misc PoCs

subscribe (RSS)

Proof-of-concept research filed under the misc category.

Entries

33

in misc

CISA KEV

3

exploited in the wild

Ransomware

1

known campaign use

Unpatched

7

no vendor fix

Critical

8

24% of listed

33 entries

Severity

Exploitation signals

Patch status

Date range

→

Sort

33 result(s)

MISC LIST 33 shown · 33 indexed

PoC title	CVE	Category	Severity	Patch	Date
Ghidra — Swift Demangler Arbitrary Code Execution via Shared Project Files (CVE-2026-18718) new CVE-2026-18718 misc Patched	CVE-2026-18718	misc	HIGH 7.5	Patched	2026-08-09
safe-expr-eval: Mitigation Library for the expr-eval Unsafe eval() RCE (CVE-2025-12735) new CVE-2025-12735 misc Patched	CVE-2025-12735	misc	CRITICAL 9.8	Patched	2026-07-06
Python tarfile `filter="data"` Bypass via PATH_MAX/realpath Confusion (CVE-2025-4517) new CVE-2025-4517 misc Patched	CVE-2025-4517	misc	CRITICAL 9.4	Patched	2026-07-06
Apache Parquet-Avro Schema Deserialization RCE/SSRF — Incomplete-Fix Bypass (CVE-2025-30065) new EPSS 43% CVE-2025-30065 misc Patched	CVE-2025-30065	misc	CRITICAL 9.8	Patched	2026-07-06
UnPoller Path Traversal / Arbitrary File Read via file:// Password Prefix (CVE-2026-36851) new CVE-2026-36851 misc Unverified	CVE-2026-36851	misc	HIGH 7.5	Unverified	2026-07-05
Rapid7 Nexpose Weak Keystore Entropy Credential Decryption — CVE-2026-1814 new CVE-2026-1814 misc Unverified	CVE-2026-1814	misc	HIGH	Unverified	2026-07-05
pypdf Circular Outline Reference Infinite-Loop DoS (CVE-2026-24688) new CVE-2026-24688 misc Patched	CVE-2026-24688	misc	HIGH	Patched	2026-07-05
psf/black GitHub Action RCE via Insecure Regex Version Validation — CVE-2026-31900 new CVE-2026-31900 (GHSA-v53h-f6m7-xcgm) misc Patched	CVE-2026-31900	misc	HIGH 8.7	Patched	2026-07-05
Orval OpenAPI Codegen Arbitrary Code Execution via Malicious Spec (CVE-2026-23947) new CVE-2026-23947 misc Patched	CVE-2026-23947	misc	HIGH	Patched	2026-07-05
Ollama GGUF Heap Out-of-Bounds Read During Quantization — CVE-2026-7482 new CVE-2026-7482 misc Patched	CVE-2026-7482	misc	MEDIUM	Patched	2026-07-05
npm `tar` Package Unicode-Normalization Race Condition / File Collision (CVE-2026-2395) new CVE-2026-2395 misc Unverified	CVE-2026-2395	misc	MEDIUM	Unverified	2026-07-05
Node.js `tar` Package Symlink Path Traversal — CVE-2026-29786 new CVE-2026-29786 misc Patched	CVE-2026-29786	misc	HIGH	Patched	2026-07-05
node-tar Hardlink/Symlink Path Traversal Arbitrary File Overwrite (CVE-2026-23745) new CVE-2026-23745 / GHSA-8qq5-rm4j-mr97 misc Patched	CVE-2026-23745 / GHSA-8qq5-rm4j-mr97	misc	HIGH	Patched	2026-07-05
Netflix Conductor Unauthenticated RCE via INLINE GraalVM Evaluator — CVE-2026-58138 new CVE-2026-58138 ([VulnCheck advisory](https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators)) misc Patched	CVE-2026-58138	misc	CRITICAL 9.8	Patched	2026-07-05
Multiparty Denial of Service via Prototype-Pollution Field Name (CVE-2026-8161) new CVE-2026-8161 / GHSA-qxch-whhj-8956 misc Patched	CVE-2026-8161 / GHSA-qxch-whhj-8956	misc	MEDIUM	Patched	2026-07-05
