https://poc.intelseclab.com/pocs/misc/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-08-09_cve-2026-18718-ghidra-swift-demangler-code-execution/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-08-09_cve-2026-18718-ghidra-swift-demangler-code-execution/High severity (CVSS 7.5) — misc · CVE-2026-18718. Status: Patched. Affects: Ghidra (NSA reverse engineering framework), Swift Demangler analyzer. Tags: ghidra, nsa, reverse-engineering, swift, demangler, code-execution, project-file, analyzer, CWE-427, CWE-494, uncontrolled-search-path, supply-chain, research-tool, shared-project.miscHighghidransareverse-engineeringswiftdemanglercode-executionproject-fileanalyzerCWE-427CWE-494uncontrolled-search-pathsupply-chainresearch-toolshared-projecthttps://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-12735-safe-expr-eval-mitigation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-12735-safe-expr-eval-mitigation/Critical severity (CVSS 9.8) — misc · CVE-2025-12735. Status: Patched. Affects: expr-eval npm package (mathematical/logical expression evaluator). Tags: expr-eval, eval-injection, arbitrary-code-execution, rce, cwe-95, javascript, typescript, npm, expression-parser, mitigation-library, drop-in-replacement.miscCriticalexpr-evaleval-injectionarbitrary-code-executionrcecwe-95javascripttypescriptnpmexpression-parsermitigation-librarydrop-in-replacementhttps://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-4517-tarfile-filter-data-path-max-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-4517-tarfile-filter-data-path-max-bypass/Critical severity (CVSS 9.4) — misc · CVE-2025-4517. Status: Weaponized. Affects: Python standard library tarfile module — filter="data" / filter="tar" extraction filters (PEP 706). Tags: python, tarfile, path-traversal, sandbox-bypass, path_max, realpath, symlink, cwe-22, stdlib.miscCriticalpythontarfilepath-traversalsandbox-bypasspath_maxrealpathsymlinkcwe-22stdlibhttps://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-30065-parquet-avro-schema-deserialization-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-30065-parquet-avro-schema-deserialization-rce/Critical severity (CVSS 9.8) — misc · CVE-2025-30065. Status: PoC. Affects: Apache Parquet Java (parquet-avro module). Tags: rce, ssrf, unsafe-deserialization, parquet-avro, avro-schema, java-class, jvm, cwe-502, cwe-20, incomplete-fix, java.miscCriticalrcessrfunsafe-deserializationparquet-avroavro-schemajava-classjvmcwe-502cwe-20incomplete-fixjavahttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-36851-unpoller-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-36851-unpoller-path-traversal/High severity (CVSS 7.5) — misc · CVE-2026-36851. Status: PoC. Affects: UnPoller (unpoller/unpoller). Tags: unpoller, path-traversal, arbitrary-file-read, unifi, cwe-22, cwe-20.miscHighunpollerpath-traversalarbitrary-file-readunificwe-22cwe-20https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-1814-nexpose-keystore-decrypt/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-1814-nexpose-keystore-decrypt/High severity — misc · CVE-2026-1814. Status: PoC. Affects: Rapid7 Nexpose (vulnerability management platform) credential export/keystore mechanism. Tags: rapid7, nexpose, credential-disclosure, weak-keystore, pkcs12, aes-cbc, offline-decryption.miscHighrapid7nexposecredential-disclosureweak-keystorepkcs12aes-cbcoffline-decryptionhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-24688-pypdf-outline-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-24688-pypdf-outline-dos/High severity — misc · CVE-2026-24688. Status: PoC. Affects: pypdf (Python PDF library). Tags: pypdf, python, denial-of-service, infinite-loop, malicious-pdf, memory-exhaustion, outline-parsing, cwe-835.miscHighpypdfpythondenial-of-serviceinfinite-loopmalicious-pdfmemory-exhaustionoutline-parsingcwe-835https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-31900-psf-black-action-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-31900-psf-black-action-rce/High severity (CVSS 8.7) — misc · CVE-2026-31900 (GHSA-v53h-f6m7-xcgm). Status: PoC. Affects: psf/black GitHub Action. Tags: