https://poc.intelseclab.com/tags/zero-day/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_greatxml-winre-bitlocker-bypass/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_greatxml-winre-bitlocker-bypass/High severity — binary · N/A (no CVE assigned, no Microsoft advisory as of 2026-07-27). Status: Unpatched. Affects: Windows Recovery Environment (WinRE) — Microsoft Defender Offline Scan launch path (ReAgent.xml scheduled operation). Tags: windows, bitlocker, winre, defender, offline-scan, trust-boundary-bypass, zero-day, unpatched, physical-access, local.binaryHighwindowsbitlockerwinredefenderoffline-scantrust-boundary-bypasszero-dayunpatchedphysical-accesslocalhttps://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-11645-chrome-v8-oob-crash/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-11645-chrome-v8-oob-crash/High severity (CVSS 8.8) — web · CVE-2026-11645. Status: Incomplete PoC (crash only — no confirmed public RCE chain). Affects: Google Chrome / Chromium — V8 JavaScript and WebAssembly engine. Tags: browser, chrome, v8, javascript, turbofan, out-of-bounds, memory-corruption, zero-day, incomplete-poc, active-exploitation.webHighbrowserchromev8javascriptturbofanout-of-boundsmemory-corruptionzero-dayincomplete-pocactive-exploitationhttps://poc.intelseclab.com/pocs/binary/2026-06-28_cve-2026-45586-ctfmon-greenplasma-lpe/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-28_cve-2026-45586-ctfmon-greenplasma-lpe/High severity (CVSS 7.8) — binary · CVE-2026-45586. Status: PoC. Affects: Windows Collaborative Translation Framework (CTFMON service). Tags: LPE, EoP, Windows, CTFMON, section-object, object-directory, link-following, zero-day, CTF-challenge, Windows-11, Windows-2022, Windows-2026, incomplete-poc.binaryHighLPEEoPWindowsCTFMONsection-objectobject-directorylink-followingzero-dayCTF-challengeWindows-11Windows-2022Windows-2026incomplete-pochttps://poc.intelseclab.com/pocs/misc/2026-06-26_yellowkey-bitlocker-bypass/Fri, 26 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-06-26_yellowkey-bitlocker-bypass/Medium severity (CVSS 6.1) — misc · CVE-2026-45585. Status: Researched. Affects: Windows BitLocker / WinRE (autofstx.exe). Tags: BitLocker, bypass, physical-access, WinRE, TPM, autofstx, NTFS-transactions, FsTx, Windows-11, Windows-Server-2022, zero-day, full-disk-access.miscMediumBitLockerbypassphysical-accessWinRETPMautofstxNTFS-transactionsFsTxWindows-11Windows-Server-2022zero-dayfull-disk-accesshttps://poc.intelseclab.com/pocs/binary/2026-05-17_windows-mmc-eviltwin-cve-2025-26633/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-mmc-eviltwin-cve-2025-26633/High severity — binary · CVE-2025-26633. Status: Patched. Affects: Microsoft Management Console (MMC), Windows. Tags: RCE, Windows, MMC, MSC, ActiveX, EvilTwin, APT, EncryptHub, Water-Gamayun, zero-day, in-the-wild.binaryHighRCEWindowsMMCMSCActiveXEvilTwinAPTEncryptHubWater-Gamayunzero-dayin-the-wildhttps://poc.intelseclab.com/pocs/web/2026-05-17_pan-os-globalprotect-unauth-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_pan-os-globalprotect-unauth-rce/Critical severity (CVSS 10) — web · CVE-2024-3400. Status: Weaponized. Affects: Palo Alto Networks PAN-OS GlobalProtect gateway. Tags: RCE, command-injection, path-traversal, PAN-OS, GlobalProtect, unauthenticated, zero-day.webCriticalRCEcommand-injectionpath-traversalPAN-OSGlobalProtectunauthenticatedzero-dayhttps://poc.intelseclab.com/pocs/network/2026-05-17_ivanti-connect-secure-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-17_ivanti-connect-secure-rce/Critical severity (CVSS 9) — network · CVE-2025-0282. Status: Weaponized. Affects: Ivanti Connect Secure, Ivanti Policy Secure, Ivanti ZTA Gateways. Tags: RCE, stack-overflow, buffer-overflow, pre-auth, unauthenticated, VPN, zero-day, active-exploitation, Ivanti, TLS.networkCriticalRCEstack-overflowbuffer-overflowpre-authunauthenticatedVPNzero-dayactive-exploitationIvantiTLShttps://poc.intelseclab.com/pocs/network/2026-05-17_fortimanager-fortijump-rce-cve-2024-47575/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-17_fortimanager-fortijump-rce-cve-2024-47575/Critical severity (CVSS 9.8) — network · CVE-2024-47575. Status: Weaponized. Affects: Fortinet FortiManager / FortiManager Cloud (fgfmd daemon). Tags: RCE, unauthenticated, FortiManager, fgfmd, zero-day, KEV.networkCriticalRCEunauthenticatedFortiManagerfgfmdzero-dayKEV