Microsoft Semantic Kernel In-Memory Vector Store Filter eval() Sandbox Bypass RCE (CVE-2026-26030) new CVE-2026-26030 misc Patched	CVE-2026-26030	misc	CRITICAL	Patched	2026-07-05
Malicious DOCX/OLE CLSID Object Embedding Builder (CVE-2026-21509) new KEV EPSS 73% CVE-2026-21509 misc Unverified	CVE-2026-21509	misc	HIGH	Unverified	2026-07-05
local-mcp exec Tool Sandbox/Restriction Bypass (CVE-2026-6130) new CVE-2026-6130 misc Unverified	CVE-2026-6130	misc	MEDIUM	Unverified	2026-07-05
LiquidJS Template Engine Path Traversal — CVE-2026-30952 new CVE-2026-30952 (GHSA-wmfp-5q7x-987x) misc Patched	CVE-2026-30952	misc	HIGH 8.7	Patched	2026-07-05
iOS App Intents Path Traversal — CVE-2026-28995 new CVE-2026-28995 misc Patched	CVE-2026-28995	misc	HIGH	Patched	2026-07-05
Feast Registry gRPC Unauthenticated RCE via dill.loads — CVE-2026-56121 new CVE-2026-56121 misc Patched	CVE-2026-56121	misc	CRITICAL 9.8	Patched	2026-07-05
exiftool-vendored.js Argument Injection via Newline-Delimited Tag Names (CVE-2026-43893) new CVE-2026-43893 / GHSA-cw26-7653-2rp5 misc Patched	CVE-2026-43893 / GHSA-cw26-7653-2rp5	misc	HIGH 8.2	Patched	2026-07-05
docling-core Unsafe YAML Deserialization Leading to Code Execution — CVE-2026-24009 new CVE-2026-24009 misc Patched	CVE-2026-24009	misc	HIGH	Patched	2026-07-05
Claude Code WebFetch Hardcoded HuggingFace Bare-Hostname Allow-List Bypass — CVE-2026-54316 new CVE-2026-54316 (GHSA-fg94-h982-f3mm) misc Patched	CVE-2026-54316	misc	MEDIUM	Patched	2026-07-05
ChatterBot Denial of Service via SQLAlchemy Connection Pool Exhaustion (CVE-2026-23842) new CVE-2026-23842 misc Patched	CVE-2026-23842	misc	HIGH 7.5	Patched	2026-07-05
Apktool Resource Table Path Traversal — Malicious APK Builder (CVE-2026-39973) new CVE-2026-39973 misc Patched	CVE-2026-39973	misc	HIGH	Patched	2026-07-05
AI Model-Loader `trust_remote_code` Order-of-Operations RCE Simulation (CVE-2026-22807) new CVE-2026-22807 misc Patched	CVE-2026-22807	misc	HIGH	Patched	2026-07-05
Adobe Acrobat/Reader PDF Exploit Generator — Claimed Prototype Pollution (CVE-2026-3462) new CVE-2026-3462 (repo internally references CVE-2026-34621 — CVE-ID mismatch, see Notes) misc Patched	CVE-2026-3462	misc	CRITICAL	Patched	2026-07-05
7-Zip RAR5 Mark-of-the-Web / ADS Full-Chain Bypass new None assigned as of 2026-07-03 misc Unverified	None assigned as of 2026-07-03	misc	HIGH	Unverified	2026-07-03
WinRAR Windows Path Traversal via NTFS Alternate Data Streams (CVE-2025-8088) new KEV RW EPSS 95% CVE-2025-8088 misc Patched	CVE-2025-8088	misc	HIGH 8.4	Patched	2026-07-01
YellowKey — BitLocker Bypass via WinRE autofstx.exe (CVE-2026-45585) new CVE-2026-45585 misc Patched	CVE-2026-45585	misc	MEDIUM 6.1	Patched	2026-06-26
Apache Parquet Java Unsafe Deserialization RCE (CVE-2025-30065) new EPSS 43% CVE-2025-30065 misc Patched	CVE-2025-30065	misc	CRITICAL 10	Patched	2026-05-16
WinRAR Archive Extraction Path Traversal (CVE-2025-6218) new KEV EPSS 90% CVE-2025-6218 misc Unverified	CVE-2025-6218	misc	HIGH	Unverified	2026-05-15