devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

PoC: CVE-2026-112445

CVE-2026-112445: The Simplest macOS Local Privilege Escalation to Date

PoC: OtherActivityToken

Exploit for CVE-2025-0098, Activity token leak due to pid-only check and then use of that token for arbitrary startActivity()

PoC: CVE-2026-98260-GhostKey

GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）

PoC: CVE-2026-98260-vivo-x-fold6-poc

CVE 2026 98260 vivo x fold6 poc

PoC: CVE-2026-98260-PMX110-Root618-Jailbreak

CVE-2026-98260 (exec: posix timer UAF) LKM jailbreak for OPPO Find X10 Pro Max (PMX110) and OnePlus 16 (PYB110): one-command root via shell uid 2000, with KernelSU / FinaSU / SukiSU / KernelSU-Next handover. Release build Root618 1.5.12 (R8-obfuscated).

PoC: CVE-2026-98260-GhostKey

GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）

PoC: brotli-node2shell-check

Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder

PoC: CVE-2026-112705-poc

Crash-only public-API reproducer for CVE-2026-112705 in AVEVideoEncoder

PoC: CVE-2026-98260-vivo-s60-poc

CVE 2026 98260 vivo s60 poc

PoC: node2shell-two-stage

CVE-2026-111497 two-stage Brotli harness: local trigger/error-semantics verification, no exploitation

PoC: ArchonX-PHP2Shell

Pre-auth PHP RCE framework for CVE-2026-109618/619 — ArchonX_DeadLock_Security

PoC: Paranoid-CVE-2026-98432

Drop incoming IPv4 TCP packets whose IP header contains options.

PoC: cve-2026-98432-checker

Check a Linux server for CVE-2026-98432 (IPv4 TCP use-after-free, CVSS 9.8): root cause explained, read-only check script and mitigations.

PoC: gitlab-onigmo-scanner

Detection-only triage for GitLab CVE-2026-97229 (and CVE-2026-110264): grade a self-managed GitLab version plus its Ruby, catch the Oct-12-patch and custom-Ruby traps. No payloads, no network probes.

PoC: panos-php2shell-defense

Open-source hotfix for PAN-OS firewall chain attack PHP2Shell and Fragnesia CVE-2026-109618 and CVE-2026-46300

PoC: oauth-sink-check

Trace untrusted OAuth endpoint URLs from source to shell sink — the CVE-2026-119025 attack class, checked in your code, lockfile and MCP configs.

PoC: PHP2SHELL-Research

Academic research harness and memory corruption analysis framework for PHP core engine vulnerabilities (CVE-2026-109618 / CVE-2026-109619).

PoC: netviser-linux-security-auditor

Read-only, agentless Linux kernel security configuration auditor (local & SSH). Initial focus: TCP migration / MPTCP checks for CVE-2026-98432.

PoC: vulnpocalypse-2026-10-response

Diagnosis and remediation prompt for PHP2Shell (CVE-2026-109618/109619), the Node.js Oct 2026 security release and Brotli CVE-2026-111497. EN + PT-BR. Facts as of 29 Oct 2026.

PoC: CVE-2026-98432

CVE-2026-98432 (Linux IPv4 TCP use-after-free): how to check your server, apply a stopgap, and clean up after the fix

PoC: CVE-2026-98432

Race trigger, heap-reuse oracle, pcap analysis, detection and mitigation tooling for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free).

PoC: pillow-uaf-research

Weaponized CVE-2026-112396 (Pillow heap use-after-free): deterministic heap grooming, file-triggered chain, attacker-chosen post-free writes - verified PoCs, evidence, CI. Plus pypdf CVE-2026-113792 DoS and a fileless macOS memory-injection demo.

PoC: ubuntu-tcp-guide

우분투 커널 TCP 구멍(CVE-2026-98432) 쉽게 보기 · 벨로키 보안 공부

PoC: cve-disclosures

Public security vulnerability disclosures — CVE-2026-78829 / 78830 / 78831 / 78832

PoC: log4shell-audit-13

Log4Shell (CVE-2021-44228) security briefing research: remediation checklist and write-up

PoC: log4shell-audit-12

Quarterly security briefing notes and Log4Shell (CVE-2021-44228) remediation tracking

PoC: log4shell-audit-11

Log4Shell (CVE-2021-44228) remediation tracking and security research notes

PoC: log4shell-audit-10

Tracking repo for our quarterly Log4Shell (CVE-2021-44228) security briefing.