github-actions, supply-chain, rce, regex, pep508, ci-cd, secrets-theft, psf-black.miscHighgithub-actionssupply-chainrceregexpep508ci-cdsecrets-theftpsf-blackhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23947-orval-codegen-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23947-orval-codegen-rce/High severity — misc · CVE-2026-23947. Status: PoC. Affects: Orval (OpenAPI-to-TypeScript client generator), version 7.10.0. Tags: orval, openapi, code-generation, arbitrary-code-execution, nodejs, supply-chain, typescript, build-tooling.miscHighorvalopenapicode-generationarbitrary-code-executionnodejssupply-chaintypescriptbuild-toolinghttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-7482-poc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-7482-poc/Medium severity — misc · CVE-2026-7482. Status: PoC. Affects: Ollama (GGUF model loader / quantization pipeline). Tags: ollama, gguf, heap-overflow, out-of-bounds-read, quantization, llm-serving, docker.miscMediumollamaggufheap-overflowout-of-bounds-readquantizationllm-servingdockerhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-2395-tar-race-condition/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-2395-tar-race-condition/Medium severity — misc · CVE-2026-2395. Status: PoC. Affects: tar npm package. Tags: tar, nodejs, npm, race-condition, unicode-normalization, file-collision, archive-extraction, data-corruption.miscMediumtarnodejsnpmrace-conditionunicode-normalizationfile-collisionarchive-extractiondata-corruptionhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-29786-node-tar-symlink-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-29786-node-tar-symlink-traversal/High severity — misc · CVE-2026-29786. Status: PoC. Affects: tar npm package (Node.js). Tags: node-tar, path-traversal, symlink, archive-extraction, arbitrary-file-write, nodejs, supply-chain.miscHighnode-tarpath-traversalsymlinkarchive-extractionarbitrary-file-writenodejssupply-chainhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23745-node-tar-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23745-node-tar-path-traversal/High severity — misc · CVE-2026-23745 / GHSA-8qq5-rm4j-mr97. Status: PoC. Affects: node-tar (npm package tar). Tags: node-tar, path-traversal, arbitrary-file-overwrite, hardlink, symlink, supply-chain, nodejs, tar-archive.miscHighnode-tarpath-traversalarbitrary-file-overwritehardlinksymlinksupply-chainnodejstar-archivehttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-58138-conductor-unauth-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-58138-conductor-unauth-rce/Critical severity (CVSS 9.8) — misc · CVE-2026-58138 ([VulnCheck advisory](https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators)). Status: PoC. Affects: Conductor (OSS / Orkes workflow orchestration engine), community API. Tags: conductor, orkes, graalvm, script-evaluator, host-access, workflow-engine, unauth-rce.miscCriticalconductororkesgraalvmscript-evaluatorhost-accessworkflow-engineunauth-rcehttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-8161-multiparty-prototype-pollution-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-8161-multiparty-prototype-pollution-dos/Medium severity — misc · CVE-2026-8161 / GHSA-qxch-whhj-8956. Status: PoC. Affects: multiparty (npm package, multipart/form-data parser). Tags: multiparty, nodejs, prototype-pollution, denial-of-service, cwe-1321, uncaught-exception, multipart-parser.miscMediummultipartynodejsprototype-pollutiondenial-of-servicecwe-1321uncaught-exceptionmultipart-parserhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-26030-semantic-kernel-eval-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-26030-semantic-kernel-eval-rce/Critical severity — misc · CVE-2026-26030. Status: Weaponized. Affects: Microsoft Semantic Kernel (Python), InMemoryCollection vector store connector. Tags: semantic-kernel, python, eval-injection, sandbox-bypass, prompt-injection, llm-agent, rce, ast-allowlist-bypass, vector-store.miscCriticalsemantic-kernelpythoneval-injectionsandbox-bypassprompt-injectionllm-agentrceast-allowlist-bypassvector-storehttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-21509-office-ole-docx-clsid-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-21509-office-ole-docx-clsid-rce/High severity — misc · CVE-2026-21509. Status: PoC. Affects: