Duplicate Advisory: PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments

PoC: CVE-2026-112611

CVE-2026-112611: OOB Write in CoreGraphics (PDF ShadingType 5) via /N and /C0 array mismatch. Causes heap overflow (DoS). The Python PoC generates the malicious PDF, while the C-code uses a SIGSEGV handler to map the faulting memory and confirm the write primitive.

PoC: opd2051example

Android front end for CVE-2026-98260 (OPD2501) via Shizuku

PoC: CVE-2026-111497

Node2Shell

PoC: Time-My-Galaxy

CVE-2026-98260 timerfd exploit and Shizuku launcher for the Samsung

PoC: zyxel-cve-2026-6952-model-scope

Vendor advisory scope, model-by-model evidence, and bounded offline reproduction for CVE-2026-6952

PoC: CVE-2026-119977

Read-only local WordPress version assessment for CVE-2026-119977.

PoC: CVE-2026-123488-CraftCMS-Lab

PoC for CVE-2026-123488: unauthenticated SQLi in the element search endpoint (CWE-89) escalating to admin via stacked UPDATE;

PoC: m6-shell

M6 Shell：荣耀 Magic6 Pro (BVL-AN16) 一键临时 root。Shizuku 拿 shell + CVE-2026-98260 UAF + 装载匹配内核的 KernelSU 模块，源码与构建产物都在这。

PoC: meizu20pro-temp-root

MEIZU 20 Pro 临时 Root 指南（锁定 BL）：DirtyFrag (CVE-2026-43284) 与 GhostLock (CVE-2026-43499)

PoC: tenda-ac6-cve-2026-4961-patch

Patched firmware + analysis for Tenda AC6 CVE-2026-4961 (/goform/QuickIndex). Version bumped to V15.03.05.17.

PoC: sshole-lab

A Docker lab that reproduces **"*sshole"** (CVE-2026-123158), an authentication bypass in OpenSSH `sshd` when it is built against **musl libc** and **without PAM**. An account whose `/etc/shadow` password field is `*` (for example, a key-only account) accepts any password between 257 and 1024 bytes.

PoC: CVE-2026-122056

A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted XCCDF document.

PoC: CVE-2023-33107-SO51A

Temporary root Xperia 1ii (SO-51A)

PoC: CVE-2026-83844-public

Out-of-bounds read in the legacy Microsoft Paint C2PA/JUMBF provenance parser (CVE-2026-83844): report, Paint reproducer, and reverse-engineering evidence.

PoC: pickle-sentry

Scan code and dataset files for unsafe pickle deserialization — including the Hugging Face datasets pandas builder RCE (CVE-2026-57845). Never executes the files it inspects.

PoC: CVE-2012-0694-SugarCRM-PoC

Python 3 proof-of-concept generator for CVE-2012-0694, a PHP deserialization vulnerability affecting SugarCRM CE ≤ 6.3.1. Supports custom command payloads, Base64 encoding, and execution verification.

PoC: is-lab2

Лаба 2 ИБ: анализ и устранение CVE-2021-44228 (Log4Shell) на Vulhub

PoC: SSI-cve-39883-lab

Security lab for CVE-2026-39883 (untrusted search path in the OpenTelemetry Go SDK on FreeBSD): walkthrough, experiment script and least-privilege lesson

PoC: CVE-2026-92606

Pardus MyComputer fstab TOCTOU race condition: research, proof of concept, and demonstration video for CVE-2026-92606.

PoC: CVE-2026-94434

Pardus Boot Repair Btrfs subvolume command injection: research, proof of concept, and demonstration video for CVE-2026-94434.

PoC: CVE-2026-118378-tabularis-PoC

CVE-2026-118378: SQL injection in Tabularis SQLite driver via MCP describe_table (fixed in 0.28.0)

PoC: CVE-2026-123158-LAB

musl libc를 쓰는 Apline의 OpenSSH에서 비밀번호 인증을 우회하는 취약점 (sshhole, CVE-2026-123158)을 이해하고 검증하기위해 작성함

PoC: CVE-2026-123488

CVE-2026-123488

PoC: cortex9-geonode-layer-name-command-injection-model

Offline educational model of CVE-2026-33050 (GeoNode layer-name command injection)

PoC: cortex9-jumpserver-yaml-jinja-sandbox-model

Offline educational model of CVE-2026-31864 (JumpServer YAML Jinja sandbox)

PoC: cortex9-fsspec-reference-jinja-ssti-model

Offline educational model of CVE-2026-104851 (fsspec ReferenceFileSystem Jinja SSTI)

PoC: cortex9-stanza-lemma-pickle-to-json-model

Offline educational model of CVE-2026-115878 (Stanza lemma pickle→JSON)

