Detector + PoC for Linux page-cache write vulnerabilities: Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284/43500). Authorized security research only.

[POC] CVE-2026-43284 — DIRTY-FRAG-Detection-with-Wazuh-4.14.4May 8, 2026

pocexploitCVE-2026-43284

Wazuh 4.14.4 detection rules for CVE-2026-43284 / CVE-2026-43500 (Dirty Frag) - Linux Local Privilege Escalation via page cache write

[POC] CVE-2025-58434 — CVE-2025-58434-PoCMay 8, 2026

pocexploitCVE-2025-58434

CVE-2025-58434 Proof of Concept

[POC] CVE-2026-31431 — ansible-mitigate-copyfail-dirtyfragMay 8, 2026

pocexploitCVE-2026-31431

Simple Ansible Playbook to mitigate against CopyFail (CVE-2026-31431) and DirtyFrag (CVE-2026-43284) vulnerabilities.

[POC] CVE-2022-30190 — CVE-2022-30190-Follina-LabMay 8, 2026

pocexploitCVE-2022-30190

Full exploit chain lab and Suricata IDS detection for CVE-2022-30190 (Follina) - MSDT RCE

[POC] CVE-2026-31431 — pagecache-guardMay 8, 2026

pocexploitCVE-2026-31431

Runtime integrity guard that detects and blocks Linux page cache tampering attacks (Copy Fail CVE-2026-31431, Dirty Pipe, Dirty COW) at execution time. Uses fanotify + O_DIRECT to protect SUID/SGID binaries from privilege escalation via page cache corruption.

[POC] CVE-2026-31431 — Copy-FailMay 8, 2026

pocexploitCVE-2026-31431

CVE-2026-31431 ("Copy Fail") vulnerability detector & exploit

[POC] CVE-2026-31431 — c-copy-failMay 8, 2026

pocexploitCVE-2026-31431

CVE-2026-31431 in C for aarch64 and amd64

[POC] CVE-2026-43284 — Paranoid-Dirty-Frag-CVE-2026-43284May 8, 2026

pocexploitCVE-2026-43284

Paranoid disable Linux IPsec ESP support (esp4/esp6) and RxRPC support.

[POC] CVE-2022-30190 — CVE-2022-30190-Follina-May 8, 2026

pocexploitCVE-2022-30190

CVE-2022-30190 — "Follina" — MSDT remote code execution via Word docs, no macro needed, Defender initially missed it

[POC] CVE-2026-44648 — CVE-2026-44648May 8, 2026

pocexploitCVE-2026-44648

PoC and advisory for CVE-2026-44648

[POC] CVE-2026-43284 — Dirty-Frag-Kubernetes-PoCMay 8, 2026

pocexploitCVE-2026-43284

A proof-of-concept demonstrating how a default, unprivileged Kubernetes Pod can achieve node-level code execution on Amazon EKS by exploiting the Dirty Frag (CVE-2026-43284) Linux kernel page-cache corruption vulnerability through shared container image layers.

[POC] CVE-2026-44578 — next-16.2.4-pocsMay 8, 2026

pocexploitCVE-2026-44578

Next.js v16.2.4 Security PoC Collection (CVE-2026-44578, CVE-2026-44574, CVE-2026-23870, GHSA-267c-6grr-h53f, GHSA-mg66-mrh9-m8jx, CVE-2026-44573, GHSA-gx5p-jg67-6x7h, GHSA-h64f-5h5j-jqjh, GHSA-wfc6-r584-vfw7, CVE-2026-44581, CVE-2026-44582, GHSA-3g8h-86w9-wvmq)

[POC] CVE-2026-31431 — copyfail2-pyMay 8, 2026

pocexploitCVE-2026-31431

One-liner Python LPE for CVE-2026-31431 (CopyFail2). No compilation, no dependencies beyond Python+OpenSSL. Just curl | python3 and get root on Linux 6.5+.

Exploits