PoC: log4shell-audit-9

Tracking repo for our quarterly Log4Shell (CVE-2021-44228) security briefing.

PoC: log4shell-audit-8

Tracking repo for our quarterly Log4Shell (CVE-2021-44228) security briefing.

PoC: log4shell-audit-7

Tracking repo for our quarterly Log4Shell (CVE-2021-44228) security briefing.

PoC: log4shell-audit-6

Quarterly security briefing tracking — Log4Shell (CVE-2021-44228) remediation

PoC: log4shell-audit-5

Log4Shell (CVE-2021-44228) remediation tracking notes and checklist

PoC: secbyte-cve-exploitation-real-world-vulnerabilities-red-teaming-ctf-labs

A practical collection of cybersecurity CTF labs covering real-world CVE exploitation, zero-day/N-day vulnerability analysis (Citrix Bleed, FortiGate SSL VPN, Apache Superset CVE-2023-27524, Ivanti VPN, ColdFusion WDDX, Veeam, HTTP/2 Rapid Reset), and Red Team fundamentals.

PoC: php2shell

🐘 Ansible CVE-2026-109618, CVE-2026-109619 scanner

PoC: CVE-2026-26026-GLPI

Minimal source comparison and local lab files for CVE-2026-26026 in GLPI 11.0.5 and 11.0.6

PoC: CVE-2026-98432

Linux kernel IPv4 SYN IP-options use-after-free CVE-2026-98432 Mitigation work (Ansible Role)

PoC: cve-2026-98432-mitigation

Temporary mitigation for CVE-2026-98432 (Linux IPv4 TCP ireq_opt use-after-free): drop IPv4 TCP with IP options, disable MPTCP. Tested scripts + verification. EN/KO.

PoC: kpatch-cve-2026-98432

kpatch livepatch for CVE-2026-98432 (and CVE-2026-99999) on AlmaLinux and Rocky Linux 8, 9 and 10

PoC: phishing-analysis-thm

SOC-style investigation of a Netflix phishing email, CVE-2017-11882 exploitation, IOC extraction, and detection engineering mapping.

PoC: ebs-cve-2026-101767-check

Detect Oracle E-Business Suite exposure to CVE-2026-101767 (Application Object Library, CVSS 9.8): read-only DB patch check and network exposure probe

PoC: CVE-2026-33439

Pre-auth RCE exploit for OpenIdentityPlatform OpenAM <=16.0.5 via Java deserialization of the jato.clientSession parameter (CVE-2026-33439, CVSS 9.8). Comparator-based gadget chain with in-band command output through Tomcat ApplicationFilterChain thread-locals.

PoC: FBI-Tor-Exploit-CVE-2013-1690

Academic cybersecurity research project analyzing and restoring the FBI's 2013 Tor Browser deanonymization exploit, focusing on CVE-2013-1690, Firefox use-after-free vulnerabilities, exploit mechanisms, and historical forensic analysis.

PoC: Bootjack

CVE-2026-97631 C

PoC: CVE-2026-48907

Adapted PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5

PoC: cve-2026-98432-audit

cve-2026-98432 audit script (ipv4 TCP inet_opt/ireq_opt use-after-free)

PoC: php2shell-poc

CLI scanner and PoC for CVE-2026-109618 / CVE-2026-109619 (PHP OOM heap corruption and session upload-progress injection, CVSS 9.2). Affects PHP 5.4.0-8.5.11; patched in 8.2.35, 8.3.36, 8.4.27, 8.5.12. No external dependencies.

PoC: CVE-2026-88804

PoC CVE-2026-88804 (Rancher)

PoC: php2shell-poc

CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.

PoC: CVE-2026-98260-dada-android

Verified CVE-2026-98260 Android port for Xiaomi 15 dada OS4.0.0.22.XOCCNXM

PoC: CVE-2025-4960

Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller Installer

PoC: ghostlock-kirkwood

CVE-2026-43499 (GhostLock) port for the Google TV Streamer (kirkwood / MT8696): single-file, per-boot temporary root + interactive root shell, with a build-matching case study and adaptation guide.