PoC: cortex9-httpx2-cl-te-framing-conflict-model

Offline educational model of CVE-2026-84380 (HTTPX2 CL/TE framing conflict)

PoC: cortex9-lact-polkit-pid-subject-bypass-model

Offline educational model of CVE-2026-75037 (LACT polkit PID subject bypass)

PoC: cortex9-pingora-http10-te-smuggling-model

Offline educational model of CVE-2026-2835 (Pingora HTTP/1.0 TE smuggling)

PoC: cortex9-open-webui-proxy-multidecode-traversal-model

Offline educational model of CVE-2026-54017 (Open WebUI proxy multi-decode path traversal)

PoC: security-research

Vulnerability Research, Non-Destructive CVE Verification (CVE-2026-23813 ArubaOS-CX), & Automated Linux/PHP Hardening Suites — by Abishek M A (CyberAeonic)

PoC: cortex9-git-diff-shell-hash-object-injection-model

Offline educational model of CVE-2026-110634 (git-diff shell hash-object injection)

PoC: cortex9-nuxt-dot-segment-middleware-bypass-model

Offline educational model of CVE-2026-119200 (Nuxt dot-segment middleware bypass)

PoC: cortex9-oauthlib-token-grant-client-id-confusion-model

Offline educational model of CVE-2026-118669 (OAuthLib token-grant client_id confusion)

PoC: cortex9-zitadel-saml-idp-intent-mismatch-model

Offline educational model of CVE-2026-109372 (ZITADEL SAML IdP intent mismatch)

PoC: cortex9-ksmbd-preauth-info-race-model

Offline educational model of CVE-2026-72422 (ksmbd preauth_info race)

PoC: cortex9-filelock-sqlite-symlink-follow-model

Offline educational model of CVE-2026-112936 (filelock SQLite symlink follow)

PoC: cortex9-trivy-action-envfile-source-injection-model

Offline educational model of CVE-2026-26189 (trivy-action envfile source injection)

PoC: cortex9-argocd-git-ssh-proxy-url-injection-model

Offline educational model of CVE-2026-55797 (Argo CD git SSH ProxyCommand URL injection)

PoC: cortex9-pillow-ghostscript-argv-injection-model

Offline educational model of CVE-2026-112900 (Pillow Ghostscript argv injection)

PoC: cortex9-shell-quote-comment-line-terminator-model

Offline educational model of CVE-2026-102422 (shell-quote comment line terminator)

PoC: cortex9-freeform-attribute-twig-render-model

Offline educational model of CVE-2026-73858 (Freeform attribute Twig render / SSTI)

PoC: cortex9-lz4java-tmp-native-lib-predictable-name-model

Offline educational model of CVE-2026-106451 (lz4-java predictable tmp native library name)

PoC: cortex9-seroval-node-id-type-confusion-model

Offline educational model of CVE-2026-116580 (seroval node-id type confusion)

PoC: cortex9-nltk-pickle-allowlist-prefix-model

Offline educational model of CVE-2026-79657 (NLTK pickle allowlist prefix / gadget names)

PoC: cortex9-keycloak-jwt-grant-alg-confusion-model

Offline differential model of Keycloak JWT grant HMAC algorithm confusion (CVE-2026-11800), educational

PoC: cortex9-fastjwt-empty-key-unsigned-accept-model

Offline differential model of fast-jwt empty-key unsigned token acceptance (CVE-2026-107720), educational

PoC: cortex9-mlflow-webhook-dns-rebinding-toctou-model

Offline educational model of CVE-2026-64849 (MLflow webhook DNS-rebinding SSRF TOCTOU)

PoC: cortex9-phpspreadsheet-redirect-whitelist-ssrf-model

Offline educational model of CVE-2026-108360 (PhpSpreadsheet redirect whitelist SSRF)

PoC: cortex9-nbconvert-output-filename-traversal-model

Offline educational model of CVE-2026-114140 (nbconvert output filename path traversal)

PoC: cortex9-echo-static-encoded-segment-bypass-model

Offline educational model of CVE-2026-118650 (Echo Static encoded-segment middleware bypass)

PoC: cortex9-traefik-replacepathregex-normalization-model

Offline educational model of CVE-2026-65600 (Traefik ReplacePathRegex path normalization / auth bypass)

PoC: cortex9-vikunja-oidc-email-verified-linking-model

Offline differential model of Vikunja OIDC email_verified account linking (CVE-2026-62367), educational

PoC: cortex9-authlib-jws-json-empty-signatures-model

Offline differential model of Authlib JWS JSON empty-signatures bypass (CVE-2026-96760), educational

PoC: cortex9-pyjwt-pem-detection-alg-confusion-model

Offline differential model of PyJWT PEM detection gap (CVE-2026-102268), educational

PoC: Defib

Recover an Android phone hit by the "SMS of Death" modem crash (CVE-2026-58882)

PoC: CVE-2026-124450

OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument

PoC: cortex9-brotli-uncompressed-copy-narrowing-model

Offline arithmetic model of the size_t-to-int narrowing in Brotli's uncompressed block copy (CVE-2020-8927). Arithmetic only: no input read, nothing decompressed.

