Browse Verified Vulnerability Reproductions

REPRO-2026-00319 published

MariaDB Galera SST remote_auth shell command injection (wsrep_shell_char blacklist bypass) — candidate for v12sec 2026-07-31 0day

critical Security Known vulnerability github

MariaDB/server

84m 16s Aug 1, 2026

REPRO-2026-00318 published

mcp-toolbox authorization bypass: unauthenticated tool invocation via direct HTTP API

CVE-2026-14537 high Security Known vulnerability github

googleapis/genai-toolbox

37m 46s Aug 1, 2026

REPRO-2026-00317 published

Rails Active Storage variant processing arbitrary file read and potential RCE

CVE-2026-66066 critical Security Known vulnerability github

rails/rails

148m 42s Aug 1, 2026

REPRO-2026-00316 published

marimo Pre-Auth RCE via Terminal WebSocket Authentication Bypass (/terminal/ws missing validate_auth)

CVE-2026-39987 critical Security Known vulnerability github

marimo

24m 19s Jul 30, 2026

REPRO-2026-00315 published

Unauthenticated RCE in ruflo MCP bridge default docker-compose deployment

CVE-2026-59726 critical Security Known vulnerability npm

ruflo

34m 45s Jul 30, 2026

REPRO-2026-00314 published

OpenCTI authentication bypass via user impersonation

CVE-2026-27960 critical Security Known vulnerability docker

opencti

44m 34s Jul 30, 2026

REPRO-2026-00312 published

Gitea diffpatch Git hook installation leads to remote code execution

CVE-2026-60004 critical Security Known vulnerability github

go-gitea/gitea

30m 6s Jul 29, 2026

REPRO-2026-00311 published

xrdp Xvnc backend authentication issue on RHEL 9

CVE-2026-55626 high Security Known vulnerability github

neutrinolabs/xrdp

64m 30s Jul 29, 2026

REPRO-2026-00310 published

Flowise arbitrary file access via unvalidated chatflowId/chatId

CVE-2025-71334 critical Security Known vulnerability npm

FlowiseAI/Flowise

66m 57s Jul 28, 2026

REPRO-2026-00309 published

PipeWire sandbox escape via malicious library loading in PulseAudio compatibility layer

CVE-2026-5674 high Security Known vulnerability

pipewire (pipewire-pulse daemon)

88m 8s Jul 28, 2026

REPRO-2026-00308 published

NGINX ASLR-enabled network RCE

CVE-2026-42533 critical Security Known vulnerability github

nginx/nginx

71m 44s Jul 27, 2026

REPRO-2026-00307 published

vBulletin runtime template runMaths pre-auth RCE

CVE-2026-61511 critical Security Discovery hunt

vBulletin

139m 11s Jul 27, 2026

REPRO-2026-00306 published

fastjson2 AutoType type-resolution flaw may lead to remote code execution

critical Security Discovery hunt github

alibaba/fastjson2

108m 42s Jul 27, 2026

REPRO-2026-00305 published

SiYuan missing authorization in /mcp enables unauthenticated administrator takeover via Publish proxy

CVE-2026-66012 critical Security Known vulnerability github

siyuan

171m 57s Jul 27, 2026

REPRO-2026-00304 published

NoteGen chat preview XSS via unsanitized HTML rendering before 0.32.0

CVE-2026-17496 high Security Known vulnerability github

note-gen

78m 29s Jul 27, 2026

REPRO-2026-00303 published

AWS API MCP Server security policy bypass via startup initialization failure

CVE-2026-16584 high Security Known vulnerability pip

awslabs.aws-api-mcp-server

29m 52s Jul 27, 2026

REPRO-2026-00302 published

datamodel-code-generator code injection via customBasePath before 0.70.0

CVE-2026-63720 high Security Known vulnerability pip

datamodel-code-generator

13m 44s Jul 27, 2026

REPRO-2026-00300 published

OpenRemote console registration authentication bypass via known asset identifier

CVE-2026-66013 critical Security Known vulnerability github

openremote

35m 36s Jul 27, 2026

REPRO-2026-00299 published

Horilla protected_media public-prefix normalization bypass: unauthenticated private in-root read on the repaired release

high Security Known vulnerability github

horilla/horilla-hr

84m 5s Jul 27, 2026

REPRO-2026-00298 published

Horilla protected_media composed chain: unauthenticated outside-root file read, with necessity controls for each component defect