PoC: node2shell

Node2Shell (CVE-2026-111497) detection-only scanner + lab — RedSide Security

PoC: CVE-2026-97555

CVE-2026-97555: heap overflow in the Linux SMB client DACL rewrite (cifs.ko) — analysis, POC, and an arm64 exploit chain ending in a uid-0 credential overwrite on the reference build

PoC: cve-2026-110311-gitea-lab

Local Gitea CVE-2026-110311 reproduction: vulnerable vs patched comparison, Python verifier, recorded evidence, and Turkish report.

PoC: nginx-rift-cve-2026-42945-lab

Interactive NGINX CVE-2026-42945 educational simulation built with HTML, CSS, and JavaScript. Features vulnerable and patched modes, synthetic request inspection, memory visualization, event logging, and security recommendations. No real exploit execution.

PoC: CVE-2026-12118-POC-

POC for CVE-2026-12118

PoC: CVE-2026-104286

Exploit for CVE-2026-104286 — FortiMail: Unauthenticated Arbitrary File Write → Code Execution

PoC: node2shell

Scanner to checking (CVE-2026-111497) vulnerability

PoC: PHP2Shell

CVE-2026-109618 & CVE-2026-109619 — Pre-Auth RCE in PHP Core (session.upload_progress). Scanner, exploit verifier, and full technical analysis.

PoC: CVE-2026-50053

Offline Python detector for CVE-2026-50053 version exposure in Zimbra Collaboration Suite.

PoC: CVE-2026-115889

Offline Python detector for CVE-2026-115889 version exposure in Wasmtime.

PoC: CVE-2026-53921

Offline Python source-pattern auditor for CVE-2026-53921 in odhcpd.

PoC: gitlab-rce-toolkit

CVE-2026-97229 + CVE-2026-110264 — GitLab Onigmo RCE Exploit Toolkit (CVSS 10.0)

PoC: CVE-2026-101259

Reproducer for CVE-2026-101259 — Apache Camel camel-coap consumer sent the exception message to the CoAP client as a 5.00 payload (CWE-209). Camel Spring Boot + Camel Quarkus.

PoC: CVE-2026-71569

Reproducer for CVE-2026-71569 — Apache Camel camel-a2a push-notification webhook guard accepted an IPv6 unique local address (fc00::/7) reached through a host name (CWE-918). Camel Spring Boot + Camel Quarkus.

PoC: RDPBleed

CVE-2026-56190 - Windows RDP Server Uninitialized Resource leads to RCE

PoC: CVE-2026-94386

Reproducer for CVE-2026-94386 — Apache Camel camel-oauth cross-scope token reuse via a JVM-global token cache keyed only on endpoint+clientId (CWE-524). Camel Spring Boot + Camel Quarkus.

PoC: CVE-2026-95629

Reproducer for CVE-2026-95629 — Apache Camel camel-docling passed the CamelDoclingOutputFilePath header to docling's --output verbatim (CWE-22). Camel Spring Boot + Camel Quarkus.

PoC: php2shell-advisory-response

PHP2Shell (CVE-2026-109618 / CVE-2026-109619) advisory response: inventory, patch, Wazuh hunt mapping, attestation outline.

PoC: CVE-2026-95628

Reproducer for CVE-2026-95628 — Apache Camel camel-docling custom-argument path validation did not reject absolute paths, an incomplete fix of CVE-2026-40047 (CWE-22). Camel Spring Boot + Camel Quarkus.

PoC: CVE-2026-95663

Reproducer for CVE-2026-95663 — Apache Camel camel-keycloak served a cached token introspection result past the token's expiry (CWE-613). Camel Spring Boot + Camel Quarkus.

PoC: CVE-2026-97798_LPE_Windows

CVE-2026-97798 PoC — WER Time Travel Debugging argument injection to SYSTEM (Windows 11 LPE), with an adaptive faultrep.dll resolver.

PoC: CVE-2026-95664

Reproducer for CVE-2026-95664 — Apache Camel camel-aws2-s3 evaluated a header-supplied object key as a Simple expression (CWE-917). Camel Spring Boot + Camel Quarkus.

PoC: woff2shell

poc of CVE-2026-111497 delivered as a WOFF2 file

PoC: wiz-bulb-tool

WiZ smart bulb LAN security tool - auto-discovery, CVE-tagged audit, intel recon & device control. Extends CVE-2019-18980 to new hardware. No credentials required.