PoC: cortex9-libxml2-strncat-length-wrap-model

Offline length-arithmetic model of libxml2 xmlStrncat/xmlStrncatNew (CVE-2016-1834), with C11 (UB_STOP) and explicit wrap32 semantics side by side. Lengths only: no strings built, nothing copied.

PoC: Gitea2shell-Sandbox-Escape-to-Host-RCE

PoC for CVE-2026-73802 - Gitea act_runner container.options host namespace escape to root RCE. CVSS 9.9 Critical. Affects runner < 3.0.0.

PoC: cortex9-glibc-getaddrinfo-dual-buffer-state-model

Offline abstract state model of glibc getaddrinfo dual-query UDP buffer handling (CVE-2015-7547). Labelled regions and length comparisons only: no DNS traffic, no memory writes.

PoC: cortex9-libwebp-huffman-table-sizing-model

Offline size-only model of libwebp BuildHuffmanTable table sizing (CVE-2023-4863). Counts entries only: no image decoding, no table writes.

PoC: cortex9-openssl-x400-generalname-type-confusion-model

Offline labelled-heap model of the OpenSSL X.400 address type confusion in GENERAL_NAME_cmp (CVE-2023-0286). Model bytes only: no OpenSSL, no real memory reads.

PoC: cortex9-openssl-sm2-plaintext-size-model

Offline length-arithmetic model of the OpenSSL SM2 decryption buffer sizing (CVE-2021-3711). Sizes only: no cryptography, no buffers, no OpenSSL.

PoC: CVE-2026-124552

PoC for CVE-2026-124552 — Webmin <= 2.670 stored XSS in Shorewall/Shorewall6 list.cgi leading to RCE as root; includes an unpatched path traversal (arbitrary file write as root) found in the same module

PoC: ethical-hacking-tp5-vulnerability-analysis-nmap-nse

TP5 Ethical Hacking: non-destructive vulnerability assessment of Windows 10 with Nmap/NSE, CVE-2024-38063, prioritisation, remediation and re-scan (EMSI)

PoC: CVE-2026-98260-Asteroids

CVE-2026-98260 LPE for Nothing Phone (3a)/(3a) Pro (Asteroids, kernel 6.1.172): uid 0, CAP_SYS_MODULE, KernelSU late-load.

PoC: CVE-2026-92080

Pardus Boot Repair mountpoint path traversal: research, proof of concept, and demonstration video for CVE-2026-92080.

PoC: CVE-2026-123158

Entorno A/B en Docker y PoC del bypass de autenticación por contraseña de OpenSSH 10.6p1 sobre musl sin PAM (CVE-2026-123158), con documentación de reproducción y parcheo.

PoC: CVE-2026-98432-Verified-Attack

Reproduction artifacts for the ASI Lab study of CVE-2026-98432 (Linux IPv4/TCP use-after-free): trigger harness, disassembly verifier, raw evidence, results. WARNING: contains a working kernel-race trigger for unpatched kernels. Handle with care.

PoC: craft-cms-scanner

Detection-only triage for the Craft CMS Nov 2026 batch headlined by CVE-2026-123488 (CVSS 9.8 unauthenticated SQL injection): grade 4.x/5.x installs against the 4.18.9 / 5.11.2 fixes. No traffic, no probes.

PoC: CVE-2026-116567

PoC for CVE-2026-116567 — pre-auth stack overflow in the FreeSWITCH mod_rtmp control-message handler (FreeSWITCH < 1.11.2)

PoC: CVE-2025-48583-PoC

This is PoC for CVE-2025-48583. The PoC only prove that the bug can be trigger through public API

PoC: CVE-2026-113386

IMAP Command Injection via CRLF in the `_uid` Parameter

PoC: cve-2025-59845

A testing sandbox and proof of concept for exploiting the vulnerable Apollo Embedded Sandbox/Explorer

PoC: Tryhackme-PHP2Shell

Documentación técnica del laboratorio PHP2Shell de TryHackMe, centrado en el análisis y explotación de la vulnerabilidad CVE-2026-109619.

