detection rules.
PoC: lg-webos2-root
Persistent root for LG webOS 2.x TVs (CVE-2014-3153)
PoC: brotli-k8s-scan
Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries themselves, not just version numbers, so it catches bundled copies in Node.js, Python, .NET, Bun and Envoy. Read-only, bash only.
PoC: CVE-2026-97798-exploit
CVE-2026-97798 Windows Error Reporting - Command Injection TO SYSTEM
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free