PoC: CVE-2026-90885

Reproducer for CVE-2026-90885 — Apache Camel camel-saxon XQuery XML External Entity via an already-built javax.xml.transform.Source (CWE-611, HIGH). Camel Spring Boot + Camel Quarkus.

PoC: cve-2026-109618-cve-2026-109619-poc

pHp2Shell CVE 2016 109618 - 109619

PoC: php2shell

Realistic multi-version lab + toolkit for the PHP php2shell pre-auth RCE (CVE-2026-109618/109619): detect, blindly prove, and understand it. No shared mounts, no planted files, no LFI.

PoC: secure-api-cve-2024-23897

Work 1 — secure Flask REST API, three-stage CI, and CVE-2024-23897 (Jenkins CLI) analysis

PoC: charla-php2shell

PHP2Shell (CVE-2026-109618/109619): demos reproducibles y guia de parcheo paso a paso.

PoC: PHP2shell

CVE-2026-109618_CVE-2026-109619

PoC: waffers

The layer that protects you. Proactive defense-in-depth Web Application Firewall mitigating recent critical PHP engine vulnerabilities including PHP2Shell (CVE-2026-109618/9), PHP-CGI Argument Injection (CVE-2024-4577), iconv Filter Chains (CVE-2024-2961), and stream wrapper abuse.

PoC: node2shell-inventory-scanner

Local inventory triage for Node2Shell (CVE-2026-111497): grade every Node, Bun and Brotli copy on disk. Detection-only, no network probes, no payloads.

PoC: php2shell-check

A Claude Skill that passively checks whether a website (and optionally its subdomains) runs PHP, confirms the version where possible, and flags exposure to PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

PoC: CVE-2026-98260-GhostKey

GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）

PoC: CVE-2026-97631-PoC

An educational laboratory for studying a PXE network-boot vulnerability in EDK II / OVMF. It builds a pinned EDK II revision, boots a UEFI virtual machine in QEMU, and includes Python proof-of-concept scripts for investigating denial of service (DoS) and memory corruption.

PoC: practica-integradora-ciberseguridad

Práctica Integradora de Ciberseguridad (Comisión 1) - Investigación, análisis técnico y laboratorio práctico de CVE-2021-41773 (Apache HTTP Server)

PoC: node2shell-audit

Read-only audit for Node2Shell (CVE-2026-111497): Node.js/Bun Brotli decoder out-of-bounds write

PoC: cve-2026-111497-wordpress-poc

CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress

PoC: demo-zip-rce-sandbox

Live demo: the same vulnerable Rust zip crate (RUSTSEC-2026-0367 setuid + CVE-2026-115905 zip cloaking) contained by a deny-by-default Cosmonic WebAssembly sandbox.

PoC: php2leak

Remote Zend MM ASLR leak testbed (PHP CVE-2026-109618 / CVE-2026-109619)

PoC: php2shell

php2shell (CVE-2026-109618/109619) reproduction lab — lab only, targets the vulnerable php:8.5.11 images

PoC: CVE-2026-101767-research

Research notes on CVE-2026-101767 — unauthenticated vulnerability in Oracle Application Object Library (E-Business Suite)

PoC: threat-intelligence-log4shell-analysis

Cybersecurity research project analyzing threat intelligence feeds, Log4Shell (CVE-2021-44228), attack progression, remediation, incident response, and threat hunting.

PoC: CVE-2026-15723

Offline Python detector for CVE-2026-15723 version exposure in self-managed GitLab CE/EE, with CSV/JSON inventories and auditable reports.

PoC: CVE-2026-105014

Offline Python applicability detector for CVE-2026-105014 in Azure Pipelines, with strict CSV/JSON inventories and auditable reports.

PoC: CVE-2026-114625

Offline Python detector for CVE-2026-114625 exposure in on-premises VeloCloud Orchestrator, with train-specific build checks and auditable reports.

PoC: CVE-2026-97785

Offline Python applicability detector for CVE-2026-97785 in Microsoft Entra application proxy, with CSV/JSON inventories and auditable reports.

PoC: CVE-2026-83938

Offline Python applicability detector for CVE-2026-83938 in Azure Kubernetes Configuration Service, with CSV/JSON inventories and auditable reports.