Microsoft Office (Word) OLE embedded-object handling. Tags: office, docx, ole, clsid, document-weaponization, embedded-object, python, malicious-document.miscHighofficedocxoleclsiddocument-weaponizationembedded-objectpythonmalicious-documenthttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-6130-local-mcp-exec-sandbox-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-6130-local-mcp-exec-sandbox-bypass/Medium severity — misc · CVE-2026-6130. Status: PoC. Affects: local-mcp (zero-dependency MCP server for local file operations, v1.1.1). Tags: mcp, model-context-protocol, sandbox-bypass, command-execution, exec-restriction-bypass.miscMediummcpmodel-context-protocolsandbox-bypasscommand-executionexec-restriction-bypasshttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-30952-liquidjs-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-30952-liquidjs-path-traversal/High severity (CVSS 8.7) — misc · CVE-2026-30952 (GHSA-wmfp-5q7x-987x). Status: PoC. Affects: liquidjs npm package (LiquidJS template engine). Tags: liquidjs, path-traversal, template-engine, arbitrary-file-read, nodejs, library, ssti-adjacent.miscHighliquidjspath-traversaltemplate-enginearbitrary-file-readnodejslibraryssti-adjacenthttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-28995-ios-appintents-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-28995-ios-appintents-path-traversal/High severity — misc · CVE-2026-28995. Status: PoC. Affects: Apple App Intents framework (iOS). Tags: ios, app-intents, path-traversal, sandbox-escape, swift, file-disclosure, mobile.miscHighiosapp-intentspath-traversalsandbox-escapeswiftfile-disclosuremobilehttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-56121-feast-unauth-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-56121-feast-unauth-rce/Critical severity (CVSS 9.8) — misc · CVE-2026-56121. Status: PoC. Affects: Feast (open-source feature store) registry gRPC server. Tags: feast, feature-store, dill, pickle, deserialization, grpc, unauth-rce, mlops.miscCriticalfeastfeature-storedillpickledeserializationgrpcunauth-rcemlopshttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-43893-exiftool-vendored-arg-injection-file-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-43893-exiftool-vendored-arg-injection-file-write/High severity (CVSS 8.2) — misc · CVE-2026-43893 / GHSA-cw26-7653-2rp5. Status: PoC. Affects: exiftool-vendored (npm package, Node.js wrapper around Phil Harvey's ExifTool). Tags: exiftool, exiftool-vendored, argument-injection, arbitrary-file-write, arbitrary-file-read, nodejs, cli-wrapper, newline-injection.miscHighexiftoolexiftool-vendoredargument-injectionarbitrary-file-writearbitrary-file-readnodejscli-wrappernewline-injectionhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-24009-docling-core-yaml-deserialization/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-24009-docling-core-yaml-deserialization/High severity — misc · CVE-2026-24009. Status: PoC. Affects: docling-core (Python library). Tags: docling-core, yaml-deserialization, pyyaml, unsafe-loader, rce, python, cwe-502.miscHighdocling-coreyaml-deserializationpyyamlunsafe-loaderrcepythoncwe-502https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-54316-claude-code-webfetch-hf-exfil/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-54316-claude-code-webfetch-hf-exfil/Medium severity — misc · CVE-2026-54316 (GHSA-fg94-h982-f3mm). Status: PoC. Affects: @anthropic-ai/claude-code (npm package, Claude Code CLI). Tags: claude-code, webfetch, prompt-injection, exfiltration, huggingface, allow-list-bypass, agentic-ai, docker-lab, cwe-183.miscMediumclaude-codewebfetchprompt-injectionexfiltrationhuggingfaceallow-list-bypassagentic-aidocker-labcwe-183https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23842-chatterbot-dos-pool-exhaustion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23842-chatterbot-dos-pool-exhaustion/High severity (CVSS 7.5) — misc · CVE-2026-23842. Status: PoC. Affects: ChatterBot (Python conversational AI library). Tags: chatterbot, denial-of-service, sqlalchemy, connection-pool-exhaustion, python, cwe-400, resource-exhaustion.miscHighchatterbotdenial-of-servicesqlalchemyconnection-pool-exhaustionpythoncwe-400resource-exhaustionhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-39973-apktool-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-39973-apktool-path-traversal/High