PoC: cve-2026-111967

WordPress Plugin MP3 Audio Player by Sonaar <= 5.14 - Stored XSS to Admin Account Creation

PoC: TryHackMe-PHP2Shell-CVE-2026

Análisis de vulnerabilidades PHP2Shell (CVE-2026-109618 y CVE-2026-109619) — TryHackMe

PoC: iqoo-neo5-temp-root

iQOO Neo5 (PD2055) temporary root research: CVE-2026-43499 exploit port, kernel kallsyms extraction (109,641 symbols), vivo OTA protocol crack, boot.img for community analysis

PoC: CVE-2026-63030

CVE-2026-63030 — WordPress Core Pre-Auth RCE (WP2Shell). PoC by NOXCRYPT (noxcrypt-x).

PoC: cve-2026-123158-defender-toolkit

CVE-2026-123158 (SSHole) defender toolkit: exposure audit, log hunts and a safe password switch-off for OpenSSH on Alpine and other musl systems

PoC: coruna-lab

Coruna / CVE-2024-23222 reproduction lab on GitHub-hosted ARM64 runners

PoC: ShellSpectre

⚡ Modern, multi-threaded CLI framework for detecting PHP core multipart vulnerabilities (CVE-2026-109618/19) with zero-false-positive calibration and auto-venv management.

PoC: CVE-2026-83844_POC

Signed Microsoft Paint A/B research lab; CVE trigger not yet confirmed

PoC: pd2301-dirtyfrag-root

iQOO Neo8 (PD2301/V2301A) DirtyFrag 临时 root 完整记录 — CVE-2026-43284 页缓存写 + vivo_coredump shim 劫持 umh

PoC: CVE-2026-13684

CVE-2026-13684 — Synology DSM Arbitrary File Read/Write + DoS

PoC: CVE-2020-13405-MicroWeber-PoC

Proof of Concept and vulnerability research for CVE-2020-13405 affecting Microweber CMS.

PoC: CVE-2026-99273

PoC and containerized lab for CVE-2026-99273 — Linux ksmbd writes a UTF-16 terminator 2 bytes past a 448-byte response buffer in get_file_stream_info() (SMB2 QUERY_INFO FileStreamInformation): exact-fill stream entry and trailing ::$DATA path, guest-reachable. Validated end-to-end on Linux 7.3.0 ef85bad3 (vulnerable, KASAN) vs patched.

PoC: CVE-2019-2215-ForMIpad4

使用CVE-2019-2215 对miui10的小米平板4的临时root获取软件。

PoC: acw3-tls-lab

Local CVE-2026-19553 TLS lab with a guarded Ubuntu 24.04 setup and seven demonstration tests.

PoC: cve-2026-98260-bvl-an16

CVE-2026-98260（exec 非主线程 + POSIX CPU timer UAF）在荣耀 Magic6 Pro（BVL-AN16，内核 6.1.157）上的移植与利用实现：源码、构建脚本、偏移与 slab 参数记录。

PoC: CVE-2026-121265

PoC for CVE-2026-121265 (SQL::Abstract < 2.000003 arrayref SQL injection, CWE-89): INSERT/UPDATE exfiltration, privilege escalation and generate()/AUTOLOAD vectors, validated in a containerized version matrix incl. the array_datatypes=0 bypass of the final patch

PoC: DFRoot-DirtyFrag

Fork de mitschud/DirtyFrag (CVE-2026-43284 page-cache exploit) con port G998U — ko dfroot-android15-5.4.ko embebido para SM-G998U/HZB1 (kernel 5.4.274-qgki). Flujo de app oficial diabl0w/DFRoot; manager KSU oficial me.weishu.kernelsu.

PoC: sonicwall-sonicos-scanner

Detection-only triage for CVE-2026-19868 (SonicWall SonicOS SSL-VPN SAML MFA bypass, CISA KEV 2026-11-06): grade Gen7/Gen8 firmware against the 7.3.4-7013 / 8.2.3-8015 fixes. No traffic, no probes.

PoC: cve-2023-6931-hitv205n

CVE-2023-6931 temporary-root port for Hisense HITV205N (TOUCH Lite), kernel 4.19.157-perf

PoC: CVE-2026-42016_CVE-2026-42018

CVE-2026-42018 / CVE-2026-42016 — JFrog Artifactory Token Chain (Scoped PoC)

PoC: php2shell-deep-dive

A deep technical walkthrough of PHP2Shell from memory visualization of a real exploit against PHP 8.4.26's Steal My Bitcoin challenge, to PHP's source code internals and engine, to the exploit code itself. How two CVEs in PHP's core (CVE-2026-109618 & CVE-2026-109619) chain an out-of-memory crash into remote code execution

PoC: MaSSHole

MaSSHole v1.3.0: detection-only checker for *sshole (CVE-2026-123158), with Docker test lab

PoC: check-sshole

Read-only exposure and compromise check for CVE-2026-123158, the musl-only OpenSSH password-auth bypass