severity — misc · CVE-2026-39973. Status: PoC. Affects: iBotPeaches/Apktool (Android APK decompiler/rebuilder). Tags: apktool, path-traversal, resources-arsc, apk, decompilation, arbitrary-file-write, android-tooling.miscHighapktoolpath-traversalresources-arscapkdecompilationarbitrary-file-writeandroid-toolinghttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-22807-vllm-trust-remote-code-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-22807-vllm-trust-remote-code-bypass/High severity — misc · CVE-2026-22807. Status: PoC. Affects: AI inference/model-loading frameworks that resolve custom model classes via auto_map before validating trust_remote_code (pattern seen in vLLM/Transformers-style loaders). Tags: vllm, huggingface, trust-remote-code, toctou, model-loading, supply-chain, python, code-execution.miscHighvllmhuggingfacetrust-remote-codetoctoumodel-loadingsupply-chainpythoncode-executionhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-3462-acrobat-pdf-exploit-generator/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-3462-acrobat-pdf-exploit-generator/Critical severity — misc · CVE-2026-3462 (repo internally references CVE-2026-34621 — CVE-ID mismatch, see Notes). Status: Weaponized. Affects: Adobe Acrobat / Acrobat Reader (DC Continuous and 2024 Classic tracks). Tags: pdf, exploit-generator, prototype-pollution, sandbox-escape, evasion, persistence, malware-generator, farmed-repo-suspected.miscCriticalpdfexploit-generatorprototype-pollutionsandbox-escapeevasionpersistencemalware-generatorfarmed-repo-suspectedhttps://poc.intelseclab.com/pocs/misc/2026-07-03_7zip-rar5-motw-ads-bypass/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-03_7zip-rar5-motw-ads-bypass/High severity — misc · None assigned as of 2026-07-03. Status: PoC. Affects: 7-Zip 26.01 x64 for Windows. Tags: 7-zip, rar5, mark-of-the-web, alternate-data-streams, ntfs, motw-bypass, windows, archive-extraction.miscHigh7-ziprar5mark-of-the-webalternate-data-streamsntfsmotw-bypasswindowsarchive-extractionhttps://poc.intelseclab.com/pocs/misc/2026-07-01_cve-2025-8088-winrar-ads-path-traversal/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-01_cve-2025-8088-winrar-ads-path-traversal/High severity (CVSS 8.4) — misc · CVE-2025-8088. Status: Weaponized. Affects: WinRAR (Windows). Tags: path-traversal, WinRAR, NTFS, Alternate-Data-Streams, RomCom, Storm-0978, persistence, startup-folder, in-the-wild.miscHighpath-traversalWinRARNTFSAlternate-Data-StreamsRomComStorm-0978persistencestartup-folderin-the-wildhttps://poc.intelseclab.com/pocs/misc/2026-06-26_yellowkey-bitlocker-bypass/Fri, 26 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-06-26_yellowkey-bitlocker-bypass/Medium severity (CVSS 6.1) — misc · CVE-2026-45585. Status: Researched. Affects: Windows BitLocker / WinRE (autofstx.exe). Tags: BitLocker, bypass, physical-access, WinRE, TPM, autofstx, NTFS-transactions, FsTx, Windows-11, Windows-Server-2022, zero-day, full-disk-access.miscMediumBitLockerbypassphysical-accessWinRETPMautofstxNTFS-transactionsFsTxWindows-11Windows-Server-2022zero-dayfull-disk-accesshttps://poc.intelseclab.com/pocs/misc/2026-05-16_apache-parquet-unsafe-deserialization-rce/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-05-16_apache-parquet-unsafe-deserialization-rce/Critical severity (CVSS 10) — misc · CVE-2025-30065. Status: Weaponized. Affects: Apache Parquet Java (parquet-avro) schema parsing consumers. Tags: RCE, unsafe-deserialization, parquet-avro, avro-schema, Java, JVM, SSRF, data-pipeline.miscCriticalRCEunsafe-deserializationparquet-avroavro-schemaJavaJVMSSRFdata-pipelinehttps://poc.intelseclab.com/pocs/misc/2026-05-15_winrar-path-traversal-cve-2025-6218/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-05-15_winrar-path-traversal-cve-2025-6218/High severity — misc · CVE-2025-6218. Status: Weaponized. Affects: WinRAR archive extraction workflow. Tags: path-traversal, arbitrary-file-write, startup-folder, WinRAR, Windows, user-interaction.miscHighpath-traversalarbitrary-file-writestartup-folderWinRARWindowsuser-interaction